2 #include "ceph_debug.h"
5 #include <linux/module.h>
6 #include <linux/random.h>
7 #include <linux/slab.h>
10 #include "auth_x_protocol.h"
15 struct kmem_cache
*ceph_x_ticketbuf_cachep
;
17 #define TEMP_TICKET_BUF_LEN 256
19 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
);
21 static int ceph_x_is_authenticated(struct ceph_auth_client
*ac
)
23 struct ceph_x_info
*xi
= ac
->private;
26 ceph_x_validate_tickets(ac
, &need
);
27 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
28 ac
->want_keys
, need
, xi
->have_keys
);
29 return (ac
->want_keys
& xi
->have_keys
) == ac
->want_keys
;
32 static int ceph_x_encrypt_buflen(int ilen
)
34 return sizeof(struct ceph_x_encrypt_header
) + ilen
+ 16 +
38 static int ceph_x_encrypt(struct ceph_crypto_key
*secret
,
39 void *ibuf
, int ilen
, void *obuf
, size_t olen
)
41 struct ceph_x_encrypt_header head
= {
43 .magic
= cpu_to_le64(CEPHX_ENC_MAGIC
)
45 size_t len
= olen
- sizeof(u32
);
48 ret
= ceph_encrypt2(secret
, obuf
+ sizeof(u32
), &len
,
49 &head
, sizeof(head
), ibuf
, ilen
);
52 ceph_encode_32(&obuf
, len
);
53 return len
+ sizeof(u32
);
56 static int ceph_x_decrypt(struct ceph_crypto_key
*secret
,
57 void **p
, void *end
, void *obuf
, size_t olen
)
59 struct ceph_x_encrypt_header head
;
60 size_t head_len
= sizeof(head
);
63 len
= ceph_decode_32(p
);
67 dout("ceph_x_decrypt len %d\n", len
);
68 ret
= ceph_decrypt2(secret
, &head
, &head_len
, obuf
, &olen
,
72 if (head
.struct_v
!= 1 || le64_to_cpu(head
.magic
) != CEPHX_ENC_MAGIC
)
79 * get existing (or insert new) ticket handler
81 struct ceph_x_ticket_handler
*get_ticket_handler(struct ceph_auth_client
*ac
,
84 struct ceph_x_ticket_handler
*th
;
85 struct ceph_x_info
*xi
= ac
->private;
86 struct rb_node
*parent
= NULL
, **p
= &xi
->ticket_handlers
.rb_node
;
90 th
= rb_entry(parent
, struct ceph_x_ticket_handler
, node
);
91 if (service
< th
->service
)
93 else if (service
> th
->service
)
100 th
= kzalloc(sizeof(*th
), GFP_NOFS
);
102 return ERR_PTR(-ENOMEM
);
103 th
->service
= service
;
104 rb_link_node(&th
->node
, parent
, p
);
105 rb_insert_color(&th
->node
, &xi
->ticket_handlers
);
109 static void remove_ticket_handler(struct ceph_auth_client
*ac
,
110 struct ceph_x_ticket_handler
*th
)
112 struct ceph_x_info
*xi
= ac
->private;
114 dout("remove_ticket_handler %p %d\n", th
, th
->service
);
115 rb_erase(&th
->node
, &xi
->ticket_handlers
);
116 ceph_crypto_key_destroy(&th
->session_key
);
118 ceph_buffer_put(th
->ticket_blob
);
122 static int ceph_x_proc_ticket_reply(struct ceph_auth_client
*ac
,
123 struct ceph_crypto_key
*secret
,
124 void *buf
, void *end
)
126 struct ceph_x_info
*xi
= ac
->private;
134 dbuf
= kmem_cache_alloc(ceph_x_ticketbuf_cachep
, GFP_NOFS
| GFP_ATOMIC
);
139 ticket_buf
= kmem_cache_alloc(ceph_x_ticketbuf_cachep
,
140 GFP_NOFS
| GFP_ATOMIC
);
144 ceph_decode_need(&p
