/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*

 * NFS Version 4 client side SECINFO code.

 */

#include <nfs/nfs4_clnt.h>

#include <nfs/nfs4.h>

#include <nfs/nfs_clnt.h>

#include <nfs/rnode4.h>

#include <sys/cmn_err.h>

#include <sys/cred.h>

#include <sys/systm.h>

/*

 * Set up the security flavors supported in this release.

 * In the order of potential usage.

 */

#define	SECINFO_SUPPORT_COUNT 6	/* sys, krb5, krb5i, krb5p, none, dh */

static char krb5_val[] = {'\x2A', '\x86', '\x48', '\x86', '\xF7', \

			'\x12', '\x01', '\x02', '\x02'};

static sec_oid4 krb5_oid = {9, krb5_val};

static SECINFO4res *secinfo_support;

/* XXX should come from auth.h, do the cleanup someday */

extern void sec_clnt_freeinfo(struct sec_data *);

/*

 * "nfsstat -m" needs to print out what flavor is used for a mount

 * point. V3 kernel gets the nfs pseudo flavor from the userland and provides

 * nfsstat with such information. However, in V4, we do not have nfs pseudo

 * flavors mapping in the kernel for the rpcsec_gss data negotiated from

 * the nfs server.

 *

 * XXX

 * Hard coded the mapping in V4 for now. We should look into a possibility

 * to return the rpcsec_gss mechanism and service information to nfsstat and

 * perhaps have nfsstat print out the mech and service seperately...

 *

 * We should avoid referring to nfssec.conf file in V4. The original reason

 * for having /etc/nfssec.conf file is because V3 MOUNT protocol can only

 * return an integer for a flavor, thus the term "nfs pseudo flavor" is

 * defined and the nfssec.conf file is used to map the nfs pseudo flavor

 * to rpcsec_gss data (mech, service, default-qop). Now, V4 can return the

 * rpcsec_gss data instead of an integer, so in theory, V4 should not need

 * to depend on the nfssec.conf file anymore.

 */

#define	NFS_FLAVOR_KRB5		390003

#define	NFS_FLAVOR_KRB5I	390004

#define	NFS_FLAVOR_KRB5P	390005

/*

 * Currently, 6 flavors are supported: sys, krb5, krb5i, krb5p, dh, none.

 * Without proper keys, krb5* or dh will fail.

 *

 * XXX kgss_indicate_mechs() should be able to tell us what gss mechanisms

 * are supported on this host (/etc/gss/mech), thus nfs should be able to

 * use them. However, the dh640 and dh1024 implementation are not nfs tested.

 * Should look into using kgss_indicate_mechs when new gss mechanism is added.

 */

void

nfs4_secinfo_init(void)

{

	secinfo4 *val;

	int i;

	secinfo_support = kmem_alloc(sizeof (SECINFO4res), KM_SLEEP);

	secinfo_support->SECINFO4resok_len = SECINFO_SUPPORT_COUNT;

	val = kmem_alloc(

		secinfo_support->SECINFO4resok_len * sizeof (secinfo4),

		KM_SLEEP);

	val[0].flavor = AUTH_SYS;

	val[0].flavor_info.oid.sec_oid4_len = 0;

	val[0].flavor_info.oid.sec_oid4_val = NULL;

	val[0].flavor_info.service = 0;

	val[0].flavor_info.qop = 0;

	/* add krb5, krb5i, krb5p */

	for (i = 1; i <= 3; i++) {

		val[i].flavor = RPCSEC_GSS;

		val[i].flavor_info.oid = krb5_oid;	/* struct copy */

		val[i].flavor_info.service = i;

		val[i].flavor_info.qop = 0;

	}

	val[4].flavor = AUTH_DH;

	val[4].flavor_info.oid.sec_oid4_len = 0;

	val[4].flavor_info.oid.sec_oid4_val = NULL;

	val[4].flavor_info.service = 0;

	val[4].flavor_info.qop = 0;

	val[5].flavor = AUTH_NONE;

	val[5].flavor_info.oid.sec_oid4_len = 0;

	val[5].flavor_info.oid.sec_oid4_val = NULL;

	val[5].flavor_info.service = 0;

	val[5].flavor_info.qop = 0;

#if !defined(lint)

	ASSERT(SECINFO_SUPPORT_COUNT == 6);

#endif

	secinfo_support->SECINFO4resok_val = val;

}

/*

 * clean up secinfo_support

 */

void

nfs4_secinfo_fini(void)

{

	kmem_free(secinfo_support->SECINFO4resok_val,

		secinfo_support->SECINFO4resok_len * sizeof (secinfo4));

	kmem_free(secinfo_support, sizeof (SECINFO4res));

}

/*

 * Map RPCSEC_GSS data to a nfs pseudo flavor number defined

 * in the nfssec.conf file.

