Edit File by line

/* $NetBSD: auth.h,v 1.15 2000/06/02 22:57:55 fvdl Exp $ */

[0] Fix | Delete

[1] Fix | Delete

[2] Fix | Delete

[3] Fix | Delete

[4] Fix | Delete

[5] Fix | Delete

* Redistribution and use in source and binary forms, with or without

[6] Fix | Delete

* modification, are permitted provided that the following conditions are met:

[7] Fix | Delete

* - Redistributions of source code must retain the above copyright notice,

[8] Fix | Delete

* this list of conditions and the following disclaimer.

[9] Fix | Delete

* - Redistributions in binary form must reproduce the above copyright notice,

[10] Fix | Delete

* this list of conditions and the following disclaimer in the documentation

[11] Fix | Delete

* and/or other materials provided with the distribution.

[12] Fix | Delete

* - Neither the name of Sun Microsystems, Inc. nor the names of its

[13] Fix | Delete

* contributors may be used to endorse or promote products derived

[14] Fix | Delete

* from this software without specific prior written permission.

[15] Fix | Delete

[16] Fix | Delete

* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

[17] Fix | Delete

* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

[18] Fix | Delete

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

[19] Fix | Delete

* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE

[20] Fix | Delete

* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

[21] Fix | Delete

* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

[22] Fix | Delete

* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

[23] Fix | Delete

* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

[24] Fix | Delete

* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

[25] Fix | Delete

* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

[26] Fix | Delete

* POSSIBILITY OF SUCH DAMAGE.

[27] Fix | Delete

[28] Fix | Delete

* from: @(#)auth.h 1.17 88/02/08 SMI

[29] Fix | Delete

* from: @(#)auth.h 2.3 88/08/07 4.0 RPCSRC

[30] Fix | Delete

* from: @(#)auth.h 1.43 98/02/02 SMI

[31] Fix | Delete

* $FreeBSD: src/include/rpc/auth.h,v 1.20 2003/01/01 18:48:42 schweikh Exp $

[32] Fix | Delete

[33] Fix | Delete

[34] Fix | Delete

[35] Fix | Delete

* auth.h, Authentication interface.

[36] Fix | Delete

[37] Fix | Delete

[38] Fix | Delete

[39] Fix | Delete

* The data structures are completely opaque to the client. The client

[40] Fix | Delete

* is required to pass an AUTH * to routines that create rpc

[41] Fix | Delete

* "sessions".

[42] Fix | Delete

[43] Fix | Delete

[44] Fix | Delete

#ifndef _TIRPC_AUTH_H

[45] Fix | Delete

#define _TIRPC_AUTH_H

[46] Fix | Delete

[47] Fix | Delete

#include <rpc/xdr.h>

[48] Fix | Delete

#include <rpc/clnt_stat.h>

[49] Fix | Delete

#include <sys/socket.h>

[50] Fix | Delete

#include <sys/types.h>

[51] Fix | Delete

[52] Fix | Delete

[53] Fix | Delete

#define MAX_AUTH_BYTES 400

[54] Fix | Delete

#define MAXNETNAMELEN 255 /* maximum length of network user's name */

[55] Fix | Delete

[56] Fix | Delete

[57] Fix | Delete

* Client side authentication/security data

[58] Fix | Delete

[59] Fix | Delete

[60] Fix | Delete

typedef struct sec_data {

[61] Fix | Delete

u_int secmod; /* security mode number e.g. in nfssec.conf */

[62] Fix | Delete

u_int rpcflavor; /* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */

[63] Fix | Delete

int flags; /* AUTH_F_xxx flags */

[64] Fix | Delete

caddr_t data; /* opaque data per flavor */

[65] Fix | Delete

} sec_data_t;

[66] Fix | Delete

[67] Fix | Delete

#ifdef _SYSCALL32_IMPL

[68] Fix | Delete

struct sec_data32 {

[69] Fix | Delete

uint32_t secmod; /* security mode number e.g. in nfssec.conf */

[70] Fix | Delete

uint32_t rpcflavor; /* rpc flavors:AUTH_UNIX,AUTH_DES,RPCSEC_GSS */

[71] Fix | Delete

int32_t flags; /* AUTH_F_xxx flags */

[72] Fix | Delete

caddr32_t data; /* opaque data per flavor */

[73] Fix | Delete

};

[74] Fix | Delete

#endif /* _SYSCALL32_IMPL */

[75] Fix | Delete

[76] Fix | Delete

[77] Fix | Delete

* AUTH_DES flavor specific data from sec_data opaque data field.