, end
, 1 + sizeof(u32
), bad
);
145 struct_v
= ceph_decode_8(&p
);
148 num
= ceph_decode_32(&p
);
149 dout("%d tickets\n", num
);
153 struct ceph_x_ticket_handler
*th
;
157 struct timespec validity
;
158 struct ceph_crypto_key old_key
;
160 struct ceph_timespec new_validity
;
161 struct ceph_crypto_key new_session_key
;
162 struct ceph_buffer
*new_ticket_blob
;
163 unsigned long new_expires
, new_renew_after
;
166 ceph_decode_need(&p
, end
, sizeof(u32
) + 1, bad
);
168 type
= ceph_decode_32(&p
);
169 dout(" ticket type %d %s\n", type
, ceph_entity_type_name(type
));
171 struct_v
= ceph_decode_8(&p
);
175 th
= get_ticket_handler(ac
, type
);
182 dlen
= ceph_x_decrypt(secret
, &p
, end
, dbuf
,
183 TEMP_TICKET_BUF_LEN
);
188 dout(" decrypted %d bytes\n", dlen
);
192 struct_v
= ceph_decode_8(&dp
);
196 memcpy(&old_key
, &th
->session_key
, sizeof(old_key
));
197 ret
= ceph_crypto_key_decode(&new_session_key
, &dp
, dend
);
201 ceph_decode_copy(&dp
, &new_validity
, sizeof(new_validity
));
202 ceph_decode_timespec(&validity
, &new_validity
);
203 new_expires
= get_seconds() + validity
.tv_sec
;
204 new_renew_after
= new_expires
- (validity
.tv_sec
/ 4);
205 dout(" expires=%lu renew_after=%lu\n", new_expires
,
208 /* ticket blob for service */
209 ceph_decode_8_safe(&p
, end
, is_enc
, bad
);
213 dout(" encrypted ticket\n");
214 dlen
= ceph_x_decrypt(&old_key
, &p
, end
, ticket_buf
,
215 TEMP_TICKET_BUF_LEN
);
220 dlen
= ceph_decode_32(&tp
);
223 ceph_decode_32_safe(&p
, end
, dlen
, bad
);
224 ceph_decode_need(&p
, end
, dlen
, bad
);
225 ceph_decode_copy(&p
, ticket_buf
, dlen
);
228 dout(" ticket blob is %d bytes\n", dlen
);
229 ceph_decode_need(&tp
, tpend
, 1 + sizeof(u64
), bad
);
230 struct_v
= ceph_decode_8(&tp
);
231 new_secret_id
= ceph_decode_64(&tp
);
232 ret
= ceph_decode_buffer(&new_ticket_blob
, &tp
, tpend
);
236 /* all is well, update our ticket */
237 ceph_crypto_key_destroy(&th
->session_key
);
239 ceph_buffer_put(th
->ticket_blob
);
240 th
->session_key
= new_session_key
;
241 th
->ticket_blob
= new_ticket_blob
;
242 th
->validity
= new_validity
;
243 th
->secret_id
= new_secret_id
;
244 th
->expires
= new_expires
;
245 th
->renew_after
= new_renew_after
;
246 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
247 type
, ceph_entity_type_name(type
), th
->secret_id
,
248 (int)th
->ticket_blob
->vec
.iov_len
);
249 xi
->have_keys
|= th
->service
;
254 kmem_cache_free(ceph_x_ticketbuf_cachep
, ticket_buf
);
256 kmem_cache_free(ceph_x_ticketbuf_cachep
, dbuf
);
264 static int ceph_x_build_authorizer(struct ceph_auth_client
*ac
,
265 struct ceph_x_ticket_handler
*th
,
266 struct ceph_x_authorizer
*au
)
269 struct ceph_x_authorize_a
*msg_a
;
270 struct ceph_x_authorize_b msg_b
;
273 int ticket_blob_len
=
274 (th
->ticket_blob
? th
->ticket_blob
->vec
.iov_len
: 0);
