auth.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2#ifndef _FS_CEPH_AUTH_H
  3#define _FS_CEPH_AUTH_H
  4
  5#include <linux/ceph/types.h>
  6#include <linux/ceph/buffer.h>
  7
  8/*
  9 * Abstract interface for communicating with the authenticate module.
 10 * There is some handshake that takes place between us and the monitor
 11 * to acquire the necessary keys.  These are used to generate an
 12 * 'authorizer' that we use when connecting to a service (mds, osd).
 13 */
 14
 15struct ceph_auth_client;
 16struct ceph_msg;
 17
 18struct ceph_authorizer {
 19	void (*destroy)(struct ceph_authorizer *);
 20};
 21
 22struct ceph_auth_handshake {
 23	struct ceph_authorizer *authorizer;
 24	void *authorizer_buf;
 25	size_t authorizer_buf_len;
 26	void *authorizer_reply_buf;
 27	size_t authorizer_reply_buf_len;
 28	int (*sign_message)(struct ceph_auth_handshake *auth,
 29			    struct ceph_msg *msg);
 30	int (*check_message_signature)(struct ceph_auth_handshake *auth,
 31				       struct ceph_msg *msg);
 32};
 33
 34struct ceph_auth_client_ops {
 35	/*
 36	 * true if we are authenticated and can connect to
 37	 * services.
 38	 */
 39	int (*is_authenticated)(struct ceph_auth_client *ac);
 40
 41	/*
 42	 * true if we should (re)authenticate, e.g., when our tickets
 43	 * are getting old and crusty.
 44	 */
 45	int (*should_authenticate)(struct ceph_auth_client *ac);
 46
 47	/*
 48	 * build requests and process replies during monitor
 49	 * handshake.  if handle_reply returns -EAGAIN, we build
 50	 * another request.
 51	 */
 52	int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end);
 53	int (*handle_reply)(struct ceph_auth_client *ac, u64 global_id,
 54			    void *buf, void *end, u8 *session_key,
 55			    int *session_key_len, u8 *con_secret,
 56			    int *con_secret_len);
 57
 58	/*
 59	 * Create authorizer for connecting to a service, and verify
 60	 * the response to authenticate the service.
 61	 */
 62	int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type,
 63				 struct ceph_auth_handshake *auth);
 64	/* ensure that an existing authorizer is up to date */
 65	int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type,
 66				 struct ceph_auth_handshake *auth);
 67	int (*add_authorizer_challenge)(struct ceph_auth_client *ac,
 68					struct ceph_authorizer *a,
 69					void *challenge_buf,
 70					int challenge_buf_len);
 71	int (*verify_authorizer_reply)(struct ceph_auth_client *ac,
 72				       struct ceph_authorizer *a,
 73				       void *reply, int reply_len,
 74				       u8 *session_key, int *session_key_len,
 75				       u8 *con_secret, int *con_secret_len);
 76	void (*invalidate_authorizer)(struct ceph_auth_client *ac,
 77				      int peer_type);
 78
 79	/* reset when we (re)connect to a monitor */
 80	void (*reset)(struct ceph_auth_client *ac);
 81
 82	void (*destroy)(struct ceph_auth_client *ac);
 83
 84	int (*sign_message)(struct ceph_auth_handshake *auth,
 85			    struct ceph_msg *msg);
 86	int (*check_message_signature)(struct ceph_auth_handshake *auth,
 87				       struct ceph_msg *msg);
 88};
 89
 90struct ceph_auth_client {
 91	u32 protocol;           /* CEPH_AUTH_* */
 92	void *private;          /* for use by protocol implementation */
 93	const struct ceph_auth_client_ops *ops;  /* null iff protocol==0 */
 94
 95	bool negotiating;       /* true if negotiating protocol */
 96	const char *name;       /* entity name */
 97	u64 global_id;          /* our unique id in system */
 98	const struct ceph_crypto_key *key;     /* our secret key */
 99	unsigned want_keys;     /* which services we want */
100
