320 	struct svc_rpc_gss_client *client;  in rpc_gss_getcred()  local
325 	client = req->rq_clntcred;  in rpc_gss_getcred()
327 		*rcred = &client->cl_rawcred;  in rpc_gss_getcred()
329 		*ucred = &client->cl_ucred;  in rpc_gss_getcred()
331 		*cookie = client->cl_cookie;  in rpc_gss_getcred()
338 	struct svc_rpc_gss_client *client = req->rq_clntcred;  in rpc_gss_svc_max_data_length()  local
344 	switch (client->cl_rawcred.service) {  in rpc_gss_svc_max_data_length()
362 	maj_stat = gss_wrap_size_limit(&min_stat, client->cl_ctx, want_conf,  in rpc_gss_svc_max_data_length()
363 	    client->cl_qop, max_tp_unit_len, &max);  in rpc_gss_svc_max_data_length()
371 		log_status("gss_wrap_size_limit", client->cl_mech,  in rpc_gss_svc_max_data_length()
380 	struct svc_rpc_gss_client *client;  in svc_rpc_gss_find_client()  local
387 	TAILQ_FOREACH(client, list, cl_link) {  in svc_rpc_gss_find_client()
388 		if (client->cl_id == clientid) {  in svc_rpc_gss_find_client()
393 			TAILQ_REMOVE(&svc_rpc_gss_clients, client, cl_alllink);  in svc_rpc_gss_find_client()
394 			TAILQ_INSERT_HEAD(&svc_rpc_gss_clients, client,  in svc_rpc_gss_find_client()
396 			return client;  in svc_rpc_gss_find_client()
406 	struct svc_rpc_gss_client *client;  in svc_rpc_gss_create_client()  local
411 	client = mem_alloc(sizeof(struct svc_rpc_gss_client));  in svc_rpc_gss_create_client()
412 	memset(client, 0, sizeof(struct svc_rpc_gss_client));  in svc_rpc_gss_create_client()
413 	client->cl_id = svc_rpc_gss_next_clientid++;  in svc_rpc_gss_create_client()
414 	list = &svc_rpc_gss_client_hash[client->cl_id % CLIENT_HASH_SIZE];  in svc_rpc_gss_create_client()
415 	TAILQ_INSERT_HEAD(list, client, cl_link);  in svc_rpc_gss_create_client()
416 	TAILQ_INSERT_HEAD(&svc_rpc_gss_clients, client, cl_alllink);  in svc_rpc_gss_create_client()
422 	client->cl_state = CLIENT_NEW;  in svc_rpc_gss_create_client()
423 	client->cl_locked = FALSE;  in svc_rpc_gss_create_client()
424 	client->cl_expiration = time(0) + 5*60;  in svc_rpc_gss_create_client()
427 	return (client);  in svc_rpc_gss_create_client()
431 svc_rpc_gss_destroy_client(struct svc_rpc_gss_client *client)  in svc_rpc_gss_destroy_client()  argument
438 	if (client->cl_ctx)  in svc_rpc_gss_destroy_client()
440 		    &client->cl_ctx, GSS_C_NO_BUFFER);  in svc_rpc_gss_destroy_client()
442 	if (client->cl_cname)  in svc_rpc_gss_destroy_client()
443 		gss_release_name(&min_stat, &client->cl_cname);  in svc_rpc_gss_destroy_client()
445 	if (client->cl_rawcred.client_principal)  in svc_rpc_gss_destroy_client()
446 		mem_free(client->cl_rawcred.client_principal,  in svc_rpc_gss_destroy_client()
447 		    sizeof(*client->cl_rawcred.client_principal)  in svc_rpc_gss_destroy_client()
448 		    + client->cl_rawcred.client_principal->len);  in svc_rpc_gss_destroy_client()
450 	if (client->cl_verf.value)  in svc_rpc_gss_destroy_client()
451 		gss_release_buffer(&min_stat, &client->cl_verf);  in svc_rpc_gss_destroy_client()
453 	list = &svc_rpc_gss_client_hash[client->cl_id % CLIENT_HASH_SIZE];  in svc_rpc_gss_destroy_client()
454 	TAILQ_REMOVE(list, client, cl_link);  in svc_rpc_gss_destroy_client()
455 	TAILQ_REMOVE(&svc_rpc_gss_clients, client, cl_alllink);  in svc_rpc_gss_destroy_client()