[78] Fix | Delete

* AUTH_KERB has the same structure.

[79] Fix | Delete

[80] Fix | Delete

typedef struct des_clnt_data {

[81] Fix | Delete

struct netbuf syncaddr; /* time sync addr */

[82] Fix | Delete

struct knetconfig *knconf; /* knetconfig info that associated */

[83] Fix | Delete

/* with the syncaddr. */

[84] Fix | Delete

char *netname; /* server's netname */

[85] Fix | Delete

int netnamelen; /* server's netname len */

[86] Fix | Delete

} dh_k4_clntdata_t;

[87] Fix | Delete

[88] Fix | Delete

#ifdef _SYSCALL32_IMPL

[89] Fix | Delete

struct des_clnt_data32 {

[90] Fix | Delete

struct netbuf32 syncaddr; /* time sync addr */

[91] Fix | Delete

caddr32_t knconf; /* knetconfig info that associated */

[92] Fix | Delete

/* with the syncaddr. */

[93] Fix | Delete

caddr32_t netname; /* server's netname */

[94] Fix | Delete

int32_t netnamelen; /* server's netname len */

[95] Fix | Delete

};

[96] Fix | Delete

#endif /* _SYSCALL32_IMPL */

[97] Fix | Delete

[98] Fix | Delete

[99] Fix | Delete

* authentication/security specific flags

[100] Fix | Delete

[101] Fix | Delete

#define AUTH_F_RPCTIMESYNC 0x001 /* use RPC to do time sync */

[102] Fix | Delete

#define AUTH_F_TRYNONE 0x002 /* allow fall back to AUTH_NONE */

[103] Fix | Delete

[104] Fix | Delete

[105] Fix | Delete

[106] Fix | Delete

* Status returned from authentication check

[107] Fix | Delete

[108] Fix | Delete

enum auth_stat {

[109] Fix | Delete

AUTH_OK=0,

[110] Fix | Delete

[111] Fix | Delete

* failed at remote end

[112] Fix | Delete

[113] Fix | Delete

AUTH_BADCRED=1, /* bogus credentials (seal broken) */

[114] Fix | Delete

AUTH_REJECTEDCRED=2, /* client should begin new session */

[115] Fix | Delete

AUTH_BADVERF=3, /* bogus verifier (seal broken) */

[116] Fix | Delete

AUTH_REJECTEDVERF=4, /* verifier expired or was replayed */

[117] Fix | Delete

AUTH_TOOWEAK=5, /* rejected due to security reasons */

[118] Fix | Delete

[119] Fix | Delete

* failed locally

[120] Fix | Delete

[121] Fix | Delete

AUTH_INVALIDRESP=6, /* bogus response verifier */

[122] Fix | Delete

AUTH_FAILED=7, /* some unknown reason */

[123] Fix | Delete

[124] Fix | Delete

* kerberos errors

[125] Fix | Delete

[126] Fix | Delete

AUTH_KERB_GENERIC = 8, /* kerberos generic error */

[127] Fix | Delete

AUTH_TIMEEXPIRE = 9, /* time of credential expired */

[128] Fix | Delete

AUTH_TKT_FILE = 10, /* something wrong with ticket file */

[129] Fix | Delete

AUTH_DECODE = 11, /* can't decode authenticator */

[130] Fix | Delete

AUTH_NET_ADDR = 12, /* wrong net address in ticket */

[131] Fix | Delete

[132] Fix | Delete

* RPCSEC_GSS errors

[133] Fix | Delete

[134] Fix | Delete

RPCSEC_GSS_CREDPROBLEM = 13,

[135] Fix | Delete

RPCSEC_GSS_CTXPROBLEM = 14

[136] Fix | Delete

[137] Fix | Delete

};

[138] Fix | Delete

[139] Fix | Delete

typedef u_int32_t u_int32; /* 32-bit unsigned integers */

[140] Fix | Delete

[141] Fix | Delete

union des_block {

[142] Fix | Delete

struct {

[143] Fix | Delete

u_int32_t high;

[144] Fix | Delete

u_int32_t low;

[145] Fix | Delete

} key;

[146] Fix | Delete

char c[8];

[147] Fix | Delete

};

[148] Fix | Delete

typedef union des_block des_block;

[149] Fix | Delete

#ifdef __cplusplus

[150] Fix | Delete

extern "C" {

[151] Fix | Delete

#endif

[152] Fix | Delete

extern bool_t xdr_des_block(XDR *, des_block *);

[153] Fix | Delete

#ifdef __cplusplus

[154] Fix | Delete

}

[155] Fix | Delete

#endif

[156] Fix | Delete

[157] Fix | Delete

[158] Fix | Delete

* Authentication info. Opaque to client.

