aboutsummaryrefslogtreecommitdiff
path: root/sys/kgssapi
Commit message (Collapse)AuthorAgeFilesLines
* OpenCrypto: Convert sessions to opaque handles instead of integersConrad Meyer2018-07-183-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Track session objects in the framework, and pass handles between the framework (OCF), consumers, and drivers. Avoid redundancy and complexity in individual drivers by allocating session memory in the framework and providing it to drivers in ::newsession(). Session handles are no longer integers with information encoded in various high bits. Use of the CRYPTO_SESID2FOO() macros should be replaced with the appropriate crypto_ses2foo() function on the opaque session handle. Convert OCF drivers (in particular, cryptosoft, as well as myriad others) to the opaque handle interface. Discard existing session tracking as much as possible (quick pass). There may be additional code ripe for deletion. Convert OCF consumers (ipsec, geom_eli, krb5, cryptodev) to handle-style interface. The conversion is largely mechnical. The change is documented in crypto.9. Inspired by https://lists.freebsd.org/pipermail/freebsd-arch/2018-January/018835.html . No objection from: ae (ipsec portion) Reported by: jhb Notes: svn path=/head/; revision=336439
* OCF: Convert consumers to the session id typedefConrad Meyer2018-07-163-4/+4
| | | | | | | | | | | These were missed in the earlier r336269. No functional change. Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=336352
* kgssapi: Remove trivial deadcodeConrad Meyer2018-02-141-2/+0
| | | | | | | | | CID: 1385956 Reported by: Coverity Sponsored by: Dell EMC Isilon Notes: svn path=/head/; revision=329251
* Use syscall_helper_register(9) rather than syscall_register().Brooks Davis2018-02-111-18/+17
| | | | | | | | | | | The usage is simpler, documented, and more common. Reviewed by: cem Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D14227 Notes: svn path=/head/; revision=329128
* sys/kgssapi: general adoption of SPDX licensing ID tags.Pedro F. Giffuni2017-11-2734-0/+68
| | | | | | | | | | | | | | | | | Mainly focus on files that use BSD 2-Clause license, however the tool I was using misidentified many licenses so this was mostly a manual - error prone - task. The Software Package Data Exchange (SPDX) group provides a specification to make it easier for automated tools to detect and summarize well known opensource licenses. We are gradually adopting the specification, noting that the tags are considered only advisory and do not, in any way, superceed or replace the license texts. No functional change intended. Notes: svn path=/head/; revision=326279
* kgssapi: insignificant spelling fix.Pedro F. Giffuni2016-05-031-1/+1
| | | | | | | No functional change. Notes: svn path=/head/; revision=299008
* kgssapi: Don't leak memory in error casesConrad Meyer2016-04-261-3/+9
| | | | | | | | | Reported by: Coverity CIDs: 1007046, 1007047, 1007048 Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=298655
* sys: extend use of the howmany() macro when available.Pedro F. Giffuni2016-04-261-2/+1
| | | | | | | | We have a howmany() macro in the <sys/param.h> header that is convenient to re-use as it makes things easier to read. Notes: svn path=/head/; revision=298649
* kgssapi(4): Don't allow user-provided arguments to overrun stack bufferConrad Meyer2016-04-201-1/+3
| | | | | | | | | | | | | | | | | An over-long path argument to gssd_syscall could overrun the stack sockaddr_un buffer. Fix gssd_syscall to not permit that. If an over-long path is provided, gssd_syscall now returns EINVAL. It looks like PRIV_NFS_DAEMON isn't granted anywhere, so my best guess is that this is likely only triggerable by root. Reported by: Coverity CID: 1006751 Sponsored by: EMC / Isilon Storage Division Notes: svn path=/head/; revision=298338
* Cleanup unnecessary semicolons from the kernel.Pedro F. Giffuni2016-04-101-1/+1
| | | | | | | Found with devel/coccinelle. Notes: svn path=/head/; revision=297793
* kcrypto_aes: Use separate sessions for AES and SHA1Conrad Meyer2016-02-021-25/+31
| | | | | | | | | | | | | | Some hardware supports AES acceleration but not SHA1, e.g., AES-NI extensions. It is useful to have accelerated AES even if SHA1 must be software. Suggested by: asomers Reviewed by: asomers, dfr Sponsored by: EMC / Isilon Storage Division Differential Revision: https://reviews.freebsd.org/D5146 Notes: svn path=/head/; revision=295134
* Unset the gss kernel state when gssd exitsJosh Paetzel2016-01-011-8/+11
| | | | | | | | | | | | | | | | | When gssd exits it leaves the kernel state set by gssd_syscall(). nfsd sees this and waits endlessly in an unkillable state for gssd to come back. If you had acidentally started gssd then stopped it, then started nfsd you'd be in a bad way until you either restarted gssd or rebooted the system. This change fixes that by setting the kernel state to "" when gssd exits. Reviewed by: rmacklem MFC after: 1 week Sponsored by: iXsystems Notes: svn path=/head/; revision=293043
* Avoid dynamic syscall overhead for statically compiled modules.Mateusz Guzik2014-10-261-1/+1
