#ifndef _NFS_NFS_GSS_H_
#define _NFS_NFS_GSS_H_
#include <gssd/gssd_mach.h>
#include <sys/param.h>
#include <nfs/nfs_ioctl.h>
#include <libkern/crypto/des.h>
#define RPCSEC_GSS 6
#define RPCSEC_GSS_VERS_1 1
enum rpcsec_gss_proc {
RPCSEC_GSS_DATA = 0,
RPCSEC_GSS_INIT = 1,
RPCSEC_GSS_CONTINUE_INIT = 2,
RPCSEC_GSS_DESTROY = 3
};
enum rpcsec_gss_service {
RPCSEC_GSS_SVC_NONE = 1, RPCSEC_GSS_SVC_INTEGRITY = 2, RPCSEC_GSS_SVC_PRIVACY = 3, };
extern u_char krb5_mech[11];
typedef uint32_t OM_uint32;
#define GSS_S_COMPLETE 0
#define GSS_S_CONTINUE_NEEDED 1
#define GSS_C_CALLING_ERROR_OFFSET 24
#define GSS_C_ROUTINE_ERROR_OFFSET 16
#define GSS_C_SUPPLEMENTARY_OFFSET 0
#define GSS_C_CALLING_ERROR_MASK ((OM_uint32) 0377ul)
#define GSS_C_ROUTINE_ERROR_MASK ((OM_uint32) 0377ul)
#define GSS_C_SUPPLEMENTARY_MASK ((OM_uint32) 0177777ul)
#define GSS_CALLING_ERROR(x) \
((x) & (GSS_C_CALLING_ERROR_MASK << GSS_C_CALLING_ERROR_OFFSET))
#define GSS_ROUTINE_ERROR(x) \
((x) & (GSS_C_ROUTINE_ERROR_MASK << GSS_C_ROUTINE_ERROR_OFFSET))
#define GSS_SUPPLEMENTARY_INFO(x) \
((x) & (GSS_C_SUPPLEMENTARY_MASK << GSS_C_SUPPLEMENTARY_OFFSET))
#define GSS_ERROR(x) \
((x) & ((GSS_C_CALLING_ERROR_MASK << GSS_C_CALLING_ERROR_OFFSET) | \
(GSS_C_ROUTINE_ERROR_MASK << GSS_C_ROUTINE_ERROR_OFFSET)))
#define GSS_MAXSEQ 0x80000000 // The biggest sequence number
#define GSS_SVC_MAXCONTEXTS 500000 // Max contexts supported
#define GSS_SVC_SEQWINDOW 256 // Server's sequence window
#define GSS_CLNT_SEQLISTMAX 32 // Max length of req seq num list
#define SKEYLEN 8 // length of DES key
#define SKEYLEN3 24 // length of DES3 keyboard
#define MAX_SKEYLEN SKEYLEN3
#define GSS_MAX_NEG_CACHE_ENTRIES 16
#define GSS_NEG_CACHE_TO 3
#define GSS_PRINT_DELAY (8 * 3600) // Wait day before printing the same error message
typedef struct {
uint32_t type; uint32_t keybytes; uint32_t hash_len;
u_char skey[MAX_SKEYLEN]; union {
struct {
des_cblock *key;
des_cbc_key_schedule gss_sched;
des_cbc_key_schedule gss_sched_Ke;
} des;
struct {
des_cblock (*key)[3];
des_cblock ckey[3];
des3_cbc_key_schedule gss_sched;
} des3;
} ks_u;
} gss_key_info;
#define NFS_GSS_0DES 0 // Not DES or uninitialized
#define NFS_GSS_1DES 1 // Single DES with DES_MAC_MD5
#define NFS_GSS_3DES 2 // Triple EDE DES KD with SHA1
struct nfs_gss_clnt_ctx {
lck_mtx_t *gss_clnt_mtx;
thread_t gss_clnt_thread; TAILQ_ENTRY(nfs_gss_clnt_ctx) gss_clnt_entries;
uint32_t gss_clnt_flags; int32_t gss_clnt_refcnt; kauth_cred_t gss_clnt_cred; uint8_t *gss_clnt_principal; uint32_t gss_clnt_prinlen; gssd_nametype gss_clnt_prinnt; char *gss_clnt_display; uint32_t gss_clnt_proc; uint32_t gss_clnt_seqnum; uint32_t gss_clnt_service; uint8_t *gss_clnt_handle; uint32_t gss_clnt_handle_len; time_t gss_clnt_nctime; uint32_t gss_clnt_seqwin; uint32_t *gss_clnt_seqbits; mach_port_t gss_clnt_mport; uint8_t *gss_clnt_verf; uint8_t *gss_clnt_svcname; uint32_t gss_clnt_svcnamlen; gssd_nametype gss_clnt_svcnt; gssd_cred gss_clnt_cred_handle; gssd_ctx gss_clnt_context; uint8_t *gss_clnt_token; uint32_t gss_clnt_tokenlen; gss_key_info *gss_clnt_kinfo; uint32_t gss_clnt_gssd_flags; uint32_t gss_clnt_major; uint32_t gss_clnt_minor; time_t gss_clnt_ptime; };
