2 #include "ceph_debug.h"
5 #include <linux/module.h>
6 #include <linux/random.h>
9 #include "auth_x_protocol.h"
14 struct kmem_cache
*ceph_x_ticketbuf_cachep
;
16 #define TEMP_TICKET_BUF_LEN 256
18 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
);
20 static int ceph_x_is_authenticated(struct ceph_auth_client
*ac
)
22 struct ceph_x_info
*xi
= ac
->private;
25 ceph_x_validate_tickets(ac
, &need
);
26 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
27 ac
->want_keys
, need
, xi
->have_keys
);
28 return (ac
->want_keys
& xi
->have_keys
) == ac
->want_keys
;
31 static int ceph_x_encrypt_buflen(int ilen
)
33 return sizeof(struct ceph_x_encrypt_header
) + ilen
+ 16 +
37 static int ceph_x_encrypt(struct ceph_crypto_key
*secret
,
38 void *ibuf
, int ilen
, void *obuf
, size_t olen
)
40 struct ceph_x_encrypt_header head
= {
42 .magic
= cpu_to_le64(CEPHX_ENC_MAGIC
)
44 size_t len
= olen
- sizeof(u32
);
47 ret
= ceph_encrypt2(secret
, obuf
+ sizeof(u32
), &len
,
48 &head
, sizeof(head
), ibuf
, ilen
);
51 ceph_encode_32(&obuf
, len
);
52 return len
+ sizeof(u32
);
55 static int ceph_x_decrypt(struct ceph_crypto_key
*secret
,
56 void **p
, void *end
, void *obuf
, size_t olen
)
58 struct ceph_x_encrypt_header head
;
59 size_t head_len
= sizeof(head
);
62 len
= ceph_decode_32(p
);
66 dout("ceph_x_decrypt len %d\n", len
);
67 ret
= ceph_decrypt2(secret
, &head
, &head_len
, obuf
, &olen
,
71 if (head
.struct_v
!= 1 || le64_to_cpu(head
.magic
) != CEPHX_ENC_MAGIC
)
78 * get existing (or insert new) ticket handler
80 struct ceph_x_ticket_handler
*get_ticket_handler(struct ceph_auth_client
*ac
,
83 struct ceph_x_ticket_handler
*th
;
84 struct ceph_x_info
*xi
= ac
->private;
85 struct rb_node
*parent
= NULL
, **p
= &xi
->ticket_handlers
.rb_node
;
89 th
= rb_entry(parent
, struct ceph_x_ticket_handler
, node
);
90 if (service
< th
->service
)
92 else if (service
> th
->service
)
99 th
= kzalloc(sizeof(*th
), GFP_NOFS
);
101 return ERR_PTR(-ENOMEM
);
102 th
->service
= service
;
103 rb_link_node(&th
->node
, parent
, p
);
104 rb_insert_color(&th
->node
, &xi
->ticket_handlers
);
108 static void remove_ticket_handler(struct ceph_auth_client
*ac
,
109 struct ceph_x_ticket_handler
*th
)
111 struct ceph_x_info
*xi
= ac
->private;
113 dout("remove_ticket_handler %p %d\n", th
, th
->service
);
114 rb_erase(&th
->node
, &xi
->ticket_handlers
);
115 ceph_crypto_key_destroy(&th
->session_key
);
117 ceph_buffer_put(th
->ticket_blob
);
121 static int ceph_x_proc_ticket_reply(struct ceph_auth_client
*ac
,
122 struct ceph_crypto_key
*secret
,
123 void *buf
, void *end
)
125 struct ceph_x_info
*xi
= ac
->private;
133 dbuf
= kmem_cache_alloc(ceph_x_ticketbuf_cachep
, GFP_NOFS
| GFP_ATOMIC
);
138 ticket_buf
= kmem_cache_alloc(ceph_x_ticketbuf_cachep
