[deliverable/linux.git] / net / ceph / auth.c

#include <linux/ceph/ceph_debug.h>

#include <linux/module.h>
#include <linux/err.h>
#include <linux/slab.h>

#include <linux/ceph/types.h>
#include <linux/ceph/decode.h>
#include <linux/ceph/libceph.h>
#include <linux/ceph/messenger.h>
#include "auth_none.h"
#include "auth_x.h"


/*
 * get protocol handler
 */
static u32 supported_protocols[] = {
	CEPH_AUTH_NONE,
	CEPH_AUTH_CEPHX
};

static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
{
	switch (protocol) {
	case CEPH_AUTH_NONE:
		return ceph_auth_none_init(ac);
	case CEPH_AUTH_CEPHX:
		return ceph_x_init(ac);
	default:
		return -ENOENT;
	}
}

/*
 * setup, teardown.
 */
struct ceph_auth_client *ceph_auth_init(const char *name, const struct ceph_crypto_key *key)
{
	struct ceph_auth_client *ac;
	int ret;

	dout("auth_init name '%s'\n", name);

	ret = -ENOMEM;
	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	if (!ac)
		goto out;

	mutex_init(&ac->mutex);
	ac->negotiating = true;
	if (name)
		ac->name = name;
	else
		ac->name = CEPH_AUTH_NAME_DEFAULT;
	dout("auth_init name %s\n", ac->name);
	ac->key = key;
	return ac;

out:
	return ERR_PTR(ret);
}

void ceph_auth_destroy(struct ceph_auth_client *ac)
{
	dout("auth_destroy %p\n", ac);
	if (ac->ops)
		ac->ops->destroy(ac);
	kfree(ac);
}

/*
 * Reset occurs when reconnecting to the monitor.
 */
void ceph_auth_reset(struct ceph_auth_client *ac)
{
	mutex_lock(&ac->mutex);
	dout("auth_reset %p\n", ac);
	if (ac->ops && !ac->negotiating)
		ac->ops->reset(ac);
	ac->negotiating = true;
	mutex_unlock(&ac->mutex);
}

/*
 * EntityName, not to be confused with entity_name_t
 */
int ceph_auth_entity_name_encode(const char *name, void **p, void *end)
{
	int len = strlen(name);

	if (*p + 2*sizeof(u32) + len > end)
		return -ERANGE;
	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	ceph_encode_32(p, len);
	ceph_encode_copy(p, name, len);
	return 0;
}

/*
 * Initiate protocol negotiation with monitor.  Include entity name
 * and list supported protocols.
 */
int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
{
	struct ceph_mon_request_header *monhdr = buf;
	void *p = monhdr + 1, *end = buf + len, *lenp;
	int i, num;
	int ret;

	mutex_lock(&ac->mutex);
	dout("auth_build_hello\n");
	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, 0);  /* no protocol, yet */

	lenp = p;
	p += sizeof(u32);

	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
	ceph_encode_8(&p, 1);
	num = ARRAY_SIZE(supported_protocols);
	ceph_encode_32(&p, num);
	ceph_decode_need(&p, end, num * sizeof(u32), bad);
	for (i = 0; i < num; i++)
		ceph_encode_32(&p, supported_protocols[i]);

	ret = ceph_auth_entity_name_encode(ac->name, &p, end);
	if (ret < 0)
		goto out;
	ceph_decode_need(&p, end, sizeof(u64), bad);
	ceph_encode_64(&p, ac->global_id);

	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
	ret = p - buf;
out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	ret = -ERANGE;
	goto out;
}

static int ceph_build_auth_request(struct ceph_auth_client *ac,
				   void *msg_buf, size_t msg_len)
{
	struct ceph_mon_request_header *monhdr = msg_buf;
	void *p = monhdr + 1;
	void *end = msg_buf + msg_len;
	int ret;

	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, ac->protocol);

	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	if (ret < 0) {
		pr_err("error %d building auth method %s request\n", ret,
		       ac->ops->name);
		goto out;
	}
	dout(" built request %d bytes\n", ret);
	ceph_encode_32(&p, ret);
	ret = p + ret - msg_buf;
out:
	return ret;
}