457 	mem_free(client, sizeof(*client));  in svc_rpc_gss_destroy_client()
463 	struct svc_rpc_gss_client *client;  in svc_rpc_gss_timeout_clients()  local
475 	TAILQ_FOREACH_SAFE(client, &svc_rpc_gss_clients, cl_alllink, nclient) {  in svc_rpc_gss_timeout_clients()
476 		if (client->cl_state == CLIENT_STALE  in svc_rpc_gss_timeout_clients()
477 		    || now > client->cl_expiration) {  in svc_rpc_gss_timeout_clients()
478 			log_debug("expiring client %p", client);  in svc_rpc_gss_timeout_clients()
479 			svc_rpc_gss_destroy_client(client);  in svc_rpc_gss_timeout_clients()
561 svc_rpc_gss_build_ucred(struct svc_rpc_gss_client *client,  in svc_rpc_gss_build_ucred()  argument
568 	rpc_gss_ucred_t		*uc = &client->cl_ucred;  in svc_rpc_gss_build_ucred()
573 	uc->gidlist = client->cl_gid_storage;  in svc_rpc_gss_build_ucred()
575 	maj_stat = gss_pname_to_uid(&min_stat, name, client->cl_mech, &uid);  in svc_rpc_gss_build_ucred()
584 		uc->gidlist = client->cl_gid_storage;  in svc_rpc_gss_build_ucred()
591 svc_rpc_gss_accept_sec_context(struct svc_rpc_gss_client *client,  in svc_rpc_gss_accept_sec_context()  argument
610 		client->cl_state = CLIENT_STALE;  in svc_rpc_gss_accept_sec_context()
618 	if (!client->cl_sname) {  in svc_rpc_gss_accept_sec_context()
624 					&client->cl_ctx,  in svc_rpc_gss_accept_sec_context()
628 					&client->cl_cname,  in svc_rpc_gss_accept_sec_context()
633 					&client->cl_creds);  in svc_rpc_gss_accept_sec_context()
636 					client->cl_sname = sname;  in svc_rpc_gss_accept_sec_context()
639 				client->cl_sname = sname;  in svc_rpc_gss_accept_sec_context()
651 			&client->cl_ctx,  in svc_rpc_gss_accept_sec_context()
652 			client->cl_sname->sn_cred,  in svc_rpc_gss_accept_sec_context()
655 			&client->cl_cname,  in svc_rpc_gss_accept_sec_context()
672 		log_status("accept_sec_context", client->cl_mech,  in svc_rpc_gss_accept_sec_context()
674 		client->cl_state = CLIENT_STALE;  in svc_rpc_gss_accept_sec_context()
678 	gr->gr_handle.value = &client->cl_id;  in svc_rpc_gss_accept_sec_context()
679 	gr->gr_handle.length = sizeof(client->cl_id);  in svc_rpc_gss_accept_sec_context()
683 	client->cl_mech = mech;  in svc_rpc_gss_accept_sec_context()
684 	client->cl_qop = GSS_C_QOP_DEFAULT;  in svc_rpc_gss_accept_sec_context()
685 	client->cl_seq = gc->gc_seq;  in svc_rpc_gss_accept_sec_context()
686 	client->cl_win = gr->gr_win;  in svc_rpc_gss_accept_sec_context()
687 	client->cl_done_callback = FALSE;  in svc_rpc_gss_accept_sec_context()
700 		client->cl_expiration = time(0) + cred_lifetime;  in svc_rpc_gss_accept_sec_context()
705 		client->cl_rawcred.version = RPCSEC_GSS_VERSION;  in svc_rpc_gss_accept_sec_context()
706 		rpc_gss_oid_to_mech(mech, &client->cl_rawcred.mechanism);  in svc_rpc_gss_accept_sec_context()
707 		maj_stat = gss_export_name(&min_stat, client->cl_cname,  in svc_rpc_gss_accept_sec_context()
710 			log_status("gss_export_name", client->cl_mech,  in svc_rpc_gss_accept_sec_context()
714 		client->cl_rawcred.client_principal =  in svc_rpc_gss_accept_sec_context()
715 			mem_alloc(sizeof(*client->cl_rawcred.client_principal)  in svc_rpc_gss_accept_sec_context()
717 		client->cl_rawcred.client_principal->len = export_name.length;  in svc_rpc_gss_accept_sec_context()