,
139 GFP_NOFS
| GFP_ATOMIC
);
143 ceph_decode_need(&p
, end
, 1 + sizeof(u32
), bad
);
144 struct_v
= ceph_decode_8(&p
);
147 num
= ceph_decode_32(&p
);
148 dout("%d tickets\n", num
);
152 struct ceph_x_ticket_handler
*th
;
156 struct timespec validity
;
157 struct ceph_crypto_key old_key
;
159 struct ceph_buffer
*new_ticket_blob
;
161 ceph_decode_need(&p
, end
, sizeof(u32
) + 1, bad
);
163 type
= ceph_decode_32(&p
);
164 dout(" ticket type %d %s\n", type
, ceph_entity_type_name(type
));
166 struct_v
= ceph_decode_8(&p
);
170 th
= get_ticket_handler(ac
, type
);
177 dlen
= ceph_x_decrypt(secret
, &p
, end
, dbuf
,
178 TEMP_TICKET_BUF_LEN
);
183 dout(" decrypted %d bytes\n", dlen
);
187 struct_v
= ceph_decode_8(&dp
);
191 memcpy(&old_key
, &th
->session_key
, sizeof(old_key
));
192 ret
= ceph_crypto_key_decode(&th
->session_key
, &dp
, dend
);
196 ceph_decode_copy(&dp
, &th
->validity
, sizeof(th
->validity
));
197 ceph_decode_timespec(&validity
, &th
->validity
);
198 th
->expires
= get_seconds() + validity
.tv_sec
;
199 th
->renew_after
= th
->expires
- (validity
.tv_sec
/ 4);
200 dout(" expires=%lu renew_after=%lu\n", th
->expires
,
203 /* ticket blob for service */
204 ceph_decode_8_safe(&p
, end
, is_enc
, bad
);
208 dout(" encrypted ticket\n");
209 dlen
= ceph_x_decrypt(&old_key
, &p
, end
, ticket_buf
,
210 TEMP_TICKET_BUF_LEN
);
215 dlen
= ceph_decode_32(&tp
);
218 ceph_decode_32_safe(&p
, end
, dlen
, bad
);
219 ceph_decode_need(&p
, end
, dlen
, bad
);
220 ceph_decode_copy(&p
, ticket_buf
, dlen
);
223 dout(" ticket blob is %d bytes\n", dlen
);
224 ceph_decode_need(&tp
, tpend
, 1 + sizeof(u64
), bad
);
225 struct_v
= ceph_decode_8(&tp
);
226 th
->secret_id
= ceph_decode_64(&tp
);
227 ret
= ceph_decode_buffer(&new_ticket_blob
, &tp
, tpend
);
231 ceph_buffer_put(th
->ticket_blob
);
232 th
->ticket_blob
= new_ticket_blob
;
233 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
234 type
, ceph_entity_type_name(type
), th
->secret_id
,
235 (int)th
->ticket_blob
->vec
.iov_len
);
236 xi
->have_keys
|= th
->service
;
241 kmem_cache_free(ceph_x_ticketbuf_cachep
, ticket_buf
);
243 kmem_cache_free(ceph_x_ticketbuf_cachep
, dbuf
);
251 static int ceph_x_build_authorizer(struct ceph_auth_client
*ac
,
252 struct ceph_x_ticket_handler
*th
,
253 struct ceph_x_authorizer
*au
)
256 struct ceph_x_authorize_a
*msg_a
;
257 struct ceph_x_authorize_b msg_b
;
260 int ticket_blob_len
=
261 (th
->ticket_blob
? th
->ticket_blob
->vec
.iov_len
: 0);
263 dout("build_authorizer for %s %p\n",
264 ceph_entity_type_name(th
->service
), au
);
266 maxlen
= sizeof(*msg_a
) + sizeof(msg_b
) +
267 ceph_x_encrypt_buflen(ticket_blob_len
);
268 dout(" need len %d\n", maxlen
);
269 if (au
->buf
&& au
->buf
->alloc_len
< maxlen
