2 #include <linux/ceph/ceph_debug.h>
5 #include <linux/module.h>
6 #include <linux/random.h>
7 #include <linux/slab.h>
9 #include <linux/ceph/decode.h>
10 #include <linux/ceph/auth.h>
14 #include "auth_x_protocol.h"
16 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
);
18 static int ceph_x_is_authenticated(struct ceph_auth_client
*ac
)
20 struct ceph_x_info
*xi
= ac
->private;
23 ceph_x_validate_tickets(ac
, &need
);
24 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
25 ac
->want_keys
, need
, xi
->have_keys
);
26 return (ac
->want_keys
& xi
->have_keys
) == ac
->want_keys
;
29 static int ceph_x_should_authenticate(struct ceph_auth_client
*ac
)
31 struct ceph_x_info
*xi
= ac
->private;
34 ceph_x_validate_tickets(ac
, &need
);
35 dout("ceph_x_should_authenticate want=%d need=%d have=%d\n",
36 ac
->want_keys
, need
, xi
->have_keys
);
40 static int ceph_x_encrypt_buflen(int ilen
)
42 return sizeof(struct ceph_x_encrypt_header
) + ilen
+ 16 +
46 static int ceph_x_encrypt(struct ceph_crypto_key
*secret
,
47 void *ibuf
, int ilen
, void *obuf
, size_t olen
)
49 struct ceph_x_encrypt_header head
= {
51 .magic
= cpu_to_le64(CEPHX_ENC_MAGIC
)
53 size_t len
= olen
- sizeof(u32
);
56 ret
= ceph_encrypt2(secret
, obuf
+ sizeof(u32
), &len
,
57 &head
, sizeof(head
), ibuf
, ilen
);
60 ceph_encode_32(&obuf
, len
);
61 return len
+ sizeof(u32
);
64 static int ceph_x_decrypt(struct ceph_crypto_key
*secret
,
65 void **p
, void *end
, void **obuf
, size_t olen
)
67 struct ceph_x_encrypt_header head
;
68 size_t head_len
= sizeof(head
);
71 len
= ceph_decode_32(p
);
75 dout("ceph_x_decrypt len %d\n", len
);
77 *obuf
= kmalloc(len
, GFP_NOFS
);
83 ret
= ceph_decrypt2(secret
, &head
, &head_len
, *obuf
, &olen
, *p
, len
);
86 if (head
.struct_v
!= 1 || le64_to_cpu(head
.magic
) != CEPHX_ENC_MAGIC
)
93 * get existing (or insert new) ticket handler
95 static struct ceph_x_ticket_handler
*
96 get_ticket_handler(struct ceph_auth_client
*ac
, int service
)
98 struct ceph_x_ticket_handler
*th
;
99 struct ceph_x_info
*xi
= ac
->private;
100 struct rb_node
*parent
= NULL
, **p
= &xi
->ticket_handlers
.rb_node
;
104 th
= rb_entry(parent
, struct ceph_x_ticket_handler
, node
);
105 if (service
< th
->service
)
107 else if (service
> th
->service
)
114 th
= kzalloc(sizeof(*th
), GFP_NOFS
);
116 return ERR_PTR(-ENOMEM
);
117 th
->service
= service
;
118 rb_link_node(&th
->node
, parent
, p
);
119 rb_insert_color(&th
->node
, &xi
->ticket_handlers
);
123 static void remove_ticket_handler(struct ceph_auth_client
*ac
,
124 struct ceph_x_ticket_handler
*th
)
126 struct ceph_x_info
*xi
= ac
->private;
128 dout("remove_ticket_handler %p %d\n", th
, th
->service
);
129 rb_erase(&th
->node
, &xi
->ticket_handlers
);
130 ceph_crypto_key_destroy(&th
->session_key
);
132 ceph_buffer_put(th
->ticket_blob
);
136 static int process_one_ticket(struct ceph_auth_client
*ac
,
137 struct ceph_crypto_key
*secret
,
140 struct ceph_x_info
*xi
= ac
->private;
142 u8 tkt_struct_v
, blob_struct_v
;
143 struct ceph_x_ticket_handler