718 		memcpy(client->cl_rawcred.client_principal->name,  in svc_rpc_gss_accept_sec_context()
721 		client->cl_rawcred.svc_principal =  in svc_rpc_gss_accept_sec_context()
722 			client->cl_sname->sn_principal;  in svc_rpc_gss_accept_sec_context()
723 		client->cl_rawcred.service = gc->gc_svc;  in svc_rpc_gss_accept_sec_context()
729 		svc_rpc_gss_build_ucred(client, client->cl_cname);  in svc_rpc_gss_accept_sec_context()
730 		gss_release_name(&min_stat, &client->cl_cname);  in svc_rpc_gss_accept_sec_context()
740 			    client->cl_rawcred.client_principal->name,  in svc_rpc_gss_accept_sec_context()
742 			    client->cl_qop, client->rawcred.service);  in svc_rpc_gss_accept_sec_context()
752 svc_rpc_gss_validate(struct svc_rpc_gss_client *client, struct rpc_msg *msg,  in svc_rpc_gss_validate()  argument
787 	maj_stat = gss_verify_mic(&min_stat, client->cl_ctx, &rpcbuf, &checksum,  in svc_rpc_gss_validate()
791 		log_status("gss_verify_mic", client->cl_mech,  in svc_rpc_gss_validate()
793 		client->cl_state = CLIENT_STALE;  in svc_rpc_gss_validate()
801 svc_rpc_gss_nextverf(struct svc_rpc_gss_client *client,  in svc_rpc_gss_nextverf()  argument
814 	if (client->cl_verf.value)  in svc_rpc_gss_nextverf()
815 		gss_release_buffer(&min_stat, &client->cl_verf);  in svc_rpc_gss_nextverf()
817 	maj_stat = gss_get_mic(&min_stat, client->cl_ctx, client->cl_qop,  in svc_rpc_gss_nextverf()
818 	    &signbuf, &client->cl_verf);  in svc_rpc_gss_nextverf()
821 		log_status("gss_get_mic", client->cl_mech, maj_stat, min_stat);  in svc_rpc_gss_nextverf()
822 		client->cl_state = CLIENT_STALE;  in svc_rpc_gss_nextverf()
826 	rqst->rq_xprt->xp_verf.oa_base = (caddr_t)client->cl_verf.value;  in svc_rpc_gss_nextverf()
827 	rqst->rq_xprt->xp_verf.oa_length = (u_int)client->cl_verf.length;  in svc_rpc_gss_nextverf()
833 svc_rpc_gss_callback(struct svc_rpc_gss_client *client, struct svc_req *rqst)  in svc_rpc_gss_callback()  argument
853 			lock.raw_cred = &client->cl_rawcred;  in svc_rpc_gss_callback()
855 			    client->cl_creds,  in svc_rpc_gss_callback()
856 			    client->cl_ctx,  in svc_rpc_gss_callback()
861 				client->cl_state = CLIENT_STALE;  in svc_rpc_gss_callback()
871 			client->cl_creds = GSS_C_NO_CREDENTIAL;  in svc_rpc_gss_callback()
872 			client->cl_locked = lock.locked;  in svc_rpc_gss_callback()
873 			client->cl_cookie = cookie;  in svc_rpc_gss_callback()
883 	if (client->cl_creds) {  in svc_rpc_gss_callback()
885 		gss_release_cred(&min_ver, &client->cl_creds);  in svc_rpc_gss_callback()
891 svc_rpc_gss_check_replay(struct svc_rpc_gss_client *client, uint32_t seq)  in svc_rpc_gss_check_replay()  argument
896 	if (seq <= client->cl_seqlast) {  in svc_rpc_gss_check_replay()
904 		offset = client->cl_seqlast - seq;  in svc_rpc_gss_check_replay()
909 		if (client->cl_seqmask[word] & (1 << bit))  in svc_rpc_gss_check_replay()
917 svc_rpc_gss_update_seq(struct svc_rpc_gss_client *client, uint32_t seq)  in svc_rpc_gss_update_seq()  argument
922 	if (seq > client->cl_seqlast) {  in svc_rpc_gss_update_seq()
930 		offset = seq - client->cl_seqlast;  in svc_rpc_gss_update_seq()
934 				client->cl_seqmask[i] = client->cl_seqmask[i-1];  in svc_rpc_gss_update_seq()
936 			client->cl_seqmask[0] = 0;  in svc_rpc_gss_update_seq()