276 dout("build_authorizer for %s %p\n",
277 ceph_entity_type_name(th
->service
), au
);
279 maxlen
= sizeof(*msg_a
) + sizeof(msg_b
) +
280 ceph_x_encrypt_buflen(ticket_blob_len
);
281 dout(" need len %d\n", maxlen
);
282 if (au
->buf
&& au
->buf
->alloc_len
< maxlen
) {
283 ceph_buffer_put(au
->buf
);
287 au
->buf
= ceph_buffer_new(maxlen
, GFP_NOFS
);
291 au
->service
= th
->service
;
293 msg_a
= au
->buf
->vec
.iov_base
;
295 msg_a
->global_id
= cpu_to_le64(ac
->global_id
);
296 msg_a
->service_id
= cpu_to_le32(th
->service
);
297 msg_a
->ticket_blob
.struct_v
= 1;
298 msg_a
->ticket_blob
.secret_id
= cpu_to_le64(th
->secret_id
);
299 msg_a
->ticket_blob
.blob_len
= cpu_to_le32(ticket_blob_len
);
300 if (ticket_blob_len
) {
301 memcpy(msg_a
->ticket_blob
.blob
, th
->ticket_blob
->vec
.iov_base
,
302 th
->ticket_blob
->vec
.iov_len
);
304 dout(" th %p secret_id %lld %lld\n", th
, th
->secret_id
,
305 le64_to_cpu(msg_a
->ticket_blob
.secret_id
));
308 p
+= ticket_blob_len
;
309 end
= au
->buf
->vec
.iov_base
+ au
->buf
->vec
.iov_len
;
311 get_random_bytes(&au
->nonce
, sizeof(au
->nonce
));
313 msg_b
.nonce
= cpu_to_le64(au
->nonce
);
314 ret
= ceph_x_encrypt(&th
->session_key
, &msg_b
, sizeof(msg_b
),
319 au
->buf
->vec
.iov_len
= p
- au
->buf
->vec
.iov_base
;
320 dout(" built authorizer nonce %llx len %d\n", au
->nonce
,
321 (int)au
->buf
->vec
.iov_len
);
322 BUG_ON(au
->buf
->vec
.iov_len
> maxlen
);
326 ceph_buffer_put(au
->buf
);
331 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler
*th
,
334 ceph_decode_need(p
, end
, 1 + sizeof(u64
), bad
);
336 ceph_encode_64(p
, th
->secret_id
);
337 if (th
->ticket_blob
) {
338 const char *buf
= th
->ticket_blob
->vec
.iov_base
;
339 u32 len
= th
->ticket_blob
->vec
.iov_len
;
341 ceph_encode_32_safe(p
, end
, len
, bad
);
342 ceph_encode_copy_safe(p
, end
, buf
, len
, bad
);
344 ceph_encode_32_safe(p
, end
, 0, bad
);
352 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
)
354 int want
= ac
->want_keys
;
355 struct ceph_x_info
*xi
= ac
->private;
358 *pneed
= ac
->want_keys
& ~(xi
->have_keys
);
360 for (service
= 1; service
<= want
; service
<<= 1) {
361 struct ceph_x_ticket_handler
*th
;
363 if (!(ac
->want_keys
& service
))
366 if (*pneed
& service
)
369 th
= get_ticket_handler(ac
, service
);
376 if (get_seconds() >= th
->renew_after
)
378 if (get_seconds() >= th
->expires
)
379 xi
->have_keys
&= ~service
;
384 static int ceph_x_build_request(struct ceph_auth_client
*ac
,
385 void *buf
, void *end
)
387 struct ceph_x_info
*xi
= ac
->private;
389 struct ceph_x_request_header
*head
= buf
;
391 struct ceph_x_ticket_handler
*th
=
392 get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
394 ceph_x_validate_tickets(ac
, &need
);
396 dout("build_request want %x have %x need %x\n",
397 ac
->want_keys
, xi
->have_keys
, need
);
399 if (need