*th
;
148 struct timespec validity
;
149 struct ceph_crypto_key old_key
;
150 void *ticket_buf
= NULL
;
152 struct ceph_timespec new_validity
;
153 struct ceph_crypto_key new_session_key
;
154 struct ceph_buffer
*new_ticket_blob
;
155 unsigned long new_expires
, new_renew_after
;
159 ceph_decode_need(p
, end
, sizeof(u32
) + 1, bad
);
161 type
= ceph_decode_32(p
);
162 dout(" ticket type %d %s\n", type
, ceph_entity_type_name(type
));
164 tkt_struct_v
= ceph_decode_8(p
);
165 if (tkt_struct_v
!= 1)
168 th
= get_ticket_handler(ac
, type
);
175 dlen
= ceph_x_decrypt(secret
, p
, end
, &dbuf
, 0);
180 dout(" decrypted %d bytes\n", dlen
);
184 tkt_struct_v
= ceph_decode_8(&dp
);
185 if (tkt_struct_v
!= 1)
188 memcpy(&old_key
, &th
->session_key
, sizeof(old_key
));
189 ret
= ceph_crypto_key_decode(&new_session_key
, &dp
, dend
);
193 ceph_decode_copy(&dp
, &new_validity
, sizeof(new_validity
));
194 ceph_decode_timespec(&validity
, &new_validity
);
195 new_expires
= get_seconds() + validity
.tv_sec
;
196 new_renew_after
= new_expires
- (validity
.tv_sec
/ 4);
197 dout(" expires=%lu renew_after=%lu\n", new_expires
,
200 /* ticket blob for service */
201 ceph_decode_8_safe(p
, end
, is_enc
, bad
);
204 dout(" encrypted ticket\n");
205 dlen
= ceph_x_decrypt(&old_key
, p
, end
, &ticket_buf
, 0);
211 dlen
= ceph_decode_32(&tp
);
214 ceph_decode_32_safe(p
, end
, dlen
, bad
);
215 ticket_buf
= kmalloc(dlen
, GFP_NOFS
);
221 ceph_decode_need(p
, end
, dlen
, bad
);
222 ceph_decode_copy(p
, ticket_buf
, dlen
);
225 dout(" ticket blob is %d bytes\n", dlen
);
226 ceph_decode_need(&tp
, tpend
, 1 + sizeof(u64
), bad
);
227 blob_struct_v
= ceph_decode_8(&tp
);
228 new_secret_id
= ceph_decode_64(&tp
);
229 ret
= ceph_decode_buffer(&new_ticket_blob
, &tp
, tpend
);
233 /* all is well, update our ticket */
234 ceph_crypto_key_destroy(&th
->session_key
);
236 ceph_buffer_put(th
->ticket_blob
);
237 th
->session_key
= new_session_key
;
238 th
->ticket_blob
= new_ticket_blob
;
239 th
->validity
= new_validity
;
240 th
->secret_id
= new_secret_id
;
241 th
->expires
= new_expires
;
242 th
->renew_after
= new_renew_after
;
243 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
244 type
, ceph_entity_type_name(type
), th
->secret_id
,
245 (int)th
->ticket_blob
->vec
.iov_len
);
246 xi
->have_keys
|= th
->service
;
258 static int ceph_x_proc_ticket_reply(struct ceph_auth_client
*ac
,
259 struct ceph_crypto_key
*secret
,
260 void *buf
, void *end
)
267 ceph_decode_8_safe(&p
, end
, reply_struct_v
, bad
);
268 if (reply_struct_v
!= 1)
271 ceph_decode_32_safe(&p
, end
, num
, bad
);
272 dout("%d tickets\n", num
);
275 ret
= process_one_ticket(ac
, secret
, &p
, end
);
286 static int ceph_x_build_authorizer(struct ceph_auth_client
*ac
,
287 struct ceph_x_ticket_handler
*th
,
288 struct ceph_x_authorizer
*au
)
291 struct ceph_x_authorize_a
*msg_a
;
292 struct ceph_x_authorize_b msg_b
;
295 int ticket_blob_len
=
296 (th
->ticket_blob
? th
->ticket_blob
->vec
.iov_len
: 0);