#define GSS_CTX_COMPLETE 0x00000001 // Context is complete
#define GSS_CTX_INVAL 0x00000002 // Context is invalid
#define GSS_CTX_STICKY 0x00000004 // Context has been set by user
#define GSS_NEEDSEQ 0x00000008 // Need a sequence number
#define GSS_NEEDCTX 0x00000010 // Need the context
#define GSS_CTX_DESTROY 0x00000020 // Context is being destroyed, don't cache
struct nfs_gss_svc_ctx {
lck_mtx_t *gss_svc_mtx;
LIST_ENTRY(nfs_gss_svc_ctx) gss_svc_entries;
uint32_t gss_svc_handle; uint32_t gss_svc_refcnt; uint32_t gss_svc_proc; uid_t gss_svc_uid; gid_t gss_svc_gids[NGROUPS]; uint32_t gss_svc_ngroups; uint64_t gss_svc_incarnation; uint32_t gss_svc_seqmax; uint32_t gss_svc_seqwin; uint32_t *gss_svc_seqbits; gssd_cred gss_svc_cred_handle; gssd_ctx gss_svc_context; u_char *gss_svc_token; uint32_t gss_svc_tokenlen; gss_key_info gss_svc_kinfo; uint32_t gss_svc_major; uint32_t gss_svc_minor; };
#define SVC_CTX_HASHSZ 64
#define SVC_CTX_HASH(handle) ((handle) % SVC_CTX_HASHSZ)
LIST_HEAD(nfs_gss_svc_ctx_hashhead, nfs_gss_svc_ctx);
#define win_getbit(bits, bit) ((bits[(bit) / 32] & (1 << (bit) % 32)) != 0)
#define win_setbit(bits, bit) do { bits[(bit) / 32] |= (1 << (bit) % 32); } while (0)
#define win_resetbit(bits, bit) do { bits[(bit) / 32] &= ~(1 << (bit) % 32); } while (0)
#define GSS_CTX_PEND 5 // seconds
#define GSS_CTX_EXPIRE (8 * 3600) // seconds
#define GSS_CTX_TTL_MIN 1 // seconds
#define GSS_TIMER_PERIOD 300 // seconds
#define MSECS_PER_SEC 1000
#define auth_is_kerberized(auth) \
(auth == RPCAUTH_KRB5 || \
auth == RPCAUTH_KRB5I || \
auth == RPCAUTH_KRB5P)
__BEGIN_DECLS
void nfs_gss_init(void);
uid_t nfs_cred_getasid2uid(kauth_cred_t);
int nfs_gss_clnt_cred_put(struct nfsreq *, struct nfsm_chain *, mbuf_t);
int nfs_gss_clnt_verf_get(struct nfsreq *, struct nfsm_chain *,
uint32_t, uint32_t, uint32_t *);
void nfs_gss_clnt_rpcdone(struct nfsreq *);
int nfs_gss_clnt_args_restore(struct nfsreq *);
int nfs_gss_clnt_ctx_renew(struct nfsreq *);
void nfs_gss_clnt_ctx_ref(struct nfsreq *, struct nfs_gss_clnt_ctx *);
void nfs_gss_clnt_ctx_unref(struct nfsreq *);
void nfs_gss_clnt_ctx_unmount(struct nfsmount *);
int nfs_gss_clnt_ctx_remove(struct nfsmount *, kauth_cred_t);
int nfs_gss_clnt_ctx_set_principal(struct nfsmount *, vfs_context_t, uint8_t *, uint32_t, uint32_t);
int nfs_gss_clnt_ctx_get_principal(struct nfsmount *, vfs_context_t, struct user_nfs_gss_principal *);
int nfs_gss_svc_cred_get(struct nfsrv_descript *, struct nfsm_chain *);
int nfs_gss_svc_verf_put(struct nfsrv_descript *, struct nfsm_chain *);
int nfs_gss_svc_ctx_init(struct nfsrv_descript *, struct nfsrv_sock *, mbuf_t *);
int nfs_gss_svc_prepare_reply(struct nfsrv_descript *, struct nfsm_chain *);
int nfs_gss_svc_protect_reply(struct nfsrv_descript *, mbuf_t);
void nfs_gss_svc_ctx_deref(struct nfs_gss_svc_ctx *);
void nfs_gss_svc_cleanup(void);
__END_DECLS
#endif