[159] Fix | Delete

[160] Fix | Delete

struct opaque_auth {

[161] Fix | Delete

enum_t oa_flavor; /* flavor of auth */

[162] Fix | Delete

caddr_t oa_base; /* address of more auth stuff */

[163] Fix | Delete

u_int oa_length; /* not to exceed MAX_AUTH_BYTES */

[164] Fix | Delete

};

[165] Fix | Delete

[166] Fix | Delete

[167] Fix | Delete

[168] Fix | Delete

* Auth handle, interface to client side authenticators.

[169] Fix | Delete

[170] Fix | Delete

typedef struct __auth {

[171] Fix | Delete

struct opaque_auth ah_cred;

[172] Fix | Delete

struct opaque_auth ah_verf;

[173] Fix | Delete

union des_block ah_key;

[174] Fix | Delete

struct auth_ops {

[175] Fix | Delete

void (*ah_nextverf) (struct __auth *);

[176] Fix | Delete

/* nextverf & serialize */

[177] Fix | Delete

int (*ah_marshal) (struct __auth *, XDR *);

[178] Fix | Delete

/* validate verifier */

[179] Fix | Delete

int (*ah_validate) (struct __auth *,

[180] Fix | Delete

struct opaque_auth *);

[181] Fix | Delete

/* refresh credentials */

[182] Fix | Delete

int (*ah_refresh) (struct __auth *, void *);

[183] Fix | Delete

/* destroy this structure */

[184] Fix | Delete

void (*ah_destroy) (struct __auth *);

[185] Fix | Delete

/* encode data for wire */

[186] Fix | Delete

int (*ah_wrap) (struct __auth *, XDR *, xdrproc_t, caddr_t);

[187] Fix | Delete

/* decode data for wire */

[188] Fix | Delete

int (*ah_unwrap) (struct __auth *, XDR *, xdrproc_t, caddr_t);

[189] Fix | Delete

[190] Fix | Delete

} *ah_ops;

[191] Fix | Delete

void *ah_private;

[192] Fix | Delete

} AUTH;

[193] Fix | Delete

[194] Fix | Delete

[195] Fix | Delete

* Authentication ops.

[196] Fix | Delete

* The ops and the auth handle provide the interface to the authenticators.

[197] Fix | Delete

[198] Fix | Delete

* AUTH *auth;

[199] Fix | Delete

* XDR *xdrs;

[200] Fix | Delete

* struct opaque_auth verf;

[201] Fix | Delete

[202] Fix | Delete

#define AUTH_NEXTVERF(auth) \

[203] Fix | Delete

((*((auth)->ah_ops->ah_nextverf))(auth))

[204] Fix | Delete

#define auth_nextverf(auth) \

[205] Fix | Delete

((*((auth)->ah_ops->ah_nextverf))(auth))

[206] Fix | Delete

[207] Fix | Delete

#define AUTH_MARSHALL(auth, xdrs) \

[208] Fix | Delete

((*((auth)->ah_ops->ah_marshal))(auth, xdrs))

[209] Fix | Delete

#define auth_marshall(auth, xdrs) \

[210] Fix | Delete

((*((auth)->ah_ops->ah_marshal))(auth, xdrs))

[211] Fix | Delete

[212] Fix | Delete

#define AUTH_VALIDATE(auth, verfp) \

[213] Fix | Delete

((*((auth)->ah_ops->ah_validate))((auth), verfp))

[214] Fix | Delete

#define auth_validate(auth, verfp) \

[215] Fix | Delete

((*((auth)->ah_ops->ah_validate))((auth), verfp))

[216] Fix | Delete

[217] Fix | Delete

#define AUTH_REFRESH(auth, msg) \

[218] Fix | Delete

((*((auth)->ah_ops->ah_refresh))(auth, msg))

[219] Fix | Delete

#define auth_refresh(auth, msg) \

[220] Fix | Delete

((*((auth)->ah_ops->ah_refresh))(auth, msg))

[221] Fix | Delete

[222] Fix | Delete

#define AUTH_DESTROY(auth) \

[223] Fix | Delete

((*((auth)->ah_ops->ah_destroy))(auth));

[224] Fix | Delete

#define auth_destroy(auth) \

[225] Fix | Delete

((*((auth)->ah_ops->ah_destroy))(auth));