298 dout("build_authorizer for %s %p\n",
299 ceph_entity_type_name(th
->service
), au
);
301 maxlen
= sizeof(*msg_a
) + sizeof(msg_b
) +
302 ceph_x_encrypt_buflen(ticket_blob_len
);
303 dout(" need len %d\n", maxlen
);
304 if (au
->buf
&& au
->buf
->alloc_len
< maxlen
) {
305 ceph_buffer_put(au
->buf
);
309 au
->buf
= ceph_buffer_new(maxlen
, GFP_NOFS
);
313 au
->service
= th
->service
;
314 au
->secret_id
= th
->secret_id
;
316 msg_a
= au
->buf
->vec
.iov_base
;
318 msg_a
->global_id
= cpu_to_le64(ac
->global_id
);
319 msg_a
->service_id
= cpu_to_le32(th
->service
);
320 msg_a
->ticket_blob
.struct_v
= 1;
321 msg_a
->ticket_blob
.secret_id
= cpu_to_le64(th
->secret_id
);
322 msg_a
->ticket_blob
.blob_len
= cpu_to_le32(ticket_blob_len
);
323 if (ticket_blob_len
) {
324 memcpy(msg_a
->ticket_blob
.blob
, th
->ticket_blob
->vec
.iov_base
,
325 th
->ticket_blob
->vec
.iov_len
);
327 dout(" th %p secret_id %lld %lld\n", th
, th
->secret_id
,
328 le64_to_cpu(msg_a
->ticket_blob
.secret_id
));
331 p
+= ticket_blob_len
;
332 end
= au
->buf
->vec
.iov_base
+ au
->buf
->vec
.iov_len
;
334 get_random_bytes(&au
->nonce
, sizeof(au
->nonce
));
336 msg_b
.nonce
= cpu_to_le64(au
->nonce
);
337 ret
= ceph_x_encrypt(&th
->session_key
, &msg_b
, sizeof(msg_b
),
342 au
->buf
->vec
.iov_len
= p
- au
->buf
->vec
.iov_base
;
343 dout(" built authorizer nonce %llx len %d\n", au
->nonce
,
344 (int)au
->buf
->vec
.iov_len
);
345 BUG_ON(au
->buf
->vec
.iov_len
> maxlen
);
349 ceph_buffer_put(au
->buf
);
354 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler
*th
,
357 ceph_decode_need(p
, end
, 1 + sizeof(u64
), bad
);
359 ceph_encode_64(p
, th
->secret_id
);
360 if (th
->ticket_blob
) {
361 const char *buf
= th
->ticket_blob
->vec
.iov_base
;
362 u32 len
= th
->ticket_blob
->vec
.iov_len
;
364 ceph_encode_32_safe(p
, end
, len
, bad
);
365 ceph_encode_copy_safe(p
, end
, buf
, len
, bad
);
367 ceph_encode_32_safe(p
, end
, 0, bad
);
375 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
)
377 int want
= ac
->want_keys
;
378 struct ceph_x_info
*xi
= ac
->private;
381 *pneed
= ac
->want_keys
& ~(xi
->have_keys
);
383 for (service
= 1; service
<= want
; service
<<= 1) {
384 struct ceph_x_ticket_handler
*th
;
386 if (!(ac
->want_keys
& service
))
389 if (*pneed
& service
)
392 th
= get_ticket_handler(ac
, service
);
399 if (get_seconds() >= th
->renew_after
)
401 if (get_seconds() >= th
->expires
)
402 xi
->have_keys
&= ~service
;
407 static int ceph_x_build_request(struct ceph_auth_client
*ac
,
408 void *buf
, void *end
)
410 struct ceph_x_info
*xi
= ac
->private;
412 struct ceph_x_request_header
*head
= buf
;
414 struct ceph_x_ticket_handler
*th
=
415 get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
420 ceph_x_validate_tickets(ac
, &need
);
422 dout("build_request want %x have %x need %x\n",
423 ac
->want_keys
, xi
->have_keys
, need
);
425 if (need
& CEPH_ENTITY_TYPE_AUTH
) {
426 struct ceph_x_authenticate
*auth
= (void *)(head
+ 1);
428 struct ceph_x_challenge_blob tmp
;
435 dout(" get_auth_session_key\n");
