2 #include "ceph_debug.h"
5 #include <linux/module.h>
6 #include <linux/random.h>
7 #include <linux/slab.h>
10 #include "auth_x_protocol.h"
15 #define TEMP_TICKET_BUF_LEN 256
17 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
);
19 static int ceph_x_is_authenticated(struct ceph_auth_client
*ac
)
21 struct ceph_x_info
*xi
= ac
->private;
24 ceph_x_validate_tickets(ac
, &need
);
25 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
26 ac
->want_keys
, need
, xi
->have_keys
);
27 return (ac
->want_keys
& xi
->have_keys
) == ac
->want_keys
;
30 static int ceph_x_encrypt_buflen(int ilen
)
32 return sizeof(struct ceph_x_encrypt_header
) + ilen
+ 16 +
36 static int ceph_x_encrypt(struct ceph_crypto_key
*secret
,
37 void *ibuf
, int ilen
, void *obuf
, size_t olen
)
39 struct ceph_x_encrypt_header head
= {
41 .magic
= cpu_to_le64(CEPHX_ENC_MAGIC
)
43 size_t len
= olen
- sizeof(u32
);
46 ret
= ceph_encrypt2(secret
, obuf
+ sizeof(u32
), &len
,
47 &head
, sizeof(head
), ibuf
, ilen
);
50 ceph_encode_32(&obuf
, len
);
51 return len
+ sizeof(u32
);
54 static int ceph_x_decrypt(struct ceph_crypto_key
*secret
,
55 void **p
, void *end
, void *obuf
, size_t olen
)
57 struct ceph_x_encrypt_header head
;
58 size_t head_len
= sizeof(head
);
61 len
= ceph_decode_32(p
);
65 dout("ceph_x_decrypt len %d\n", len
);
66 ret
= ceph_decrypt2(secret
, &head
, &head_len
, obuf
, &olen
,
70 if (head
.struct_v
!= 1 || le64_to_cpu(head
.magic
) != CEPHX_ENC_MAGIC
)
77 * get existing (or insert new) ticket handler
79 struct ceph_x_ticket_handler
*get_ticket_handler(struct ceph_auth_client
*ac
,
82 struct ceph_x_ticket_handler
*th
;
83 struct ceph_x_info
*xi
= ac
->private;
84 struct rb_node
*parent
= NULL
, **p
= &xi
->ticket_handlers
.rb_node
;
88 th
= rb_entry(parent
, struct ceph_x_ticket_handler
, node
);
89 if (service
< th
->service
)
91 else if (service
> th
->service
)
98 th
= kzalloc(sizeof(*th
), GFP_NOFS
);
100 return ERR_PTR(-ENOMEM
);
101 th
->service
= service
;
102 rb_link_node(&th
->node
, parent
, p
);
103 rb_insert_color(&th
->node
, &xi
->ticket_handlers
);
107 static void remove_ticket_handler(struct ceph_auth_client
*ac
,
108 struct ceph_x_ticket_handler
*th
)
110 struct ceph_x_info
*xi
= ac
->private;
112 dout("remove_ticket_handler %p %d\n", th
, th
->service
);
113 rb_erase(&th
->node
, &xi
->ticket_handlers
);
114 ceph_crypto_key_destroy(&th
->session_key
);
116 ceph_buffer_put(th
->ticket_blob
);
120 static int ceph_x_proc_ticket_reply(struct ceph_auth_client
*ac
,
121 struct ceph_crypto_key
*secret
,
122 void *buf
, void *end
)
124 struct ceph_x_info
*xi
= ac
->private;
132 dbuf
= kmalloc(TEMP_TICKET_BUF_LEN
, GFP_NOFS
);
137 ticket_buf
= kmalloc(TEMP_TICKET_BUF_LEN
, GFP_NOFS
);
141 ceph_decode_need(&p
, end
, 1 + sizeof(u32