/*
 * Handle auth message from monitor.
 */
int ceph_handle_auth_reply(struct ceph_auth_client *ac,
			   void *buf, size_t len,
			   void *reply_buf, size_t reply_len)
{
	void *p = buf;
	void *end = buf + len;
	int protocol;
	s32 result;
	u64 global_id;
	void *payload, *payload_end;
	int payload_len;
	char *result_msg;
	int result_msg_len;
	int ret = -EINVAL;

	mutex_lock(&ac->mutex);
	dout("handle_auth_reply %p %p\n", p, end);
	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	protocol = ceph_decode_32(&p);
	result = ceph_decode_32(&p);
	global_id = ceph_decode_64(&p);
	payload_len = ceph_decode_32(&p);
	payload = p;
	p += payload_len;
	ceph_decode_need(&p, end, sizeof(u32), bad);
	result_msg_len = ceph_decode_32(&p);
	result_msg = p;
	p += result_msg_len;
	if (p != end)
		goto bad;

	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	     result_msg, global_id, payload_len);

	payload_end = payload + payload_len;

	if (global_id && ac->global_id != global_id) {
		dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
		ac->global_id = global_id;
	}

	if (ac->negotiating) {
		/* server does not support our protocols? */
		if (!protocol && result < 0) {
			ret = result;
			goto out;
		}
		/* set up (new) protocol handler? */
		if (ac->protocol && ac->protocol != protocol) {
			ac->ops->destroy(ac);
			ac->protocol = 0;
			ac->ops = NULL;
		}
		if (ac->protocol != protocol) {
			ret = ceph_auth_init_protocol(ac, protocol);
			if (ret) {
				pr_err("error %d on auth protocol %d init\n",
				       ret, protocol);
				goto out;
			}
		}

		ac->negotiating = false;
	}

	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	if (ret == -EAGAIN) {
		ret = ceph_build_auth_request(ac, reply_buf, reply_len);
	} else if (ret) {
		pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
	}

out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	pr_err("failed to decode auth msg\n");
	ret = -EINVAL;
	goto out;
}

int ceph_build_auth(struct ceph_auth_client *ac,
		    void *msg_buf, size_t msg_len)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (!ac->protocol)
		ret = ceph_auth_build_hello(ac, msg_buf, msg_len);
	else if (ac->ops->should_authenticate(ac))
		ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	mutex_unlock(&ac->mutex);
	return ret;
}

int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops)
		ret = ac->ops->is_authenticated(ac);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_is_authenticated);

int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *auth)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->create_authorizer)
		ret = ac->ops->create_authorizer(ac, peer_type, auth);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_create_authorizer);

void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
{
	a->destroy(a);
}
EXPORT_SYMBOL(ceph_auth_destroy_authorizer);

int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *a)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->update_authorizer)
		ret = ac->ops->update_authorizer(ac, peer_type, a);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_update_authorizer);

int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
				      struct ceph_authorizer *a, size_t len)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->verify_authorizer_reply)
		ret = ac->ops->verify_authorizer_reply(ac, a, len);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);

