2 #include <linux/ceph/ceph_debug.h>
5 #include <linux/module.h>
6 #include <linux/random.h>
7 #include <linux/slab.h>
9 #include <linux/ceph/decode.h>
10 #include <linux/ceph/auth.h>
11 #include <linux/ceph/messenger.h>
15 #include "auth_x_protocol.h"
17 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
);
19 static int ceph_x_is_authenticated(struct ceph_auth_client
*ac
)
21 struct ceph_x_info
*xi
= ac
->private;
24 ceph_x_validate_tickets(ac
, &need
);
25 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
26 ac
->want_keys
, need
, xi
->have_keys
);
27 return (ac
->want_keys
& xi
->have_keys
) == ac
->want_keys
;
30 static int ceph_x_should_authenticate(struct ceph_auth_client
*ac
)
32 struct ceph_x_info
*xi
= ac
->private;
35 ceph_x_validate_tickets(ac
, &need
);
36 dout("ceph_x_should_authenticate want=%d need=%d have=%d\n",
37 ac
->want_keys
, need
, xi
->have_keys
);
41 static int ceph_x_encrypt_buflen(int ilen
)
43 return sizeof(struct ceph_x_encrypt_header
) + ilen
+ 16 +
47 static int ceph_x_encrypt(struct ceph_crypto_key
*secret
,
48 void *ibuf
, int ilen
, void *obuf
, size_t olen
)
50 struct ceph_x_encrypt_header head
= {
52 .magic
= cpu_to_le64(CEPHX_ENC_MAGIC
)
54 size_t len
= olen
- sizeof(u32
);
57 ret
= ceph_encrypt2(secret
, obuf
+ sizeof(u32
), &len
,
58 &head
, sizeof(head
), ibuf
, ilen
);
61 ceph_encode_32(&obuf
, len
);
62 return len
+ sizeof(u32
);
65 static int ceph_x_decrypt(struct ceph_crypto_key
*secret
,
66 void **p
, void *end
, void **obuf
, size_t olen
)
68 struct ceph_x_encrypt_header head
;
69 size_t head_len
= sizeof(head
);
72 len
= ceph_decode_32(p
);
76 dout("ceph_x_decrypt len %d\n", len
);
78 *obuf
= kmalloc(len
, GFP_NOFS
);
84 ret
= ceph_decrypt2(secret
, &head
, &head_len
, *obuf
, &olen
, *p
, len
);
87 if (head
.struct_v
!= 1 || le64_to_cpu(head
.magic
) != CEPHX_ENC_MAGIC
)
94 * get existing (or insert new) ticket handler
96 static struct ceph_x_ticket_handler
*
97 get_ticket_handler(struct ceph_auth_client
*ac
, int service
)
99 struct ceph_x_ticket_handler
*th
;
100 struct ceph_x_info
*xi
= ac
->private;
101 struct rb_node
*parent
= NULL
, **p
= &xi
->ticket_handlers
.rb_node
;
105 th
= rb_entry(parent
, struct ceph_x_ticket_handler
, node
);
106 if (service
< th
->service
)
108 else if (service
> th
->service
)
115 th
= kzalloc(sizeof(*th
), GFP_NOFS
);
117 return ERR_PTR(-ENOMEM
);
118 th
->service
= service
;
119 rb_link_node(&th
->node
, parent
, p
);
120 rb_insert_color(&th
->node
, &xi
->ticket_handlers
);
124 static void remove_ticket_handler(struct ceph_auth_client
*ac
,
125 struct ceph_x_ticket_handler
*th
)
127 struct ceph_x_info
*xi
= ac
->private;
129 dout("remove_ticket_handler %p %d\n", th
, th
->service
);
130 rb_erase(&th
->node
, &xi
->ticket_handlers
);
131 ceph_crypto_key_destroy(&th
->session_key
);
133 ceph_buffer_put(th
->ticket_blob
);
137 static int process_one_ticket(struct ceph_auth_client
*ac
,
138 struct ceph_crypto_key
*secret
,
141 struct ceph_x_info
*xi
= ac
->private;
143 u8 tkt_struct_v
, blob_struct_v
;
144 struct ceph_x_ticket_handler
*th
;
149 struct timespec validity
;
150 struct ceph_crypto_key old_key
;
151 void *ticket_buf
= NULL
;
154 struct ceph_timespec new_validity
;
155 struct ceph_crypto_key new_session_key
;
156 struct ceph_buffer
*new_ticket_blob
;