) {
270 ceph_buffer_put(au
->buf
);
274 au
->buf
= ceph_buffer_new(maxlen
, GFP_NOFS
);
278 au
->service
= th
->service
;
280 msg_a
= au
->buf
->vec
.iov_base
;
282 msg_a
->global_id
= cpu_to_le64(ac
->global_id
);
283 msg_a
->service_id
= cpu_to_le32(th
->service
);
284 msg_a
->ticket_blob
.struct_v
= 1;
285 msg_a
->ticket_blob
.secret_id
= cpu_to_le64(th
->secret_id
);
286 msg_a
->ticket_blob
.blob_len
= cpu_to_le32(ticket_blob_len
);
287 if (ticket_blob_len
) {
288 memcpy(msg_a
->ticket_blob
.blob
, th
->ticket_blob
->vec
.iov_base
,
289 th
->ticket_blob
->vec
.iov_len
);
291 dout(" th %p secret_id %lld %lld\n", th
, th
->secret_id
,
292 le64_to_cpu(msg_a
->ticket_blob
.secret_id
));
295 p
+= ticket_blob_len
;
296 end
= au
->buf
->vec
.iov_base
+ au
->buf
->vec
.iov_len
;
298 get_random_bytes(&au
->nonce
, sizeof(au
->nonce
));
300 msg_b
.nonce
= cpu_to_le64(au
->nonce
);
301 ret
= ceph_x_encrypt(&th
->session_key
, &msg_b
, sizeof(msg_b
),
306 au
->buf
->vec
.iov_len
= p
- au
->buf
->vec
.iov_base
;
307 dout(" built authorizer nonce %llx len %d\n", au
->nonce
,
308 (int)au
->buf
->vec
.iov_len
);
309 BUG_ON(au
->buf
->vec
.iov_len
> maxlen
);
313 ceph_buffer_put(au
->buf
);
318 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler
*th
,
321 ceph_decode_need(p
, end
, 1 + sizeof(u64
), bad
);
323 ceph_encode_64(p
, th
->secret_id
);
324 if (th
->ticket_blob
) {
325 const char *buf
= th
->ticket_blob
->vec
.iov_base
;
326 u32 len
= th
->ticket_blob
->vec
.iov_len
;
328 ceph_encode_32_safe(p
, end
, len
, bad
);
329 ceph_encode_copy_safe(p
, end
, buf
, len
, bad
);
331 ceph_encode_32_safe(p
, end
, 0, bad
);
339 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
)
341 int want
= ac
->want_keys
;
342 struct ceph_x_info
*xi
= ac
->private;
345 *pneed
= ac
->want_keys
& ~(xi
->have_keys
);
347 for (service
= 1; service
<= want
; service
<<= 1) {
348 struct ceph_x_ticket_handler
*th
;
350 if (!(ac
->want_keys
& service
))
353 if (*pneed
& service
)
356 th
= get_ticket_handler(ac
, service
);
363 if (get_seconds() >= th
->renew_after
)
365 if (get_seconds() >= th
->expires
)
366 xi
->have_keys
&= ~service
;
371 static int ceph_x_build_request(struct ceph_auth_client
*ac
,
372 void *buf
, void *end
)
374 struct ceph_x_info
*xi
= ac
->private;
376 struct ceph_x_request_header
*head
= buf
;
378 struct ceph_x_ticket_handler
*th
=
379 get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
381 ceph_x_validate_tickets(ac
, &need
);
383 dout("build_request want %x have %x need %x\n",
384 ac
->want_keys
, xi
->have_keys
, need
);
386 if (need
& CEPH_ENTITY_TYPE_AUTH
) {
387 struct ceph_x_authenticate
*auth
= (void *)(head
+ 1);
389 struct ceph_x_challenge_blob tmp
;
396 dout(" get_auth_session_key\n");
397 head
->op
= cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY
);
399 /* encrypt and hash */
400 get_random_bytes(&auth
->client_challenge
, sizeof(u64
));
401 tmp
.client_challenge
= auth
->client_challenge
;
402 tmp
.server_challenge
= cpu_to_le64(xi
->server_challenge
);
403 ret
= ceph_x_encrypt(&xi
->secret
, &tmp
, sizeof(tmp
),
404 tmp_enc
, sizeof(tmp_enc
));
410 for (u
= (u64
*)tmp_enc
; u
+ 1 <= (u64
*)(tmp_enc
+ ret
); u
++)
412 dout(" server_challenge %llx client_challenge %llx key %llx\n",
413 xi
->server_challenge
, le64_to_cpu(auth
->client_challenge
),
414 le64_to_cpu(auth
->key
));
416 /* now encode the old ticket if exists */
417 ret
= ceph_x_encode_ticket(th
, &p
, end
);
426 struct ceph_x_service_ticket_request
*req
;
430 head
->op
= cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY
);
433 ret
= ceph_x_build_authorizer(ac
, th
, &xi
->auth_authorizer
);
436 ceph_encode_copy(&p
, xi
->auth_authorizer
.buf
->vec
.iov_base
,
437 xi
->auth_authorizer
.buf
->vec
.iov_len
);
440 req
->keys
= cpu_to_le32(need
);
448 static int ceph_x_handle_reply(struct ceph_auth_client
*ac
, int result
,
449 void *buf
, void *end
)
451 struct ceph_x_info
*xi
= ac
->private;
452 struct ceph_x_reply_header
*head
= buf
;
453 struct ceph_x_ticket_handler
*th
;
459 return result
; /* XXX hmm? */
463 struct ceph_x_server_challenge
*sc
= buf
;
465 if (len
!= sizeof(*sc
))
467 xi
->server_challenge
= le64_to_cpu(sc
->server_challenge
);
468 dout("handle_reply got server challenge %llx\n",
469 xi
->server_challenge
);
470 xi
->starting
= false;
471 xi
->have_keys
&= ~CEPH_ENTITY_TYPE_AUTH
;
475 op
= le32_to_cpu(head
->op
);
476 result
= le32_to_cpu(head
->result
);
477 dout("handle_reply op %d result %d\n", op
, result
);
479 case CEPHX_GET_AUTH_SESSION_KEY
:
480 /* verify auth key */
481 ret
= ceph_x_proc_ticket_reply(ac
, &xi
->secret
,
482 buf
+ sizeof(*head
), end
);
485 case CEPHX_GET_PRINCIPAL_SESSION_KEY
:
486 th
= get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
488 ret
= ceph_x_proc_ticket_reply(ac
, &th
->session_key
,
489 buf
+ sizeof(*head
), end
);
497 if (ac
->want_keys
== xi
->have_keys
)
502 static int ceph_x_create_authorizer(
503 struct ceph_auth_client
*ac
, int peer_type
,
504 struct ceph_authorizer
**a
,
505 void **buf
, size_t *len
,
506 void **reply_buf
, size_t *reply_len
)
508 struct ceph_x_authorizer
*au
;
509 struct ceph_x_ticket_handler
*th
;
512 th
= get_ticket_handler(ac
, peer_type
);
516 au
= kzalloc(sizeof(*au
), GFP_NOFS
);
520 ret
= ceph_x_build_authorizer(ac
, th
, au
);
526 *a
= (struct ceph_authorizer
*)au
;
527 *buf
= au
->buf
->vec
.iov_base
;
528 *len
= au
->buf
->vec
.iov_len
;
529 *reply_buf
= au
->reply_buf
;
530 *reply_len
= sizeof(au
->reply_buf
);