 *

 * mechanism    service    qop       nfs-pseudo-flavor

 * ----------------------------------------------------

 * kerberos_v5  none       default   390003/krb5

 * kerberos_v5  integrity  default   390004/krb5i

 * kerberos_v5  privacy    default   390005/krb5p

 *

 * XXX need to re-visit the mapping semantics when a new

 * security mechanism is to be added.

 */

int

secinfo2nfsflavor(sec_oid4 *mech_oid, rpc_gss_svc_t service)

{

	/* Is this kerberos_v5? */

	if (bcmp(mech_oid->sec_oid4_val, krb5_oid.sec_oid4_val,

		krb5_oid.sec_oid4_len) != 0) {

		return (0);

	}

	/* for krb5, krb5i, krb5p mapping */

	switch (service) {

	case RPC_GSS_SVC_NONE:

		return (NFS_FLAVOR_KRB5);

	case RPC_GSS_SVC_INTEGRITY:

		return (NFS_FLAVOR_KRB5I);

	case RPC_GSS_SVC_PRIVACY:

		return (NFS_FLAVOR_KRB5P);

	default:

		break;

	}

	/* no mapping */

	return (0);

}

/*

 * secinfo_create() maps the secinfo4 data coming over the wire

 * to sv_secinfo data structure in servinfo4_t

 */

static sv_secinfo_t *

secinfo_create(servinfo4_t *svp, SECINFO4res *sec_info, char *servname)

{

	uint_t i, seccnt, scnt;

	sec_data_t *sdata;

	sv_secinfo_t *sinfo;

	uint_t len = sec_info->SECINFO4resok_len;

	secinfo4 *value = sec_info->SECINFO4resok_val;

	if (len == 0)

		return (NULL);

	seccnt = len;

	/*

	 * If there is no valid sv_dhsec data available but an AUTH_DH

	 * is in the list, skip AUTH_DH flavor.

	 */

	if (!svp->sv_dhsec) {

		for (i = 0; i < len; i++) {

			if (value[i].flavor == AUTH_DH)

				seccnt--;

		}

	}

	if (seccnt == 0)

		return (NULL);

	sdata = kmem_alloc(sizeof (sec_data_t) * seccnt, KM_SLEEP);

	scnt = 0;

	for (i = 0; i < len; i++) {

		secinfo4 *val = &value[i];

		gss_clntdata_t *data;

		rpcsec_gss_info *info;

		sdata[scnt].flags = 0;

		sdata[scnt].rpcflavor = val->flavor;

		switch (val->flavor) {

		case RPCSEC_GSS:

			data = kmem_alloc(sizeof (gss_clntdata_t), KM_SLEEP);

			data->realm[0] = '\0';

			info = &val->flavor_info;

			data->service = (rpc_gss_service_t)info->service;

			data->qop = (uint_t)info->qop;

			data->mechanism.length = info->oid.sec_oid4_len;

			data->mechanism.elements =

				kmem_alloc(info->oid.sec_oid4_len, KM_SLEEP);

			bcopy(info->oid.sec_oid4_val,

			    data->mechanism.elements, info->oid.sec_oid4_len);

			data->uname[0] = 'n'; data->uname[1] = 'f';

			data->uname[2] = 's'; data->uname[3] = '\0';

			(void) strcpy(data->inst, servname);

			sdata[scnt].data = (caddr_t)data;

			sdata[scnt].secmod =

				secinfo2nfsflavor(&info->oid, info->service);

			scnt++;

			break;

		case AUTH_DH:

			if (svp->sv_dhsec) {

				sdata[scnt] = *svp->sv_dhsec;

				scnt++;

				break;

			}

			/* no auth_dh data on the client, skip auth_dh */

			continue;

		default:

			sdata[scnt].secmod = val->flavor;

			sdata[scnt].data = NULL;

			scnt++;

			break;

		}

	}

	ASSERT(seccnt == scnt);

	sinfo = kmem_alloc(sizeof (sv_secinfo_t), KM_SLEEP);

	sinfo->count = seccnt;

	sinfo->sdata = sdata;

	return (sinfo);

}

/*

 * secinfo_free() frees the malloc'd portion of a sv_secinfo_t in servinfo4_t.