436 head
->op
= cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY
);
438 /* encrypt and hash */
439 get_random_bytes(&auth
->client_challenge
, sizeof(u64
));
440 tmp
.client_challenge
= auth
->client_challenge
;
441 tmp
.server_challenge
= cpu_to_le64(xi
->server_challenge
);
442 ret
= ceph_x_encrypt(&xi
->secret
, &tmp
, sizeof(tmp
),
443 tmp_enc
, sizeof(tmp_enc
));
449 for (u
= (u64
*)tmp_enc
; u
+ 1 <= (u64
*)(tmp_enc
+ ret
); u
++)
450 auth
->key
^= *(__le64
*)u
;
451 dout(" server_challenge %llx client_challenge %llx key %llx\n",
452 xi
->server_challenge
, le64_to_cpu(auth
->client_challenge
),
453 le64_to_cpu(auth
->key
));
455 /* now encode the old ticket if exists */
456 ret
= ceph_x_encode_ticket(th
, &p
, end
);
465 struct ceph_x_service_ticket_request
*req
;
469 head
->op
= cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY
);
471 ret
= ceph_x_build_authorizer(ac
, th
, &xi
->auth_authorizer
);
474 ceph_encode_copy(&p
, xi
->auth_authorizer
.buf
->vec
.iov_base
,
475 xi
->auth_authorizer
.buf
->vec
.iov_len
);
478 req
->keys
= cpu_to_le32(need
);
486 static int ceph_x_handle_reply(struct ceph_auth_client
*ac
, int result
,
487 void *buf
, void *end
)
489 struct ceph_x_info
*xi
= ac
->private;
490 struct ceph_x_reply_header
*head
= buf
;
491 struct ceph_x_ticket_handler
*th
;
497 return result
; /* XXX hmm? */
501 struct ceph_x_server_challenge
*sc
= buf
;
503 if (len
!= sizeof(*sc
))
505 xi
->server_challenge
= le64_to_cpu(sc
->server_challenge
);
506 dout("handle_reply got server challenge %llx\n",
507 xi
->server_challenge
);
508 xi
->starting
= false;
509 xi
->have_keys
&= ~CEPH_ENTITY_TYPE_AUTH
;
513 op
= le16_to_cpu(head
->op
);
514 result
= le32_to_cpu(head
->result
);
515 dout("handle_reply op %d result %d\n", op
, result
);
517 case CEPHX_GET_AUTH_SESSION_KEY
:
518 /* verify auth key */
519 ret
= ceph_x_proc_ticket_reply(ac
, &xi
->secret
,
520 buf
+ sizeof(*head
), end
);
523 case CEPHX_GET_PRINCIPAL_SESSION_KEY
:
524 th
= get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
527 ret
= ceph_x_proc_ticket_reply(ac
, &th
->session_key
,
528 buf
+ sizeof(*head
), end
);
536 if (ac
->want_keys
== xi
->have_keys
)
541 static int ceph_x_create_authorizer(
542 struct ceph_auth_client
*ac
, int peer_type
,
543 struct ceph_auth_handshake
*auth
)
545 struct ceph_x_authorizer
*au
;
546 struct ceph_x_ticket_handler
*th
;
549 th
= get_ticket_handler(ac
, peer_type
);
553 au
= kzalloc(sizeof(*au
), GFP_NOFS
);
557 ret
= ceph_x_build_authorizer(ac
, th
, au
);
563 auth
->authorizer
= (struct ceph_authorizer
*) au
;
564 auth
->authorizer_buf
= au
->buf
->vec
.iov_base
;
565 auth
->authorizer_buf_len
= au
->buf
->vec
.iov_len
;
566 auth
->authorizer_reply_buf
= au
->reply_buf
;
567 auth
->authorizer_reply_buf_len
= sizeof (au
->reply_buf
);
572 static int ceph_x_update_authorizer(
573 struct ceph_auth_client
*ac
, int peer_type
,
574 struct ceph_auth_handshake
*auth
)
576 struct ceph_x_authorizer
*au
;
577 struct ceph_x_ticket_handler