941 			newcarry = client->cl_seqmask[i] >> (32 - offset);  in svc_rpc_gss_update_seq()
942 			client->cl_seqmask[i] =  in svc_rpc_gss_update_seq()
943 				(client->cl_seqmask[i] << offset) | carry;  in svc_rpc_gss_update_seq()
946 		client->cl_seqmask[0] |= 1;  in svc_rpc_gss_update_seq()
947 		client->cl_seqlast = seq;  in svc_rpc_gss_update_seq()
949 		offset = client->cl_seqlast - seq;  in svc_rpc_gss_update_seq()
952 		client->cl_seqmask[word] |= (1 << bit);  in svc_rpc_gss_update_seq()
963 	struct svc_rpc_gss_client *client;  in svc_rpc_gss()  local
1005 		client = svc_rpc_gss_create_client();  in svc_rpc_gss()
1012 		client = svc_rpc_gss_find_client(*p);  in svc_rpc_gss()
1013 		if (!client) {  in svc_rpc_gss()
1023 	rqst->rq_clntcred = client;  in svc_rpc_gss()
1038 		client->cl_seq = gc.gc_seq;  in svc_rpc_gss()
1062 		if (!svc_rpc_gss_accept_sec_context(client, rqst, &gr, &gc)) {  in svc_rpc_gss()
1068 			if (!svc_rpc_gss_nextverf(client, rqst, gr.gr_win)) {  in svc_rpc_gss()
1089 			client->cl_state = CLIENT_ESTABLISHED;  in svc_rpc_gss()
1096 		if (!svc_rpc_gss_check_replay(client, gc.gc_seq)) {  in svc_rpc_gss()
1101 		if (!svc_rpc_gss_validate(client, msg, &qop)) {  in svc_rpc_gss()
1106 		if (!svc_rpc_gss_nextverf(client, rqst, gc.gc_seq)) {  in svc_rpc_gss()
1111 		svc_rpc_gss_update_seq(client, gc.gc_seq);  in svc_rpc_gss()
1121 		SVC_AUTH(rqst->rq_xprt).svc_ah_private = client;  in svc_rpc_gss()
1128 			if (!client->cl_done_callback) {  in svc_rpc_gss()
1129 				client->cl_done_callback = TRUE;  in svc_rpc_gss()
1130 				client->cl_qop = qop;  in svc_rpc_gss()
1131 				client->cl_rawcred.qop = _rpc_gss_num_to_qop(  in svc_rpc_gss()
1132 					client->cl_rawcred.mechanism, qop);  in svc_rpc_gss()
1133 				if (!svc_rpc_gss_callback(client, rqst)) {  in svc_rpc_gss()
1144 			if (client->cl_locked) {  in svc_rpc_gss()
1145 				if (client->cl_rawcred.service != gc.gc_svc) {  in svc_rpc_gss()
1148 				} else if (client->cl_qop != qop) {  in svc_rpc_gss()
1158 			if (client->cl_qop != qop) {  in svc_rpc_gss()
1159 				client->cl_qop = qop;  in svc_rpc_gss()
1160 				client->cl_rawcred.qop = _rpc_gss_num_to_qop(  in svc_rpc_gss()
1161 					client->cl_rawcred.mechanism, qop);  in svc_rpc_gss()
1168 			client->cl_rawcred.service = gc.gc_svc;  in svc_rpc_gss()
1185 			svc_rpc_gss_destroy_client(client);  in svc_rpc_gss()
1204 	struct svc_rpc_gss_client *client;  in svc_rpc_gss_wrap()  local
1208 	client = (struct svc_rpc_gss_client *) auth->svc_ah_private;  in svc_rpc_gss_wrap()
1209 	if (client->cl_state != CLIENT_ESTABLISHED  in svc_rpc_gss_wrap()
1210 	    || client->cl_rawcred.service == rpc_gss_svc_none) {  in svc_rpc_gss_wrap()
1214 		client->cl_ctx, client->cl_qop,  in svc_rpc_gss_wrap()
1215 		client->cl_rawcred.service, client->cl_seq));  in svc_rpc_gss_wrap()
1221 	struct svc_rpc_gss_client *client;  in svc_rpc_gss_unwrap()  local
1225 	client = (struct svc_rpc_gss_client *) auth->svc_ah_private;  in svc_rpc_gss_unwrap()
1226 	if (client->cl_state != CLIENT_ESTABLISHED  in svc_rpc_gss_unwrap()
1227 	    || client->cl_rawcred.service == rpc_gss_svc_none) {  in svc_rpc_gss_unwrap()
1231 		client->cl_ctx, client->cl_qop,  in svc_rpc_gss_unwrap()
1232 		client->cl_rawcred.service, client->cl_seq));  in svc_rpc_gss_unwrap()