 *

 * This is similar to sec_clnt_freeinfo() offered from rpcsec module,

 * except that sec_clnt_freeinfo() frees up an individual secdata.

 */

void

secinfo_free(sv_secinfo_t *secinfo)

{

	int i;

	if (secinfo == NULL)

		return;

	for (i = 0; i < secinfo->count; i++) {

	    if (secinfo->sdata[i].rpcflavor == RPCSEC_GSS) {

		gss_clntdata_t *data = (gss_clntdata_t *)

						secinfo->sdata[i].data;

		/*

		 * An auth handle may already cached in rpcsec_gss module

		 * per this secdata. Purge the cache entry before freeing

		 * up this secdata. Can't use sec_clnt_freeinfo since

		 * the allocation of secinfo is different from sec_data.

		 */

		(void) rpc_gss_secpurge((void *)&secinfo->sdata[i]);

		kmem_free(data->mechanism.elements, data->mechanism.length);

		kmem_free(data, sizeof (gss_clntdata_t));

	    }

	    if (secinfo->sdata[i].rpcflavor == AUTH_DH) {

		secinfo->sdata[i].data = NULL; /* release ref to sv_dhsec */

		/*

		 * No need to purge the auth_dh cache entry (e.g. call

		 * purge_authtab()) since the AUTH_DH data used here

		 * are always the same.

		 */

	    }

	}

	kmem_free(secinfo->sdata, sizeof (sec_data_t) * secinfo->count);

	kmem_free(secinfo, sizeof (sv_secinfo_t));

}

/*

 * Check if there is more secinfo to try.

 * If TRUE, try again.

 */

static bool_t

secinfo_check(servinfo4_t *svp)

{

	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_WRITER, 0);

	if (svp->sv_secinfo == NULL) {

		nfs_rw_exit(&svp->sv_lock);

		return (FALSE);

	}

	svp->sv_secinfo->index++;

	if (svp->sv_secinfo->index < svp->sv_secinfo->count) {

		svp->sv_flags |= SV4_TRYSECINFO;

		svp->sv_currsec =

			&svp->sv_secinfo->sdata[svp->sv_secinfo->index];

		nfs_rw_exit(&svp->sv_lock);

		return (TRUE);

	} else {

		svp->sv_secinfo->index = 0;

		svp->sv_flags &= ~SV4_TRYSECINFO;

		svp->sv_currsec = NULL;

		nfs_rw_exit(&svp->sv_lock);

		return (FALSE);

	}

}

/*

 * Update the secinfo related fields in svp.

 *

 * secinfo_update will free the previous sv_secinfo and update with

 * the new secinfo. However, if the sv_secinfo is saved into sv_save_secinfo

 * before the recovery starts via save_mnt_secinfo(), sv_secinfo will not

 * be freed until the recovery is done.

 */

static void

secinfo_update(servinfo4_t *svp, SECINFO4res *sec_info)

{

	sv_secinfo_t *newsecinfo;

	/*

	 * Create secinfo before freeing the old one to make sure

	 * they are not using the same address.

	 */

	newsecinfo = secinfo_create(svp, sec_info, svp->sv_hostname);

	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_WRITER, 0);

	if (svp->sv_secinfo && svp->sv_secinfo != svp->sv_save_secinfo) {

		secinfo_free(svp->sv_secinfo);

	}

	svp->sv_secinfo = newsecinfo;

	if (svp->sv_secinfo) {

		svp->sv_secinfo->index = 0;

		svp->sv_flags |= SV4_TRYSECINFO;

		svp->sv_currsec =

			&svp->sv_secinfo->sdata[svp->sv_secinfo->index];

	} else {

		svp->sv_flags &= ~SV4_TRYSECINFO;

		svp->sv_currsec = NULL;

	}

	nfs_rw_exit(&svp->sv_lock);

}

/*

 * Save the original mount point security information.

 *

 * sv_savesec saves the pointer of sv_currsec which points to one of the

 * secinfo data in the sv_secinfo list. i.e. sv_currsec == &sv_secinfo[index].