), bad
);
142 reply_struct_v
= ceph_decode_8(&p
);
143 if (reply_struct_v
!= 1)
145 num
= ceph_decode_32(&p
);
146 dout("%d tickets\n", num
);
149 u8 tkt_struct_v
, blob_struct_v
;
150 struct ceph_x_ticket_handler
*th
;
154 struct timespec validity
;
155 struct ceph_crypto_key old_key
;
157 struct ceph_timespec new_validity
;
158 struct ceph_crypto_key new_session_key
;
159 struct ceph_buffer
*new_ticket_blob
;
160 unsigned long new_expires
, new_renew_after
;
163 ceph_decode_need(&p
, end
, sizeof(u32
) + 1, bad
);
165 type
= ceph_decode_32(&p
);
166 dout(" ticket type %d %s\n", type
, ceph_entity_type_name(type
));
168 tkt_struct_v
= ceph_decode_8(&p
);
169 if (tkt_struct_v
!= 1)
172 th
= get_ticket_handler(ac
, type
);
179 dlen
= ceph_x_decrypt(secret
, &p
, end
, dbuf
,
180 TEMP_TICKET_BUF_LEN
);
185 dout(" decrypted %d bytes\n", dlen
);
189 tkt_struct_v
= ceph_decode_8(&dp
);
190 if (tkt_struct_v
!= 1)
193 memcpy(&old_key
, &th
->session_key
, sizeof(old_key
));
194 ret
= ceph_crypto_key_decode(&new_session_key
, &dp
, dend
);
198 ceph_decode_copy(&dp
, &new_validity
, sizeof(new_validity
));
199 ceph_decode_timespec(&validity
, &new_validity
);
200 new_expires
= get_seconds() + validity
.tv_sec
;
201 new_renew_after
= new_expires
- (validity
.tv_sec
/ 4);
202 dout(" expires=%lu renew_after=%lu\n", new_expires
,
205 /* ticket blob for service */
206 ceph_decode_8_safe(&p
, end
, is_enc
, bad
);
210 dout(" encrypted ticket\n");
211 dlen
= ceph_x_decrypt(&old_key
, &p
, end
, ticket_buf
,
212 TEMP_TICKET_BUF_LEN
);
217 dlen
= ceph_decode_32(&tp
);
220 ceph_decode_32_safe(&p
, end
, dlen
, bad
);
221 ceph_decode_need(&p
, end
, dlen
, bad
);
222 ceph_decode_copy(&p
, ticket_buf
, dlen
);
225 dout(" ticket blob is %d bytes\n", dlen
);
226 ceph_decode_need(&tp
, tpend
, 1 + sizeof(u64
), bad
);
227 blob_struct_v
= ceph_decode_8(&tp
);
228 new_secret_id
= ceph_decode_64(&tp
);
229 ret
= ceph_decode_buffer(&new_ticket_blob
, &tp
, tpend
);
233 /* all is well, update our ticket */
234 ceph_crypto_key_destroy(&th
->session_key
);
236 ceph_buffer_put(th
->ticket_blob
);
237 th
->session_key
= new_session_key
;
238 th
->ticket_blob
= new_ticket_blob
;
239 th
->validity
= new_validity
;
240 th
->secret_id
= new_secret_id
;
241 th
->expires
= new_expires
;
242 th
->renew_after
= new_renew_after
;
243 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
244 type
, ceph_entity_type_name(type
), th
->secret_id
,
245 (int)th
->ticket_blob
->vec
.iov_len
);
246 xi
->have_keys
|= th
->service
;
261 static int ceph_x_build_authorizer(struct ceph_auth_client
*ac
,
262 struct ceph_x_ticket_handler
*th
,
263 struct ceph_x_authorizer
*au
)
266 struct ceph_x_authorize_a
*msg_a
;
267 struct ceph_x_authorize_b msg_b
;
270 int ticket_blob_len