157 unsigned long new_expires
, new_renew_after
;
161 ceph_decode_need(p
, end
, sizeof(u32
) + 1, bad
);
163 type
= ceph_decode_32(p
);
164 dout(" ticket type %d %s\n", type
, ceph_entity_type_name(type
));
166 tkt_struct_v
= ceph_decode_8(p
);
167 if (tkt_struct_v
!= 1)
170 th
= get_ticket_handler(ac
, type
);
177 dlen
= ceph_x_decrypt(secret
, p
, end
, &dbuf
, 0);
182 dout(" decrypted %d bytes\n", dlen
);
186 tkt_struct_v
= ceph_decode_8(&dp
);
187 if (tkt_struct_v
!= 1)
190 memcpy(&old_key
, &th
->session_key
, sizeof(old_key
));
191 ret
= ceph_crypto_key_decode(&new_session_key
, &dp
, dend
);
195 ceph_decode_copy(&dp
, &new_validity
, sizeof(new_validity
));
196 ceph_decode_timespec(&validity
, &new_validity
);
197 new_expires
= get_seconds() + validity
.tv_sec
;
198 new_renew_after
= new_expires
- (validity
.tv_sec
/ 4);
199 dout(" expires=%lu renew_after=%lu\n", new_expires
,
202 /* ticket blob for service */
203 ceph_decode_8_safe(p
, end
, is_enc
, bad
);
206 dout(" encrypted ticket\n");
207 dlen
= ceph_x_decrypt(&old_key
, p
, end
, &ticket_buf
, 0);
220 ceph_decode_32_safe(ptp
, tpend
, dlen
, bad
);
221 dout(" ticket blob is %d bytes\n", dlen
);
222 ceph_decode_need(ptp
, tpend
, 1 + sizeof(u64
), bad
);
223 blob_struct_v
= ceph_decode_8(ptp
);
224 new_secret_id
= ceph_decode_64(ptp
);
225 ret
= ceph_decode_buffer(&new_ticket_blob
, ptp
, tpend
);
229 /* all is well, update our ticket */
230 ceph_crypto_key_destroy(&th
->session_key
);
232 ceph_buffer_put(th
->ticket_blob
);
233 th
->session_key
= new_session_key
;
234 th
->ticket_blob
= new_ticket_blob
;
235 th
->validity
= new_validity
;
236 th
->secret_id
= new_secret_id
;
237 th
->expires
= new_expires
;
238 th
->renew_after
= new_renew_after
;
239 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
240 type
, ceph_entity_type_name(type
), th
->secret_id
,
241 (int)th
->ticket_blob
->vec
.iov_len
);
242 xi
->have_keys
|= th
->service
;
254 static int ceph_x_proc_ticket_reply(struct ceph_auth_client
*ac
,
255 struct ceph_crypto_key
*secret
,
256 void *buf
, void *end
)
263 ceph_decode_8_safe(&p
, end
, reply_struct_v
, bad
);
264 if (reply_struct_v
!= 1)
267 ceph_decode_32_safe(&p
, end
, num
, bad
);
268 dout("%d tickets\n", num
);
271 ret
= process_one_ticket(ac
, secret
, &p
, end
);
282 static void ceph_x_authorizer_cleanup(struct ceph_x_authorizer
*au
)
284 ceph_crypto_key_destroy(&au
->session_key
);
286 ceph_buffer_put(au
->buf
);
291 static int ceph_x_build_authorizer(struct ceph_auth_client
*ac
,
292 struct ceph_x_ticket_handler
*th
,
293 struct ceph_x_authorizer
*au
)
296 struct ceph_x_authorize_a
*msg_a
;
297 struct ceph_x_authorize_b msg_b
;
300 int ticket_blob_len
=
301 (th
->ticket_blob
? th
->ticket_blob
->vec
.iov_len
: 0);
303 dout("build_authorizer for %s %p\n",
304 ceph_entity_type_name(th
->service
), au
);
306 ceph_crypto_key_destroy(&au
->session_key
);
307 ret
= ceph_crypto_key_clone(&au
->session_key
, &th
->session_key
);
311 maxlen
= sizeof(*msg_a
) + sizeof(msg_b
) +
312 ceph_x_encrypt_buflen(ticket_blob_len
);
313 dout(" need len %d\n", maxlen
);
314 if (au
->buf
&& au
->buf
->alloc_len
< maxlen
) {
315 ceph_buffer_put(au
->buf
);
319 au
->buf
= ceph_buffer_new(maxlen
, GFP_NOFS
);
325 au
->service
= th
->service
;
326 au
->secret_id
= th
->secret_id
;
328 msg_a
= au