 *

 * sv_save_secinfo saves the pointer of sv_secinfo which is the list of

 * secinfo data returned by the server.

 */

void

save_mnt_secinfo(servinfo4_t *svp)

{

	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_WRITER, 0);

	if (svp->sv_currsec) {

		svp->sv_savesec = svp->sv_currsec;

		svp->sv_save_secinfo = svp->sv_secinfo;

	} else {

		ASSERT(svp->sv_save_secinfo == NULL);

		svp->sv_savesec = svp->sv_secdata;

	}

	nfs_rw_exit(&svp->sv_lock);

}

/*

 * Check if we need to restore what is saved in sv_savesec and sv_save_secinfo

 * to be the current secinfo information - sv_currsec and sv_secinfo.

 *

 * If op a node that is a stub for a crossed mount point,

 * keep the original secinfo flavor for the current file system,

 * not the crossed one.

 */

void

check_mnt_secinfo(servinfo4_t *svp, vnode_t *vp)

{

	bool_t is_restore;

	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_WRITER, 0);

	is_restore = (vp == NULL || (VTOR4(vp)->r_flags & R4SRVSTUB)) &&

			svp->sv_save_secinfo &&

			(svp->sv_secinfo != svp->sv_save_secinfo);

	if (is_restore) {

		secinfo_free(svp->sv_secinfo);

		if (svp->sv_savesec == svp->sv_secdata) {

			ASSERT(svp->sv_save_secinfo == NULL);

			svp->sv_secinfo = NULL;

			svp->sv_currsec = NULL;

		} else {

			ASSERT(svp->sv_save_secinfo != NULL);

			svp->sv_secinfo = svp->sv_save_secinfo;

			svp->sv_currsec = svp->sv_savesec;

		}

	} else {

		if (svp->sv_save_secinfo &&

				svp->sv_save_secinfo != svp->sv_secinfo)

			secinfo_free(svp->sv_save_secinfo);

	}

	svp->sv_save_secinfo = NULL;

	svp->sv_savesec = NULL;

	nfs_rw_exit(&svp->sv_lock);

}

/*

 * Use the security flavors supported on the client to try

 * PUTROOTFH until a flavor is found.

 *

 * PUTROOTFH could return NFS4ERR_RESOURCE and NFS4ERR_WRONGSEC that

 * may need a recovery action. This routine only handles NFS4ERR_WRONGSEC.

 * For other recovery action, it returns ok to the caller for retry.

 */

static int

secinfo_tryroot_otw(mntinfo4_t *mi, cred_t *cr)

{

	COMPOUND4args_clnt args;

	COMPOUND4res_clnt res;

	nfs_argop4 argop;

	int doqueue = 1;

	bool_t needrecov = FALSE;

	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };

	/* use the flavors supported on the client */

	secinfo_update(mi->mi_curr_serv, secinfo_support);

	/* Compound {Putroofh} */

	args.ctag = TAG_PUTROOTFH;

	args.array_len = 1;

	args.array = &argop;

	argop.argop = OP_PUTROOTFH;

retry:

	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,

	    "secinfo_tryroot_otw: %s call, mi 0x%p",

	    needrecov ? "recov" : "first", (void*)mi));

	rfs4call(mi, &args, &res, cr, &doqueue, RFSCALL_SOFT, &e);

	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);

	if (e.error && !needrecov) {

		return (e.error);

	}

	if (res.status == NFS4ERR_WRONGSEC) {

		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);

		if (secinfo_check(mi->mi_curr_serv))

			goto retry;

		/*

		 * Have tried all flavors supported on the client,

		 * but still get NFS4ERR_WRONGSEC. Nothing more can

		 * be done.

		 */

		return (geterrno4(res.status));

	}

	if (needrecov) {

		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,

		    "secinfo_tryroot_otw: let the caller retry\n"));

		if (!e.error)

			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);

		return (0);

	}

	if (res.status) {

		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);

		return (geterrno4(res.status));

	}

	/*

	 * Done.

	 *

	 * Now, mi->sv_curr_server->sv_currsec points to the flavor found.

	 * SV4_TRYSECINFO has been cleared in rfs4call.

	 * sv_currsec will be used.

	 */

	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);

	return (e.error);

}

/*

 * Caculate the total number of components within a given pathname.

 * Assuming the given pathname is not null.