& CEPH_ENTITY_TYPE_AUTH
) {
400 struct ceph_x_authenticate
*auth
= (void *)(head
+ 1);
402 struct ceph_x_challenge_blob tmp
;
409 dout(" get_auth_session_key\n");
410 head
->op
= cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY
);
412 /* encrypt and hash */
413 get_random_bytes(&auth
->client_challenge
, sizeof(u64
));
414 tmp
.client_challenge
= auth
->client_challenge
;
415 tmp
.server_challenge
= cpu_to_le64(xi
->server_challenge
);
416 ret
= ceph_x_encrypt(&xi
->secret
, &tmp
, sizeof(tmp
),
417 tmp_enc
, sizeof(tmp_enc
));
423 for (u
= (u64
*)tmp_enc
; u
+ 1 <= (u64
*)(tmp_enc
+ ret
); u
++)
425 dout(" server_challenge %llx client_challenge %llx key %llx\n",
426 xi
->server_challenge
, le64_to_cpu(auth
->client_challenge
),
427 le64_to_cpu(auth
->key
));
429 /* now encode the old ticket if exists */
430 ret
= ceph_x_encode_ticket(th
, &p
, end
);
439 struct ceph_x_service_ticket_request
*req
;
443 head
->op
= cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY
);
446 ret
= ceph_x_build_authorizer(ac
, th
, &xi
->auth_authorizer
);
449 ceph_encode_copy(&p
, xi
->auth_authorizer
.buf
->vec
.iov_base
,
450 xi
->auth_authorizer
.buf
->vec
.iov_len
);
453 req
->keys
= cpu_to_le32(need
);
461 static int ceph_x_handle_reply(struct ceph_auth_client
*ac
, int result
,
462 void *buf
, void *end
)
464 struct ceph_x_info
*xi
= ac
->private;
465 struct ceph_x_reply_header
*head
= buf
;
466 struct ceph_x_ticket_handler
*th
;
472 return result
; /* XXX hmm? */
476 struct ceph_x_server_challenge
*sc
= buf
;
478 if (len
!= sizeof(*sc
))
480 xi
->server_challenge
= le64_to_cpu(sc
->server_challenge
);
481 dout("handle_reply got server challenge %llx\n",
482 xi
->server_challenge
);
483 xi
->starting
= false;
484 xi
->have_keys
&= ~CEPH_ENTITY_TYPE_AUTH
;
488 op
= le32_to_cpu(head
->op
);
489 result
= le32_to_cpu(head
->result
);
490 dout("handle_reply op %d result %d\n", op
, result
);
492 case CEPHX_GET_AUTH_SESSION_KEY
:
493 /* verify auth key */
494 ret
= ceph_x_proc_ticket_reply(ac
, &xi
->secret
,
495 buf
+ sizeof(*head
), end
);
498 case CEPHX_GET_PRINCIPAL_SESSION_KEY
:
499 th
= get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
501 ret
= ceph_x_proc_ticket_reply(ac
, &th
->session_key
,
502 buf
+ sizeof(*head
), end
);
510 if (ac
->want_keys
== xi
->have_keys
)
515 static int ceph_x_create_authorizer(
516 struct ceph_auth_client
*ac
, int peer_type
,
517 struct ceph_authorizer
**a
,
518 void **buf
, size_t *len
,
519 void **reply_buf
, size_t *reply_len
)
521 struct ceph_x_authorizer
*au
;
522 struct ceph_x_ticket_handler
*th
;
525 th
= get_ticket_handler(ac
, peer_type
);
529 au
= kzalloc(sizeof(*au
), GFP_NOFS
);
533 ret
= ceph_x_build_authorizer(ac
, th
, au
);
539 *a
= (struct ceph_authorizer
*)au
;
540 *buf
= au
->buf
->vec
.iov_base
;
541 *len
= au
->buf
->vec
.iov_len
;
542 *reply_buf