534 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client
*ac
,
535 struct ceph_authorizer
*a
, size_t len
)
537 struct ceph_x_authorizer
*au
= (void *)a
;
538 struct ceph_x_ticket_handler
*th
;
540 struct ceph_x_authorize_reply reply
;
541 void *p
= au
->reply_buf
;
542 void *end
= p
+ sizeof(au
->reply_buf
);
544 th
= get_ticket_handler(ac
, au
->service
);
546 return -EIO
; /* hrm! */
547 ret
= ceph_x_decrypt(&th
->session_key
, &p
, end
, &reply
, sizeof(reply
));
550 if (ret
!= sizeof(reply
))
553 if (au
->nonce
+ 1 != le64_to_cpu(reply
.nonce_plus_one
))
557 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
558 au
->nonce
, le64_to_cpu(reply
.nonce_plus_one
), ret
);
562 static void ceph_x_destroy_authorizer(struct ceph_auth_client
*ac
,
563 struct ceph_authorizer
*a
)
565 struct ceph_x_authorizer
*au
= (void *)a
;
567 ceph_buffer_put(au
->buf
);
572 static void ceph_x_reset(struct ceph_auth_client
*ac
)
574 struct ceph_x_info
*xi
= ac
->private;
578 xi
->server_challenge
= 0;
581 static void ceph_x_destroy(struct ceph_auth_client
*ac
)
583 struct ceph_x_info
*xi
= ac
->private;
586 dout("ceph_x_destroy %p\n", ac
);
587 ceph_crypto_key_destroy(&xi
->secret
);
589 while ((p
= rb_first(&xi
->ticket_handlers
)) != NULL
) {
590 struct ceph_x_ticket_handler
*th
=
591 rb_entry(p
, struct ceph_x_ticket_handler
, node
);
592 remove_ticket_handler(ac
, th
);
595 kmem_cache_destroy(ceph_x_ticketbuf_cachep
);
601 static void ceph_x_invalidate_authorizer(struct ceph_auth_client
*ac
,
604 struct ceph_x_ticket_handler
*th
;
606 th
= get_ticket_handler(ac
, peer_type
);
607 if (th
&& !IS_ERR(th
))
608 remove_ticket_handler(ac
, th
);
612 static const struct ceph_auth_client_ops ceph_x_ops
= {
613 .is_authenticated
= ceph_x_is_authenticated
,
614 .build_request
= ceph_x_build_request
,
615 .handle_reply
= ceph_x_handle_reply
,
616 .create_authorizer
= ceph_x_create_authorizer
,
617 .verify_authorizer_reply
= ceph_x_verify_authorizer_reply
,
618 .destroy_authorizer
= ceph_x_destroy_authorizer
,
619 .invalidate_authorizer
= ceph_x_invalidate_authorizer
,
620 .reset
= ceph_x_reset
,
621 .destroy
= ceph_x_destroy
,
625 int ceph_x_init(struct ceph_auth_client
*ac
)
627 struct ceph_x_info
*xi
;
630 dout("ceph_x_init %p\n", ac
);
631 xi
= kzalloc(sizeof(*xi
), GFP_NOFS
);
636 ceph_x_ticketbuf_cachep
= kmem_cache_create("ceph_x_ticketbuf",
637 TEMP_TICKET_BUF_LEN
, 8,
638 (SLAB_RECLAIM_ACCOUNT
|SLAB_MEM_SPREAD
),
640 if (!ceph_x_ticketbuf_cachep
)
644 pr_err("no secret set (for auth_x protocol)\n");
648 ret
= ceph_crypto_key_unarmor(&xi
->secret
, ac
->secret
);
653 xi
->ticket_handlers
= RB_ROOT
;
655 ac
->protocol
= CEPH_AUTH_CEPHX
;
657 ac
->ops
= &ceph_x_ops
;
662 if (ceph_x_ticketbuf_cachep
)
663 kmem_cache_destroy(ceph_x_ticketbuf_cachep
);