void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
{
	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->invalidate_authorizer)
		ac->ops->invalidate_authorizer(ac, peer_type);
	mutex_unlock(&ac->mutex);
}
EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);
Commit	Line	Data
3d14c5d2	1	#include <linux/ceph/ceph_debug.h>
4e7a5dcd SW	2
	3	#include <linux/module.h>
	4	#include <linux/err.h>
d45d0d97	5	#include <linux/slab.h>
4e7a5dcd	6
3d14c5d2 YS	7	#include <linux/ceph/types.h>
	8	#include <linux/ceph/decode.h>
	9	#include <linux/ceph/libceph.h>
	10	#include <linux/ceph/messenger.h>
4e7a5dcd	11	#include "auth_none.h"
ec0994e4	12	#include "auth_x.h"
4e7a5dcd	13
4e7a5dcd SW	14
	15	/*
	16	* get protocol handler
	17	*/
	18	static u32 supported_protocols[] = {
ec0994e4 SW	19	CEPH_AUTH_NONE,
ec0994e4 SW	20	CEPH_AUTH_CEPHX
4e7a5dcd SW	21	};
4e7a5dcd SW	22
cd84db6e	23	static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
4e7a5dcd SW	24	{
	25	switch (protocol) {
	26	case CEPH_AUTH_NONE:
	27	return ceph_auth_none_init(ac);
ec0994e4 SW	28	case CEPH_AUTH_CEPHX:
ec0994e4 SW	29	return ceph_x_init(ac);
4e7a5dcd SW	30	default:
	31	return -ENOENT;
	32	}
	33	}
	34
	35	/*
	36	* setup, teardown.
	37	*/
8323c3aa	38	struct ceph_auth_client ceph_auth_init(const char name, const struct ceph_crypto_key *key)
4e7a5dcd SW	39	{
	40	struct ceph_auth_client *ac;
	41	int ret;
	42
8323c3aa	43	dout("auth_init name '%s'\n", name);
4e7a5dcd SW	44
	45	ret = -ENOMEM;
	46	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	47	if (!ac)
	48	goto out;
	49
e9966076	50	mutex_init(&ac->mutex);
4e7a5dcd SW	51	ac->negotiating = true;
	52	if (name)
	53	ac->name = name;
	54	else
	55	ac->name = CEPH_AUTH_NAME_DEFAULT;
8323c3aa TV	56	dout("auth_init name %s\n", ac->name);
8323c3aa TV	57	ac->key = key;
4e7a5dcd SW	58	return ac;
	59
	60	out:
	61	return ERR_PTR(ret);
	62	}
	63
	64	void ceph_auth_destroy(struct ceph_auth_client *ac)
	65	{
	66	dout("auth_destroy %p\n", ac);
	67	if (ac->ops)
	68	ac->ops->destroy(ac);
	69	kfree(ac);
	70	}
	71
	72	/*
	73	* Reset occurs when reconnecting to the monitor.
	74	*/
	75	void ceph_auth_reset(struct ceph_auth_client *ac)
	76	{
e9966076	77	mutex_lock(&ac->mutex);
4e7a5dcd SW	78	dout("auth_reset %p\n", ac);
	79	if (ac->ops && !ac->negotiating)
	80	ac->ops->reset(ac);
	81	ac->negotiating = true;
e9966076	82	mutex_unlock(&ac->mutex);
4e7a5dcd SW	83	}
4e7a5dcd SW	84
f01d5cb2 ID	85	/*
	86	* EntityName, not to be confused with entity_name_t
	87	*/
	88	int ceph_auth_entity_name_encode(const char name, void p, void end)
4e7a5dcd SW	89	{
	90	int len = strlen(name);
	91
	92	if (p + 2sizeof(u32) + len > end)
	93	return -ERANGE;
	94	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	95	ceph_encode_32(p, len);
	96	ceph_encode_copy(p, name, len);
	97	return 0;
	98	}
	99
	100	/*
	101	* Initiate protocol negotiation with monitor. Include entity name
	102	* and list supported protocols.
	103	*/
	104	int ceph_auth_build_hello(struct ceph_auth_client ac, void buf, size_t len)
	105	{
	106	struct ceph_mon_request_header *monhdr = buf;
	107	void p = monhdr + 1, end = buf + len, *lenp;
	108	int i, num;
	109	int ret;
	110
e9966076	111	mutex_lock(&ac->mutex);
4e7a5dcd SW	112	dout("auth_build_hello\n");
	113	monhdr->have_version = 0;
	114	monhdr->session_mon = cpu_to_le16(-1);
	115	monhdr->session_mon_tid = 0;
	116
	117	ceph_encode_32(&p, 0); /* no protocol, yet */
	118