= au
->reply_buf
;
543 *reply_len
= sizeof(au
->reply_buf
);
547 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client
*ac
,
548 struct ceph_authorizer
*a
, size_t len
)
550 struct ceph_x_authorizer
*au
= (void *)a
;
551 struct ceph_x_ticket_handler
*th
;
553 struct ceph_x_authorize_reply reply
;
554 void *p
= au
->reply_buf
;
555 void *end
= p
+ sizeof(au
->reply_buf
);
557 th
= get_ticket_handler(ac
, au
->service
);
559 return -EIO
; /* hrm! */
560 ret
= ceph_x_decrypt(&th
->session_key
, &p
, end
, &reply
, sizeof(reply
));
563 if (ret
!= sizeof(reply
))
566 if (au
->nonce
+ 1 != le64_to_cpu(reply
.nonce_plus_one
))
570 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
571 au
->nonce
, le64_to_cpu(reply
.nonce_plus_one
), ret
);
575 static void ceph_x_destroy_authorizer(struct ceph_auth_client
*ac
,
576 struct ceph_authorizer
*a
)
578 struct ceph_x_authorizer
*au
= (void *)a
;
580 ceph_buffer_put(au
->buf
);
585 static void ceph_x_reset(struct ceph_auth_client
*ac
)
587 struct ceph_x_info
*xi
= ac
->private;
591 xi
->server_challenge
= 0;
594 static void ceph_x_destroy(struct ceph_auth_client
*ac
)
596 struct ceph_x_info
*xi
= ac
->private;
599 dout("ceph_x_destroy %p\n", ac
);
600 ceph_crypto_key_destroy(&xi
->secret
);
602 while ((p
= rb_first(&xi
->ticket_handlers
)) != NULL
) {
603 struct ceph_x_ticket_handler
*th
=
604 rb_entry(p
, struct ceph_x_ticket_handler
, node
);
605 remove_ticket_handler(ac
, th
);
608 kmem_cache_destroy(ceph_x_ticketbuf_cachep
);
614 static void ceph_x_invalidate_authorizer(struct ceph_auth_client
*ac
,
617 struct ceph_x_ticket_handler
*th
;
619 th
= get_ticket_handler(ac
, peer_type
);
620 if (th
&& !IS_ERR(th
))
621 remove_ticket_handler(ac
, th
);
625 static const struct ceph_auth_client_ops ceph_x_ops
= {
626 .is_authenticated
= ceph_x_is_authenticated
,
627 .build_request
= ceph_x_build_request
,
628 .handle_reply
= ceph_x_handle_reply
,
629 .create_authorizer
= ceph_x_create_authorizer
,
630 .verify_authorizer_reply
= ceph_x_verify_authorizer_reply
,
631 .destroy_authorizer
= ceph_x_destroy_authorizer
,
632 .invalidate_authorizer
= ceph_x_invalidate_authorizer
,
633 .reset
= ceph_x_reset
,
634 .destroy
= ceph_x_destroy
,
638 int ceph_x_init(struct ceph_auth_client
*ac
)
640 struct ceph_x_info
*xi
;
643 dout("ceph_x_init %p\n", ac
);
644 xi
= kzalloc(sizeof(*xi
), GFP_NOFS
);
649 ceph_x_ticketbuf_cachep
= kmem_cache_create("ceph_x_ticketbuf",
650 TEMP_TICKET_BUF_LEN
, 8,
651 (SLAB_RECLAIM_ACCOUNT
|SLAB_MEM_SPREAD
),
653 if (!ceph_x_ticketbuf_cachep
)
657 pr_err("no secret set (for auth_x protocol)\n");
661 ret
= ceph_crypto_key_unarmor(&xi
->secret
, ac
->secret
);
666 xi
->ticket_handlers
= RB_ROOT
;
668 ac
->protocol
= CEPH_AUTH_CEPHX
;
670 ac
->ops
= &ceph_x_ops
;
675 if (ceph_x_ticketbuf_cachep
)
676 kmem_cache_destroy(ceph_x_ticketbuf_cachep
);