[226] Fix | Delete

[227] Fix | Delete

#define AUTH_WRAP(auth, xdrs, xfunc, xwhere) \

[228] Fix | Delete

((*((auth)->ah_ops->ah_wrap))(auth, xdrs, \

[229] Fix | Delete

xfunc, xwhere))

[230] Fix | Delete

#define auth_wrap(auth, xdrs, xfunc, xwhere) \

[231] Fix | Delete

((*((auth)->ah_ops->ah_wrap))(auth, xdrs, \

[232] Fix | Delete

xfunc, xwhere))

[233] Fix | Delete

[234] Fix | Delete

#define AUTH_UNWRAP(auth, xdrs, xfunc, xwhere) \

[235] Fix | Delete

((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, \

[236] Fix | Delete

xfunc, xwhere))

[237] Fix | Delete

#define auth_unwrap(auth, xdrs, xfunc, xwhere) \

[238] Fix | Delete

((*((auth)->ah_ops->ah_unwrap))(auth, xdrs, \

[239] Fix | Delete

xfunc, xwhere))

[240] Fix | Delete

[241] Fix | Delete

[242] Fix | Delete

#ifdef __cplusplus

[243] Fix | Delete

extern "C" {

[244] Fix | Delete

#endif

[245] Fix | Delete

extern struct opaque_auth _null_auth;

[246] Fix | Delete

#ifdef __cplusplus

[247] Fix | Delete

}

[248] Fix | Delete

#endif

[249] Fix | Delete

[250] Fix | Delete

[251] Fix | Delete

* Any style authentication. These routines can be used by any

[252] Fix | Delete

* authentication style that does not use the wrap/unwrap functions.

[253] Fix | Delete

[254] Fix | Delete

int authany_wrap(void), authany_unwrap(void);

[255] Fix | Delete

[256] Fix | Delete

[257] Fix | Delete

* These are the various implementations of client side authenticators.

[258] Fix | Delete

[259] Fix | Delete

[260] Fix | Delete

[261] Fix | Delete

* System style authentication

[262] Fix | Delete

* AUTH *authunix_create(machname, uid, gid, len, aup_gids)

[263] Fix | Delete

* char *machname;

[264] Fix | Delete

* int uid;

[265] Fix | Delete

* int gid;

[266] Fix | Delete

* int len;

[267] Fix | Delete

* int *aup_gids;

[268] Fix | Delete

[269] Fix | Delete

#ifdef __cplusplus

[270] Fix | Delete

extern "C" {

[271] Fix | Delete

#endif

[272] Fix | Delete

extern AUTH *authunix_create(char *, uid_t, uid_t, int, uid_t *);

[273] Fix | Delete

extern AUTH *authunix_create_default(void); /* takes no parameters */

[274] Fix | Delete

extern AUTH *authnone_create(void); /* takes no parameters */

[275] Fix | Delete

#ifdef __cplusplus

[276] Fix | Delete

}

[277] Fix | Delete

#endif

[278] Fix | Delete

[279] Fix | Delete

* DES style authentication

[280] Fix | Delete

* AUTH *authsecdes_create(servername, window, timehost, ckey)

[281] Fix | Delete

* char *servername; - network name of server

[282] Fix | Delete

* u_int window; - time to live

[283] Fix | Delete

* const char *timehost; - optional hostname to sync with

[284] Fix | Delete

* des_block *ckey; - optional conversation key to use

[285] Fix | Delete

[286] Fix | Delete

#ifdef __cplusplus

[287] Fix | Delete

extern "C" {

[288] Fix | Delete

#endif

[289] Fix | Delete

extern AUTH *authdes_create (char *, u_int, struct sockaddr *, des_block *);

[290] Fix | Delete

extern AUTH *authdes_pk_create (char *, netobj *, u_int,

[291] Fix | Delete

struct sockaddr *, des_block *);

[292] Fix | Delete

extern AUTH *authdes_seccreate (const char *, const u_int, const char *,

[293] Fix | Delete

const des_block *);

[294] Fix | Delete

#ifdef __cplusplus

[295] Fix | Delete

}

[296] Fix | Delete

#endif

[297] Fix | Delete

[298] Fix | Delete

#ifdef __cplusplus

[299] Fix | Delete

extern "C" {

[300] Fix | Delete

#endif

[301] Fix | Delete

extern bool_t xdr_opaque_auth (XDR *, struct opaque_auth *);

[302] Fix | Delete

#ifdef __cplusplus

[303] Fix | Delete

}

[304] Fix | Delete

#endif

[305] Fix | Delete

[306] Fix | Delete

#define authsys_create(c,i1,i2,i3,ip) authunix_create((c),(i1),(i2),(i3),(ip))

[307] Fix | Delete

#define authsys_create_default() authunix_create_default()

[308] Fix | Delete

[309] Fix | Delete

[310] Fix | Delete

* Netname manipulation routines.