*th
;
579 th
= get_ticket_handler(ac
, peer_type
);
583 au
= (struct ceph_x_authorizer
*)auth
->authorizer
;
584 if (au
->secret_id
< th
->secret_id
) {
585 dout("ceph_x_update_authorizer service %u secret %llu < %llu\n",
586 au
->service
, au
->secret_id
, th
->secret_id
);
587 return ceph_x_build_authorizer(ac
, th
, au
);
592 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client
*ac
,
593 struct ceph_authorizer
*a
, size_t len
)
595 struct ceph_x_authorizer
*au
= (void *)a
;
596 struct ceph_x_ticket_handler
*th
;
598 struct ceph_x_authorize_reply reply
;
599 void *preply
= &reply
;
600 void *p
= au
->reply_buf
;
601 void *end
= p
+ sizeof(au
->reply_buf
);
603 th
= get_ticket_handler(ac
, au
->service
);
606 ret
= ceph_x_decrypt(&th
->session_key
, &p
, end
, &preply
, sizeof(reply
));
609 if (ret
!= sizeof(reply
))
612 if (au
->nonce
+ 1 != le64_to_cpu(reply
.nonce_plus_one
))
616 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
617 au
->nonce
, le64_to_cpu(reply
.nonce_plus_one
), ret
);
621 static void ceph_x_destroy_authorizer(struct ceph_auth_client
*ac
,
622 struct ceph_authorizer
*a
)
624 struct ceph_x_authorizer
*au
= (void *)a
;
626 ceph_buffer_put(au
->buf
);
631 static void ceph_x_reset(struct ceph_auth_client
*ac
)
633 struct ceph_x_info
*xi
= ac
->private;
637 xi
->server_challenge
= 0;
640 static void ceph_x_destroy(struct ceph_auth_client
*ac
)
642 struct ceph_x_info
*xi
= ac
->private;
645 dout("ceph_x_destroy %p\n", ac
);
646 ceph_crypto_key_destroy(&xi
->secret
);
648 while ((p
= rb_first(&xi
->ticket_handlers
)) != NULL
) {
649 struct ceph_x_ticket_handler
*th
=
650 rb_entry(p
, struct ceph_x_ticket_handler
, node
);
651 remove_ticket_handler(ac
, th
);
654 if (xi
->auth_authorizer
.buf
)
655 ceph_buffer_put(xi
->auth_authorizer
.buf
);
661 static void ceph_x_invalidate_authorizer(struct ceph_auth_client
*ac
,
664 struct ceph_x_ticket_handler
*th
;
666 th
= get_ticket_handler(ac
, peer_type
);
668 memset(&th
->validity
, 0, sizeof(th
->validity
));
672 static const struct ceph_auth_client_ops ceph_x_ops
= {
674 .is_authenticated
= ceph_x_is_authenticated
,
675 .should_authenticate
= ceph_x_should_authenticate
,
676 .build_request
= ceph_x_build_request
,
677 .handle_reply
= ceph_x_handle_reply
,
678 .create_authorizer
= ceph_x_create_authorizer
,
679 .update_authorizer
= ceph_x_update_authorizer
,
680 .verify_authorizer_reply
= ceph_x_verify_authorizer_reply
,
681 .destroy_authorizer
= ceph_x_destroy_authorizer
,
682 .invalidate_authorizer
= ceph_x_invalidate_authorizer
,
683 .reset
= ceph_x_reset
,
684 .destroy
= ceph_x_destroy
,
688 int ceph_x_init(struct ceph_auth_client
*ac
)
690 struct ceph_x_info
*xi
;
693 dout("ceph_x_init %p\n", ac
);
695 xi
= kzalloc(sizeof(*xi
), GFP_NOFS
);
701 pr_err("no secret set (for auth_x protocol)\n");
705 ret
= ceph_crypto_key_clone(&xi
->secret
, ac
->key
);
707 pr_err("cannot clone key: %d\n", ret
);
712 xi
->ticket_handlers
= RB_ROOT
;
714 ac
->protocol
= CEPH_AUTH_CEPHX
;
716 ac
->ops
= &ceph_x_ops
;