->buf
->vec
.iov_base
;
330 msg_a
->global_id
= cpu_to_le64(ac
->global_id
);
331 msg_a
->service_id
= cpu_to_le32(th
->service
);
332 msg_a
->ticket_blob
.struct_v
= 1;
333 msg_a
->ticket_blob
.secret_id
= cpu_to_le64(th
->secret_id
);
334 msg_a
->ticket_blob
.blob_len
= cpu_to_le32(ticket_blob_len
);
335 if (ticket_blob_len
) {
336 memcpy(msg_a
->ticket_blob
.blob
, th
->ticket_blob
->vec
.iov_base
,
337 th
->ticket_blob
->vec
.iov_len
);
339 dout(" th %p secret_id %lld %lld\n", th
, th
->secret_id
,
340 le64_to_cpu(msg_a
->ticket_blob
.secret_id
));
343 p
+= ticket_blob_len
;
344 end
= au
->buf
->vec
.iov_base
+ au
->buf
->vec
.iov_len
;
346 get_random_bytes(&au
->nonce
, sizeof(au
->nonce
));
348 msg_b
.nonce
= cpu_to_le64(au
->nonce
);
349 ret
= ceph_x_encrypt(&au
->session_key
, &msg_b
, sizeof(msg_b
),
354 au
->buf
->vec
.iov_len
= p
- au
->buf
->vec
.iov_base
;
355 dout(" built authorizer nonce %llx len %d\n", au
->nonce
,
356 (int)au
->buf
->vec
.iov_len
);
357 BUG_ON(au
->buf
->vec
.iov_len
> maxlen
);
361 ceph_x_authorizer_cleanup(au
);
365 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler
*th
,
368 ceph_decode_need(p
, end
, 1 + sizeof(u64
), bad
);
370 ceph_encode_64(p
, th
->secret_id
);
371 if (th
->ticket_blob
) {
372 const char *buf
= th
->ticket_blob
->vec
.iov_base
;
373 u32 len
= th
->ticket_blob
->vec
.iov_len
;
375 ceph_encode_32_safe(p
, end
, len
, bad
);
376 ceph_encode_copy_safe(p
, end
, buf
, len
, bad
);
378 ceph_encode_32_safe(p
, end
, 0, bad
);
386 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
)
388 int want
= ac
->want_keys
;
389 struct ceph_x_info
*xi
= ac
->private;
392 *pneed
= ac
->want_keys
& ~(xi
->have_keys
);
394 for (service
= 1; service
<= want
; service
<<= 1) {
395 struct ceph_x_ticket_handler
*th
;
397 if (!(ac
->want_keys
& service
))
400 if (*pneed
& service
)
403 th
= get_ticket_handler(ac
, service
);
410 if (get_seconds() >= th
->renew_after
)
412 if (get_seconds() >= th
->expires
)
413 xi
->have_keys
&= ~service
;
418 static int ceph_x_build_request(struct ceph_auth_client
*ac
,
419 void *buf
, void *end
)
421 struct ceph_x_info
*xi
= ac
->private;
423 struct ceph_x_request_header
*head
= buf
;
425 struct ceph_x_ticket_handler
*th
=
426 get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
431 ceph_x_validate_tickets(ac
, &need
);
433 dout("build_request want %x have %x need %x\n",
434 ac
->want_keys
, xi
->have_keys
, need
);
436 if (need
& CEPH_ENTITY_TYPE_AUTH
) {
437 struct ceph_x_authenticate
*auth
= (void *)(head
+ 1);
439 struct ceph_x_challenge_blob tmp
;
446 dout(" get_auth_session_key\n");
447 head
->op
= cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY
);
449 /* encrypt and hash */
450 get_random_bytes(&auth
->client_challenge
, sizeof(u64
));
451 tmp
.client_challenge
= auth
->client_challenge
;
452 tmp
.server_challenge
= cpu_to_le64(xi
->server_challenge
);
453 ret
= ceph_x_encrypt(&xi
->secret
, &tmp
, sizeof(tmp
),
454 tmp_enc
, sizeof(tmp_enc
));
460 for (u
= (u64
*)tmp_enc
; u
+ 1 <= (u64
*)(tmp_enc
+ ret
); u
++)
461 auth
->key
^= *(__le64
*)u
;
462 dout(" server_challenge %llx client_challenge %llx key %llx\n",
463 xi
->server_challenge
, le64_to_cpu(auth
->client_challenge
),
464 le64_to_cpu(auth
->key
));
466 /* now encode the old ticket if exists */
467 ret