	119	lenp = p;
	120	p += sizeof(u32);
	121
07c8739c SW	122	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
07c8739c SW	123	ceph_encode_8(&p, 1);
4e7a5dcd SW	124	num = ARRAY_SIZE(supported_protocols);
4e7a5dcd SW	125	ceph_encode_32(&p, num);
07c8739c	126	ceph_decode_need(&p, end, num * sizeof(u32), bad);
4e7a5dcd SW	127	for (i = 0; i < num; i++)
	128	ceph_encode_32(&p, supported_protocols[i]);
	129
f01d5cb2	130	ret = ceph_auth_entity_name_encode(ac->name, &p, end);
4e7a5dcd	131	if (ret < 0)
e9966076	132	goto out;
4e7a5dcd SW	133	ceph_decode_need(&p, end, sizeof(u64), bad);
	134	ceph_encode_64(&p, ac->global_id);
	135
	136	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
e9966076 SW	137	ret = p - buf;
	138	out:
	139	mutex_unlock(&ac->mutex);
	140	return ret;
4e7a5dcd SW	141
4e7a5dcd SW	142	bad:
e9966076 SW	143	ret = -ERANGE;
e9966076 SW	144	goto out;
4e7a5dcd SW	145	}
4e7a5dcd SW	146
cd84db6e YS	147	static int ceph_build_auth_request(struct ceph_auth_client *ac,
cd84db6e YS	148	void *msg_buf, size_t msg_len)
9bd2e6f8 SW	149	{
	150	struct ceph_mon_request_header *monhdr = msg_buf;
	151	void *p = monhdr + 1;
	152	void *end = msg_buf + msg_len;
	153	int ret;
	154
	155	monhdr->have_version = 0;
	156	monhdr->session_mon = cpu_to_le16(-1);
	157	monhdr->session_mon_tid = 0;
	158
	159	ceph_encode_32(&p, ac->protocol);
	160
	161	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	162	if (ret < 0) {
559c1e00 SW	163	pr_err("error %d building auth method %s request\n", ret,
559c1e00 SW	164	ac->ops->name);
e9966076	165	goto out;
9bd2e6f8 SW	166	}
	167	dout(" built request %d bytes\n", ret);
	168	ceph_encode_32(&p, ret);
e9966076 SW	169	ret = p + ret - msg_buf;
	170	out:
	171	return ret;
9bd2e6f8 SW	172	}
9bd2e6f8 SW	173
4e7a5dcd SW	174	/*
	175	* Handle auth message from monitor.
	176	*/
	177	int ceph_handle_auth_reply(struct ceph_auth_client *ac,
	178	void *buf, size_t len,
	179	void *reply_buf, size_t reply_len)
	180	{
	181	void *p = buf;
	182	void *end = buf + len;
	183	int protocol;
	184	s32 result;
	185	u64 global_id;
	186	void payload, payload_end;
	187	int payload_len;
	188	char *result_msg;
	189	int result_msg_len;
	190	int ret = -EINVAL;
	191
e9966076	192	mutex_lock(&ac->mutex);
4e7a5dcd SW	193	dout("handle_auth_reply %p %p\n", p, end);
	194	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	195	protocol = ceph_decode_32(&p);
	196	result = ceph_decode_32(&p);
	197	global_id = ceph_decode_64(&p);
	198	payload_len = ceph_decode_32(&p);
	199	payload = p;
	200	p += payload_len;
	201	ceph_decode_need(&p, end, sizeof(u32), bad);
	202	result_msg_len = ceph_decode_32(&p);
	203	result_msg = p;
	204	p += result_msg_len;
	205	if (p != end)
	206	goto bad;
	207
	208	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	209	result_msg, global_id, payload_len);
	210
	211	payload_end = payload + payload_len;
	212
	213	if (global_id && ac->global_id != global_id) {
	214	dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
	215	ac->global_id = global_id;
	216	}
	217
	218	if (ac->negotiating) {
dc14657c YS	219	/* server does not support our protocols? */
	220	if (!protocol && result < 0) {
	221	ret = result;
	222	goto out;
	223	}
4e7a5dcd SW	224	/* set up (new) protocol handler? */
	225	if (ac->protocol && ac->protocol != protocol) {
	226	ac->ops->destroy(ac);
	227	ac->protocol = 0;
	228	ac->ops = NULL;
	229	}
	230	if (ac->protocol != protocol) {