| | | | | | | | | | | | | | | | The kernel tracks syscall users so that modules can safely unregister them. But if the module is not unloadable or was compiled into the kernel, there is no need to do this. Achieve this by adding SY_THR_STATIC_KLD macro which expands to SY_THR_STATIC during kernel build and 0 otherwise. Reviewed by: kib (previous version) MFC after: 2 weeks Notes: svn path=/head/; revision=273707
* Add support for host-based (Kerberos 5 service principal) initiatorRick Macklem2013-07-091-0/+1
| | | | | | | | | | | credentials to the kernel rpc. Modify the NFSv4 client to add support for the gssname and allgssname mount options to use this capability. Requires the gssd daemon to be running with the "-h" option. Reviewed by: jhb Notes: svn path=/head/; revision=253049
* Isilon reported that sec=krb5p NFS mounts had a problem when m_len == 0Rick Macklem2013-05-011-3/+21
| | | | | | | | | | | | for the last mbuf of the list with an encrypted message. This patch replaces the KASSERT() with code that handles this case. Reported by: john.gemignani@isilon.com Reviewed by: jhb MFC after: 2 weeks Notes: svn path=/head/; revision=250157
* Piete.Brooks at cl.cam.ac.uk reported via email a crash which wasRick Macklem2012-12-1814-41/+144
| | | | | | | | | | | | | | | caused by use of an invalid kgss_gssd_handle during an upcall to the gssd daemon when it has exited. This patch seems to avoid the crashes by holding a reference count on the kgss_gssd_handle until the upcall is done. It also adds a new mutex kgss_gssd_lock used to make manipulation of kgss_gssd_handle SMP safe. Tested by: Illias A. Marinos, Herbert Poeckl Reviewed by: jhb MFC after: 2 weeks Notes: svn path=/head/; revision=244370
* Add missing break statement to make sure all 3DES etypes really are treatedChristian Brueffer2011-10-101-0/+1
| | | | | | | | | | | | the same. CID: 3624 Found with: Coverity Prevent(tm) Reviewed by: dfr MFC after: 1 week Notes: svn path=/head/; revision=226185
* In order to maximize the re-usability of kernel code in user space thisKip Macy2011-09-161-1/+1
| | | | | | | | | | | | | | | | patch modifies makesyscalls.sh to prefix all of the non-compatibility calls (e.g. not linux_, freebsd32_) with sys_ and updates the kernel entry points and all places in the code that use them. It also fixes an additional name space collision between the kernel function psignal and the libc function of the same name by renaming the kernel psignal kern_psignal(). By introducing this change now we will ease future MFCs that change syscalls. Reviewed by: rwatson Approved by: re (bz) Notes: svn path=/head/; revision=225617
* Add a small comment about unloading the kgsappi module.Zack Kirsch2011-07-161-1/+5
| | | | | | | | | Reviewed by: rmacklem Approved by: zml (mentor) MFC after: 2 weeks Notes: svn path=/head/; revision=224084
* Fix the kgssapi so that it can be loaded as a module. CurrentlyRick Macklem2011-06-191-1/+34
| | | | | | | | | | | | | | | | the NFS subsystems use five of the rpcsec_gss/kgssapi entry points, but since it was not obvious which others might be useful, all nineteen were included. Basically the nineteen entry points are set in a structure called rpc_gss_entries and inline functions defined in sys/rpc/rpcsec_gss.h check for the entry points being non-NULL and then call them. A default value is returned otherwise. Requested by rwatson. Reviewed by: jhb MFC after: 2 weeks Notes: svn path=/head/; revision=223309
* When the KOBJMETHOD() macro was updated, it resulted in theRick Macklem2009-06-141-9/+17
| | | | | | | | | | | | | | | | compiler doing argument type checking. Since the prototypes in kgss_if.h used the generic gss_ctx_id_t for the context argument, but the functions in sys/kgssapi/krb5/krb5_mech.c used the KerberosV specific context argument, the file would no longer build. This patch fixes it so it will build by replacing the argument with a gss_ctx_id_t one and setting a local "struct krb5_context *" variable to it for use by the function. Reviewed by: dfr Approved by: kib (mentor) Notes: svn path=/head/; revision=194202
* Place hostnames and similar information fully under the prison system.Jamie Gritton2009-05-291-13/+17
| | | | | | | | | | | | | | | | | | | | The system hostname is now stored in prison0, and the global variable "hostname" has been removed, as has the hostname_mtx mutex. Jails may have their own host information, or they may inherit it from the parent/system. The proper way to read the hostname is via getcredhostname(), which will copy either the hostname associated with the passed cred, or the system hostname if you pass NULL. The system hostname can still be accessed directly (and without locking) at prison0.pr_host, but that should be avoided where possible. The "similar information" referred to is domainname, hostid, and hostuuid, which have also become prison parameters and had their associated global variables removed. Approved by: bz (mentor) Notes: svn path=/head/; revision=193066
* Fix build of KGSSAPI bits post-vimage.Doug Rabson2009-05-241-4/+5
| | | | Notes: svn path=/head/; revision=192678
* Call svc_freereq() before returning from the service proc.Doug Rabson2008-11-121-0/+1
| | | | Notes: svn path=/head/; revision=184887
* Implement support for RPCSEC_GSS authentication to both the NFS clientDoug Rabson2008-11-0337-0/+8492
and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month Notes: svn path=/head/; revision=184588
generated by cgit v1.3 (git 2.53.0) at 2026-04-18 15:57:12 +0000