= ceph_x_encode_ticket(th
, &p
, end
);
476 struct ceph_x_service_ticket_request
*req
;
480 head
->op
= cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY
);
482 ret
= ceph_x_build_authorizer(ac
, th
, &xi
->auth_authorizer
);
485 ceph_encode_copy(&p
, xi
->auth_authorizer
.buf
->vec
.iov_base
,
486 xi
->auth_authorizer
.buf
->vec
.iov_len
);
489 req
->keys
= cpu_to_le32(need
);
497 static int ceph_x_handle_reply(struct ceph_auth_client
*ac
, int result
,
498 void *buf
, void *end
)
500 struct ceph_x_info
*xi
= ac
->private;
501 struct ceph_x_reply_header
*head
= buf
;
502 struct ceph_x_ticket_handler
*th
;
508 return result
; /* XXX hmm? */
512 struct ceph_x_server_challenge
*sc
= buf
;
514 if (len
!= sizeof(*sc
))
516 xi
->server_challenge
= le64_to_cpu(sc
->server_challenge
);
517 dout("handle_reply got server challenge %llx\n",
518 xi
->server_challenge
);
519 xi
->starting
= false;
520 xi
->have_keys
&= ~CEPH_ENTITY_TYPE_AUTH
;
524 op
= le16_to_cpu(head
->op
);
525 result
= le32_to_cpu(head
->result
);
526 dout("handle_reply op %d result %d\n", op
, result
);
528 case CEPHX_GET_AUTH_SESSION_KEY
:
529 /* verify auth key */
530 ret
= ceph_x_proc_ticket_reply(ac
, &xi
->secret
,
531 buf
+ sizeof(*head
), end
);
534 case CEPHX_GET_PRINCIPAL_SESSION_KEY
:
535 th
= get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
538 ret
= ceph_x_proc_ticket_reply(ac
, &th
->session_key
,
539 buf
+ sizeof(*head
), end
);
547 if (ac
->want_keys
== xi
->have_keys
)
552 static int ceph_x_create_authorizer(
553 struct ceph_auth_client
*ac
, int peer_type
,
554 struct ceph_auth_handshake
*auth
)
556 struct ceph_x_authorizer
*au
;
557 struct ceph_x_ticket_handler
*th
;
560 th
= get_ticket_handler(ac
, peer_type
);
564 au
= kzalloc(sizeof(*au
), GFP_NOFS
);
568 ret
= ceph_x_build_authorizer(ac
, th
, au
);
574 auth
->authorizer
= (struct ceph_authorizer
*) au
;
575 auth
->authorizer_buf
= au
->buf
->vec
.iov_base
;
576 auth
->authorizer_buf_len
= au
->buf
->vec
.iov_len
;
577 auth
->authorizer_reply_buf
= au
->reply_buf
;
578 auth
->authorizer_reply_buf_len
= sizeof (au
->reply_buf
);
579 auth
->sign_message
= ac
->ops
->sign_message
;
580 auth
->check_message_signature
= ac
->ops
->check_message_signature
;
585 static int ceph_x_update_authorizer(
586 struct ceph_auth_client
*ac
, int peer_type
,
587 struct ceph_auth_handshake
*auth
)
589 struct ceph_x_authorizer
*au
;
590 struct ceph_x_ticket_handler
*th
;
592 th
= get_ticket_handler(ac
, peer_type
);
596 au
= (struct ceph_x_authorizer
*)auth
->authorizer
;
597 if (au
->secret_id
< th
->secret_id
) {
598 dout("ceph_x_update_authorizer service %u secret %llu < %llu\n",
599 au
->service
, au
->secret_id
, th
->secret_id
);
600 return ceph_x_build_authorizer(ac
, th
, au
);
605 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client
*ac
,
606 struct ceph_authorizer
*a
, size_t len
)
608 struct ceph_x_authorizer
*au
= (void *)a
;
610 struct ceph_x_authorize_reply reply
;
611 void *preply
= &reply
;
612 void *p
= au
->reply_buf
;
613 void *end
= p
+ sizeof(au
->reply_buf
);
615 ret
= ceph_x_decrypt(&au
->session_key
, &p
, end
, &preply
, sizeof(reply
));
618 if (ret
!= sizeof(reply
))
621 if (au
->nonce
+ 1 != le64_to_cpu(reply
.nonce_plus_one
))
625 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
626 au