	231	ret = ceph_auth_init_protocol(ac, protocol);
	232	if (ret) {
e95e9a7a SW	233	pr_err("error %d on auth protocol %d init\n",
e95e9a7a SW	234	ret, protocol);
4e7a5dcd SW	235	goto out;
	236	}
	237	}
9bd2e6f8 SW	238
9bd2e6f8 SW	239	ac->negotiating = false;
4e7a5dcd SW	240	}
	241
	242	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	243	if (ret == -EAGAIN) {
e9966076	244	ret = ceph_build_auth_request(ac, reply_buf, reply_len);
4e7a5dcd	245	} else if (ret) {
559c1e00	246	pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
4e7a5dcd	247	}
4e7a5dcd	248
4e7a5dcd	249	out:
e9966076	250	mutex_unlock(&ac->mutex);
4e7a5dcd	251	return ret;
e9966076 SW	252
	253	bad:
	254	pr_err("failed to decode auth msg\n");
	255	ret = -EINVAL;
	256	goto out;
4e7a5dcd SW	257	}
4e7a5dcd SW	258
9bd2e6f8 SW	259	int ceph_build_auth(struct ceph_auth_client *ac,
	260	void *msg_buf, size_t msg_len)
	261	{
e9966076 SW	262	int ret = 0;
	263
	264	mutex_lock(&ac->mutex);
9bd2e6f8	265	if (!ac->protocol)
e9966076 SW	266	ret = ceph_auth_build_hello(ac, msg_buf, msg_len);
	267	else if (ac->ops->should_authenticate(ac))
	268	ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	269	mutex_unlock(&ac->mutex);
	270	return ret;
9bd2e6f8	271	}
4e7a5dcd	272
9bd2e6f8 SW	273	int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
9bd2e6f8 SW	274	{
e9966076 SW	275	int ret = 0;
	276
	277	mutex_lock(&ac->mutex);
	278	if (ac->ops)
	279	ret = ac->ops->is_authenticated(ac);
	280	mutex_unlock(&ac->mutex);
	281	return ret;
9bd2e6f8	282	}
27859f97 SW	283	EXPORT_SYMBOL(ceph_auth_is_authenticated);
	284
	285	int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
	286	int peer_type,
	287	struct ceph_auth_handshake *auth)
	288	{
e9966076 SW	289	int ret = 0;
	290
	291	mutex_lock(&ac->mutex);
27859f97	292	if (ac->ops && ac->ops->create_authorizer)
e9966076 SW	293	ret = ac->ops->create_authorizer(ac, peer_type, auth);
	294	mutex_unlock(&ac->mutex);
	295	return ret;
27859f97 SW	296	}
	297	EXPORT_SYMBOL(ceph_auth_create_authorizer);
	298
6c1ea260	299	void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
27859f97	300	{
6c1ea260	301	a->destroy(a);
27859f97 SW	302	}
	303	EXPORT_SYMBOL(ceph_auth_destroy_authorizer);
	304
	305	int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
	306	int peer_type,
	307	struct ceph_auth_handshake *a)
	308	{
	309	int ret = 0;
	310
e9966076	311	mutex_lock(&ac->mutex);
27859f97 SW	312	if (ac->ops && ac->ops->update_authorizer)
27859f97 SW	313	ret = ac->ops->update_authorizer(ac, peer_type, a);
e9966076	314	mutex_unlock(&ac->mutex);
27859f97 SW	315	return ret;
	316	}
	317	EXPORT_SYMBOL(ceph_auth_update_authorizer);
	318
	319	int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
	320	struct ceph_authorizer *a, size_t len)
	321	{
e9966076 SW	322	int ret = 0;
	323
	324	mutex_lock(&ac->mutex);
27859f97	325	if (ac->ops && ac->ops->verify_authorizer_reply)
e9966076 SW	326	ret = ac->ops->verify_authorizer_reply(ac, a, len);
	327	mutex_unlock(&ac->mutex);
	328	return ret;
27859f97 SW	329	}
	330	EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);
	331
	332	void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
	333	{
e9966076	334	mutex_lock(&ac->mutex);
27859f97 SW	335	if (ac->ops && ac->ops->invalidate_authorizer)
27859f97 SW	336	ac->ops->invalidate_authorizer(ac, peer_type);
e9966076	337	mutex_unlock(&ac->mutex);
27859f97 SW	338	}
27859f97 SW	339	EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);