101	int preferred_mode;	/* CEPH_CON_MODE_* */
102	int fallback_mode;	/* ditto */
103
104	struct mutex mutex;
105};
106
107void ceph_auth_set_global_id(struct ceph_auth_client *ac, u64 global_id);
108
109struct ceph_auth_client *ceph_auth_init(const char *name,
110					const struct ceph_crypto_key *key,
111					const int *con_modes);
112extern void ceph_auth_destroy(struct ceph_auth_client *ac);
113
114extern void ceph_auth_reset(struct ceph_auth_client *ac);
115
116extern int ceph_auth_build_hello(struct ceph_auth_client *ac,
117				 void *buf, size_t len);
118extern int ceph_handle_auth_reply(struct ceph_auth_client *ac,
119				  void *buf, size_t len,
120				  void *reply_buf, size_t reply_len);
121int ceph_auth_entity_name_encode(const char *name, void **p, void *end);
122
123extern int ceph_build_auth(struct ceph_auth_client *ac,
124		    void *msg_buf, size_t msg_len);
125extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac);
126
127int __ceph_auth_get_authorizer(struct ceph_auth_client *ac,
128			       struct ceph_auth_handshake *auth,
129			       int peer_type, bool force_new,
130			       int *proto, int *pref_mode, int *fallb_mode);
131void ceph_auth_destroy_authorizer(struct ceph_authorizer *a);
132int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac,
133				       struct ceph_authorizer *a,
134				       void *challenge_buf,
135				       int challenge_buf_len);
136int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
137				      struct ceph_authorizer *a,
138				      void *reply, int reply_len,
139				      u8 *session_key, int *session_key_len,
140				      u8 *con_secret, int *con_secret_len);
141extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac,
142					    int peer_type);
143
144static inline int ceph_auth_sign_message(struct ceph_auth_handshake *auth,
145					 struct ceph_msg *msg)
146{
147	if (auth->sign_message)
148		return auth->sign_message(auth, msg);
149	return 0;
150}
151
152static inline
153int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth,
154				      struct ceph_msg *msg)
155{
156	if (auth->check_message_signature)
157		return auth->check_message_signature(auth, msg);
158	return 0;
159}
160
161int ceph_auth_get_request(struct ceph_auth_client *ac, void *buf, int buf_len);
162int ceph_auth_handle_reply_more(struct ceph_auth_client *ac, void *reply,
163				int reply_len, void *buf, int buf_len);
164int ceph_auth_handle_reply_done(struct ceph_auth_client *ac,
165				u64 global_id, void *reply, int reply_len,
166				u8 *session_key, int *session_key_len,
167				u8 *con_secret, int *con_secret_len);
168bool ceph_auth_handle_bad_method(struct ceph_auth_client *ac,
169				 int used_proto, int result,
170				 const int *allowed_protos, int proto_cnt,
171				 const int *allowed_modes, int mode_cnt);
172
173int ceph_auth_get_authorizer(struct ceph_auth_client *ac,
174			     struct ceph_auth_handshake *auth,
175			     int peer_type, void *buf, int *buf_len);
176int ceph_auth_handle_svc_reply_more(struct ceph_auth_client *ac,
177				    struct ceph_auth_handshake *auth,
178				    void *reply, int reply_len,
179				    void *buf, int *buf_len);
180int ceph_auth_handle_svc_reply_done(struct ceph_auth_client *ac,
181				    struct ceph_auth_handshake *auth,
182				    void *reply, int reply_len,
183				    u8 *session_key, int *session_key_len,
184				    u8 *con_secret, int *con_secret_len);
185bool ceph_auth_handle_bad_authorizer(struct ceph_auth_client *ac,
186				     int peer_type, int used_proto, int result,
187				     const int *allowed_protos, int proto_cnt,
188				     const int *allowed_modes, int mode_cnt);
189
190#endif