=
271 (th
->ticket_blob
? th
->ticket_blob
->vec
.iov_len
: 0);
273 dout("build_authorizer for %s %p\n",
274 ceph_entity_type_name(th
->service
), au
);
276 maxlen
= sizeof(*msg_a
) + sizeof(msg_b
) +
277 ceph_x_encrypt_buflen(ticket_blob_len
);
278 dout(" need len %d\n", maxlen
);
279 if (au
->buf
&& au
->buf
->alloc_len
< maxlen
) {
280 ceph_buffer_put(au
->buf
);
284 au
->buf
= ceph_buffer_new(maxlen
, GFP_NOFS
);
288 au
->service
= th
->service
;
290 msg_a
= au
->buf
->vec
.iov_base
;
292 msg_a
->global_id
= cpu_to_le64(ac
->global_id
);
293 msg_a
->service_id
= cpu_to_le32(th
->service
);
294 msg_a
->ticket_blob
.struct_v
= 1;
295 msg_a
->ticket_blob
.secret_id
= cpu_to_le64(th
->secret_id
);
296 msg_a
->ticket_blob
.blob_len
= cpu_to_le32(ticket_blob_len
);
297 if (ticket_blob_len
) {
298 memcpy(msg_a
->ticket_blob
.blob
, th
->ticket_blob
->vec
.iov_base
,
299 th
->ticket_blob
->vec
.iov_len
);
301 dout(" th %p secret_id %lld %lld\n", th
, th
->secret_id
,
302 le64_to_cpu(msg_a
->ticket_blob
.secret_id
));
305 p
+= ticket_blob_len
;
306 end
= au
->buf
->vec
.iov_base
+ au
->buf
->vec
.iov_len
;
308 get_random_bytes(&au
->nonce
, sizeof(au
->nonce
));
310 msg_b
.nonce
= cpu_to_le64(au
->nonce
);
311 ret
= ceph_x_encrypt(&th
->session_key
, &msg_b
, sizeof(msg_b
),
316 au
->buf
->vec
.iov_len
= p
- au
->buf
->vec
.iov_base
;
317 dout(" built authorizer nonce %llx len %d\n", au
->nonce
,
318 (int)au
->buf
->vec
.iov_len
);
319 BUG_ON(au
->buf
->vec
.iov_len
> maxlen
);
323 ceph_buffer_put(au
->buf
);
328 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler
*th
,
331 ceph_decode_need(p
, end
, 1 + sizeof(u64
), bad
);
333 ceph_encode_64(p
, th
->secret_id
);
334 if (th
->ticket_blob
) {
335 const char *buf
= th
->ticket_blob
->vec
.iov_base
;
336 u32 len
= th
->ticket_blob
->vec
.iov_len
;
338 ceph_encode_32_safe(p
, end
, len
, bad
);
339 ceph_encode_copy_safe(p
, end
, buf
, len
, bad
);
341 ceph_encode_32_safe(p
, end
, 0, bad
);
349 static void ceph_x_validate_tickets(struct ceph_auth_client
*ac
, int *pneed
)
351 int want
= ac
->want_keys
;
352 struct ceph_x_info
*xi
= ac
->private;
355 *pneed
= ac
->want_keys
& ~(xi
->have_keys
);
357 for (service
= 1; service
<= want
; service
<<= 1) {
358 struct ceph_x_ticket_handler
*th
;
360 if (!(ac
->want_keys
& service
))
363 if (*pneed
& service
)
366 th
= get_ticket_handler(ac
, service
);
373 if (get_seconds() >= th
->renew_after
)
375 if (get_seconds() >= th
->expires
)
376 xi
->have_keys
&= ~service
;
381 static int ceph_x_build_request(struct ceph_auth_client
*ac
,
382 void *buf
, void *end
)
384 struct ceph_x_info
*xi
= ac
->private;
386 struct ceph_x_request_header
*head
= buf
;
388 struct ceph_x_ticket_handler
*th
=
389 get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