[311] Fix | Delete

[312] Fix | Delete

#ifdef __cplusplus

[313] Fix | Delete

extern "C" {

[314] Fix | Delete

#endif

[315] Fix | Delete

extern int getnetname(char *);

[316] Fix | Delete

extern int host2netname(char *, const char *, const char *);

[317] Fix | Delete

extern int user2netname(char *, const uid_t, const char *);

[318] Fix | Delete

extern int netname2user(char *, uid_t *, gid_t *, int *, gid_t *);

[319] Fix | Delete

extern int netname2host(char *, char *, const int);

[320] Fix | Delete

extern void passwd2des ( char *, char * );

[321] Fix | Delete

#ifdef __cplusplus

[322] Fix | Delete

}

[323] Fix | Delete

#endif

[324] Fix | Delete

[325] Fix | Delete

[326] Fix | Delete

[327] Fix | Delete

* These routines interface to the keyserv daemon

[328] Fix | Delete

[329] Fix | Delete

[330] Fix | Delete

#ifdef __cplusplus

[331] Fix | Delete

extern "C" {

[332] Fix | Delete

#endif

[333] Fix | Delete

extern int key_decryptsession(const char *, des_block *);

[334] Fix | Delete

extern int key_encryptsession(const char *, des_block *);

[335] Fix | Delete

extern int key_gendes(des_block *);

[336] Fix | Delete

extern int key_setsecret(const char *);

[337] Fix | Delete

extern int key_secretkey_is_set(void);

[338] Fix | Delete

#ifdef __cplusplus

[339] Fix | Delete

}

[340] Fix | Delete

#endif

[341] Fix | Delete

[342] Fix | Delete

[343] Fix | Delete

* Publickey routines.

[344] Fix | Delete

[345] Fix | Delete

#ifdef __cplusplus

[346] Fix | Delete

extern "C" {

[347] Fix | Delete

#endif

[348] Fix | Delete

extern int getpublickey (const char *, char *);

[349] Fix | Delete

extern int getpublicandprivatekey (char *, char *);

[350] Fix | Delete

extern int getsecretkey (char *, char *, char *);

[351] Fix | Delete

#ifdef __cplusplus

[352] Fix | Delete

}

[353] Fix | Delete

#endif

[354] Fix | Delete

[355] Fix | Delete

#ifdef __cplusplus

[356] Fix | Delete

extern "C" {

[357] Fix | Delete

#endif

[358] Fix | Delete

struct svc_req;

[359] Fix | Delete

struct rpc_msg;

[360] Fix | Delete

enum auth_stat _svcauth_none (struct svc_req *, struct rpc_msg *);

[361] Fix | Delete

enum auth_stat _svcauth_short (struct svc_req *, struct rpc_msg *);

[362] Fix | Delete

enum auth_stat _svcauth_unix (struct svc_req *, struct rpc_msg *);

[363] Fix | Delete

enum auth_stat _svcauth_gss (struct svc_req *, struct rpc_msg *, bool_t *);

[364] Fix | Delete

#ifdef __cplusplus

[365] Fix | Delete

}

[366] Fix | Delete

#endif

[367] Fix | Delete

[368] Fix | Delete

#define AUTH_NONE 0 /* no authentication */

[369] Fix | Delete

#define AUTH_NULL 0 /* backward compatibility */

[370] Fix | Delete

#define AUTH_SYS 1 /* unix style (uid, gids) */

[371] Fix | Delete

#define AUTH_UNIX AUTH_SYS

[372] Fix | Delete

#define AUTH_SHORT 2 /* short hand unix style */

[373] Fix | Delete

#define AUTH_DH 3 /* for Diffie-Hellman mechanism */

[374] Fix | Delete

#define AUTH_DES AUTH_DH /* for backward compatibility */

[375] Fix | Delete

#define AUTH_KERB 4 /* kerberos style */

[376] Fix | Delete

#define RPCSEC_GSS 6 /* RPCSEC_GSS */

[377] Fix | Delete

[378] Fix | Delete

#endif /* !_TIRPC_AUTH_H */

[379] Fix | Delete

[380] Fix | Delete