->nonce
, le64_to_cpu(reply
.nonce_plus_one
), ret
);
630 static void ceph_x_destroy_authorizer(struct ceph_auth_client
*ac
,
631 struct ceph_authorizer
*a
)
633 struct ceph_x_authorizer
*au
= (void *)a
;
635 ceph_x_authorizer_cleanup(au
);
640 static void ceph_x_reset(struct ceph_auth_client
*ac
)
642 struct ceph_x_info
*xi
= ac
->private;
646 xi
->server_challenge
= 0;
649 static void ceph_x_destroy(struct ceph_auth_client
*ac
)
651 struct ceph_x_info
*xi
= ac
->private;
654 dout("ceph_x_destroy %p\n", ac
);
655 ceph_crypto_key_destroy(&xi
->secret
);
657 while ((p
= rb_first(&xi
->ticket_handlers
)) != NULL
) {
658 struct ceph_x_ticket_handler
*th
=
659 rb_entry(p
, struct ceph_x_ticket_handler
, node
);
660 remove_ticket_handler(ac
, th
);
663 ceph_x_authorizer_cleanup(&xi
->auth_authorizer
);
669 static void ceph_x_invalidate_authorizer(struct ceph_auth_client
*ac
,
672 struct ceph_x_ticket_handler
*th
;
674 th
= get_ticket_handler(ac
, peer_type
);
676 memset(&th
->validity
, 0, sizeof(th
->validity
));
679 static int calcu_signature(struct ceph_x_authorizer
*au
,
680 struct ceph_msg
*msg
, __le64
*sig
)
685 cpu_to_le32(16), msg
->hdr
.crc
, msg
->footer
.front_crc
,
686 msg
->footer
.middle_crc
, msg
->footer
.data_crc
,
688 ret
= ceph_x_encrypt(&au
->session_key
, &tmp
, sizeof(tmp
),
689 tmp_enc
, sizeof(tmp_enc
));
692 *sig
= *(__le64
*)(tmp_enc
+ 4);
696 static int ceph_x_sign_message(struct ceph_auth_handshake
*auth
,
697 struct ceph_msg
*msg
)
700 if (!auth
->authorizer
)
702 ret
= calcu_signature((struct ceph_x_authorizer
*)auth
->authorizer
,
703 msg
, &msg
->footer
.sig
);
706 msg
->footer
.flags
|= CEPH_MSG_FOOTER_SIGNED
;
710 static int ceph_x_check_message_signature(struct ceph_auth_handshake
*auth
,
711 struct ceph_msg
*msg
)
716 if (!auth
->authorizer
)
718 ret
= calcu_signature((struct ceph_x_authorizer
*)auth
->authorizer
,
722 if (sig_check
== msg
->footer
.sig
)
724 if (msg
->footer
.flags
& CEPH_MSG_FOOTER_SIGNED
)
725 dout("ceph_x_check_message_signature %p has signature %llx "
726 "expect %llx\n", msg
, msg
->footer
.sig
, sig_check
);
728 dout("ceph_x_check_message_signature %p sender did not set "
729 "CEPH_MSG_FOOTER_SIGNED\n", msg
);
733 static const struct ceph_auth_client_ops ceph_x_ops
= {
735 .is_authenticated
= ceph_x_is_authenticated
,
736 .should_authenticate
= ceph_x_should_authenticate
,
737 .build_request
= ceph_x_build_request
,
738 .handle_reply
= ceph_x_handle_reply
,
739 .create_authorizer
= ceph_x_create_authorizer
,
740 .update_authorizer
= ceph_x_update_authorizer
,
741 .verify_authorizer_reply
= ceph_x_verify_authorizer_reply
,
742 .destroy_authorizer
= ceph_x_destroy_authorizer
,
743 .invalidate_authorizer
= ceph_x_invalidate_authorizer
,
744 .reset
= ceph_x_reset
,
745 .destroy
= ceph_x_destroy
,
746 .sign_message
= ceph_x_sign_message
,
747 .check_message_signature
= ceph_x_check_message_signature
,
751 int ceph_x_init(struct ceph_auth_client
*ac
)
753 struct ceph_x_info
*xi
;
756 dout("ceph_x_init %p\n", ac
);
758 xi
= kzalloc(sizeof(*xi
), GFP_NOFS
);
764 pr_err("no secret set (for auth_x protocol)\n");
768 ret
= ceph_crypto_key_clone(&xi
->secret
, ac
->key
);
770 pr_err("cannot clone key: %d\n", ret
);
775 xi
->ticket_handlers
= RB_ROOT
;
777 ac
->protocol
= CEPH_AUTH_CEPHX
;
779 ac
->ops
= &ceph_x_ops
;