391 ceph_x_validate_tickets(ac
, &need
);
393 dout("build_request want %x have %x need %x\n",
394 ac
->want_keys
, xi
->have_keys
, need
);
396 if (need
& CEPH_ENTITY_TYPE_AUTH
) {
397 struct ceph_x_authenticate
*auth
= (void *)(head
+ 1);
399 struct ceph_x_challenge_blob tmp
;
406 dout(" get_auth_session_key\n");
407 head
->op
= cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY
);
409 /* encrypt and hash */
410 get_random_bytes(&auth
->client_challenge
, sizeof(u64
));
411 tmp
.client_challenge
= auth
->client_challenge
;
412 tmp
.server_challenge
= cpu_to_le64(xi
->server_challenge
);
413 ret
= ceph_x_encrypt(&xi
->secret
, &tmp
, sizeof(tmp
),
414 tmp_enc
, sizeof(tmp_enc
));
420 for (u
= (u64
*)tmp_enc
; u
+ 1 <= (u64
*)(tmp_enc
+ ret
); u
++)
422 dout(" server_challenge %llx client_challenge %llx key %llx\n",
423 xi
->server_challenge
, le64_to_cpu(auth
->client_challenge
),
424 le64_to_cpu(auth
->key
));
426 /* now encode the old ticket if exists */
427 ret
= ceph_x_encode_ticket(th
, &p
, end
);
436 struct ceph_x_service_ticket_request
*req
;
440 head
->op
= cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY
);
443 ret
= ceph_x_build_authorizer(ac
, th
, &xi
->auth_authorizer
);
446 ceph_encode_copy(&p
, xi
->auth_authorizer
.buf
->vec
.iov_base
,
447 xi
->auth_authorizer
.buf
->vec
.iov_len
);
450 req
->keys
= cpu_to_le32(need
);
458 static int ceph_x_handle_reply(struct ceph_auth_client
*ac
, int result
,
459 void *buf
, void *end
)
461 struct ceph_x_info
*xi
= ac
->private;
462 struct ceph_x_reply_header
*head
= buf
;
463 struct ceph_x_ticket_handler
*th
;
469 return result
; /* XXX hmm? */
473 struct ceph_x_server_challenge
*sc
= buf
;
475 if (len
!= sizeof(*sc
))
477 xi
->server_challenge
= le64_to_cpu(sc
->server_challenge
);
478 dout("handle_reply got server challenge %llx\n",
479 xi
->server_challenge
);
480 xi
->starting
= false;
481 xi
->have_keys
&= ~CEPH_ENTITY_TYPE_AUTH
;
485 op
= le32_to_cpu(head
->op
);
486 result
= le32_to_cpu(head
->result
);
487 dout("handle_reply op %d result %d\n", op
, result
);
489 case CEPHX_GET_AUTH_SESSION_KEY
:
490 /* verify auth key */
491 ret
= ceph_x_proc_ticket_reply(ac
, &xi
->secret
,
492 buf
+ sizeof(*head
), end
);
495 case CEPHX_GET_PRINCIPAL_SESSION_KEY
:
496 th
= get_ticket_handler(ac
, CEPH_ENTITY_TYPE_AUTH
);
498 ret
= ceph_x_proc_ticket_reply(ac
, &th
->session_key
,
499 buf
+ sizeof(*head
), end
);
507 if (ac
->want_keys
== xi
->have_keys
)
512 static int ceph_x_create_authorizer(
513 struct ceph_auth_client
*ac
, int peer_type
,
514 struct ceph_authorizer
**a
,
515 void **buf
, size_t *len
,
516 void **reply_buf
, size_t *reply_len
)
518 struct ceph_x_authorizer
*au
;
519 struct ceph_x_ticket_handler
*th
;
522 th
= get_ticket_handler(ac
, peer_type
);
526 au
= kzalloc(sizeof(*au
), GFP_NOFS
);
530 ret
= ceph_x_build_authorizer(ac
, th
, au
);
536 *a
= (struct ceph_authorizer
*)au
;
537 *buf
= au
->buf
->vec
.iov_base
;
538 *len
= au
->buf
->vec
.iov_len
;
539 *reply_buf
= au
->reply_buf
;
540 *reply_len
= sizeof(au
->reply_buf
);
544 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client
*ac
,
545 struct ceph_authorizer
*a
, size_t len
)
547 struct ceph_x_authorizer
*au
= (void *)a
;
548 struct ceph_x_ticket_handler
*th
;
550 struct ceph_x_authorize_reply reply
;
551 void *p
= au
->reply_buf
;
552 void *end
= p
+ sizeof(au
->reply_buf
);
554 th
= get_ticket_handler(ac
, au
->service
);
556 return -EIO
; /* hrm! */
557 ret
= ceph_x_decrypt(&th
->session_key
, &p
, end
, &reply
, sizeof(reply
));
560 if (ret
!= sizeof(reply
))
563 if (au
->nonce
+ 1 != le64_to_cpu(reply
.nonce_plus_one
))
567 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
568 au
->nonce
, le64_to_cpu(reply
.nonce_plus_one
), ret
);
572 static void ceph_x_destroy_authorizer(struct ceph_auth_client
*ac
,
573 struct ceph_authorizer
*a
)
575 struct ceph_x_authorizer
*au
= (void *)a
;
577 ceph_buffer_put(au
->buf
);
582 static void ceph_x_reset(struct ceph_auth_client
*ac
)
584 struct ceph_x_info
*xi
= ac
->private;
588 xi
->server_challenge
= 0;
591 static void ceph_x_destroy(struct ceph_auth_client
*ac
)
593 struct ceph_x_info
*xi
= ac
->private;
596 dout("ceph_x_destroy %p\n", ac
);
597 ceph_crypto_key_destroy(&xi
->secret
);
599 while ((p
= rb_first(&xi
->ticket_handlers
)) != NULL
) {
600 struct ceph_x_ticket_handler
*th
=
601 rb_entry(p
, struct ceph_x_ticket_handler
, node
);
602 remove_ticket_handler(ac
, th
);
609 static void ceph_x_invalidate_authorizer(struct ceph_auth_client
*ac
,
612 struct ceph_x_ticket_handler
*th
;
614 th
= get_ticket_handler(ac
, peer_type
);
615 if (th
&& !IS_ERR(th
))
616 remove_ticket_handler(ac
, th
);
620 static const struct ceph_auth_client_ops ceph_x_ops
= {
622 .is_authenticated
= ceph_x_is_authenticated
,
623 .build_request
= ceph_x_build_request
,
624 .handle_reply
= ceph_x_handle_reply
,
625 .create_authorizer
= ceph_x_create_authorizer
,
626 .verify_authorizer_reply
= ceph_x_verify_authorizer_reply
,
627 .destroy_authorizer
= ceph_x_destroy_authorizer
,
628 .invalidate_authorizer
= ceph_x_invalidate_authorizer
,
629 .reset
= ceph_x_reset
,
630 .destroy
= ceph_x_destroy
,
634 int ceph_x_init(struct ceph_auth_client
*ac
)
636 struct ceph_x_info
*xi
;
639 dout("ceph_x_init %p\n", ac
);
641 xi
= kzalloc(sizeof(*xi
), GFP_NOFS
);
647 pr_err("no secret set (for auth_x protocol)\n");
651 ret
= ceph_crypto_key_unarmor(&xi
->secret
, ac
->secret
);
656 xi
->ticket_handlers
= RB_ROOT
;
658 ac
->protocol
= CEPH_AUTH_CEPHX
;
660 ac
->ops
= &ceph_x_ops
;