linux/ceph/auth.h

0001 /* SPDX-License-Identifier: GPL-2.0 */
0002 #ifndef _FS_CEPH_AUTH_H
0003 #define _FS_CEPH_AUTH_H
0004
0005 #include <linux/ceph/types.h>
0006 #include <linux/ceph/buffer.h>
0007
0008 /*
0009  * Abstract interface for communicating with the authenticate module.
0010  * There is some handshake that takes place between us and the monitor
0011  * to acquire the necessary keys.  These are used to generate an
0012  * 'authorizer' that we use when connecting to a service (mds, osd).
0013  */
0014
0015 struct ceph_auth_client;
0016 struct ceph_msg;
0017
0018 struct ceph_authorizer {
0019     void (*destroy)(struct ceph_authorizer *);
0020 };
0021
0022 struct ceph_auth_handshake {
0023     struct ceph_authorizer *authorizer;
0024     void *authorizer_buf;
0025     size_t authorizer_buf_len;
0026     void *authorizer_reply_buf;
0027     size_t authorizer_reply_buf_len;
0028     int (*sign_message)(struct ceph_auth_handshake *auth,
0029                 struct ceph_msg *msg);
0030     int (*check_message_signature)(struct ceph_auth_handshake *auth,
0031                        struct ceph_msg *msg);
0032 };
0033
0034 struct ceph_auth_client_ops {
0035     /*
0036      * true if we are authenticated and can connect to
0037      * services.
0038      */
0039     int (*is_authenticated)(struct ceph_auth_client *ac);
0040
0041     /*
0042      * true if we should (re)authenticate, e.g., when our tickets
0043      * are getting old and crusty.
0044      */
0045     int (*should_authenticate)(struct ceph_auth_client *ac);
0046
0047     /*
0048      * build requests and process replies during monitor
0049      * handshake.  if handle_reply returns -EAGAIN, we build
0050      * another request.
0051      */
0052     int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end);
0053     int (*handle_reply)(struct ceph_auth_client *ac, u64 global_id,
0054                 void *buf, void *end, u8 *session_key,
0055                 int *session_key_len, u8 *con_secret,
0056                 int *con_secret_len);
0057
0058     /*
0059      * Create authorizer for connecting to a service, and verify
0060      * the response to authenticate the service.
0061      */
0062     int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type,
0063                  struct ceph_auth_handshake *auth);
0064     /* ensure that an existing authorizer is up to date */
0065     int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type,
0066                  struct ceph_auth_handshake *auth);
0067     int (*add_authorizer_challenge)(struct ceph_auth_client *ac,
0068                     struct ceph_authorizer *a,
0069                     void *challenge_buf,
0070                     int challenge_buf_len);
0071     int (*verify_authorizer_reply)(struct ceph_auth_client *ac,
0072                        struct ceph_authorizer *a,
0073                        void *reply, int reply_len,
0074                        u8 *session_key, int *session_key_len,
0075                        u8 *con_secret, int *con_secret_len);
0076     void (*invalidate_authorizer)(struct ceph_auth_client *ac,
0077                       int peer_type);
0078
0079     /* reset when we (re)connect to a monitor */
0080     void (*reset)(struct ceph_auth_client *ac);
0081
0082     void (*destroy)(struct ceph_auth_client *ac);
0083
0084     int (*sign_message)(struct ceph_auth_handshake *auth,
0085                 struct ceph_msg *msg);
0086     int (*check_message_signature)(struct ceph_auth_handshake *auth,
0087                        struct ceph_msg *msg);
0088 };
0089
0090 struct ceph_auth_client {
0091     u32 protocol;           /* CEPH_AUTH_* */
0092     void *private;          /* for use by protocol implementation */
0093     const struct ceph_auth_client_ops *ops;  /* null iff protocol==0 */
0094
0095     bool negotiating;       /* true if negotiating protocol */
0096     const char *name;       /* entity name */
0097     u64 global_id;          /* our unique id in system */
0098     const struct ceph_crypto_key *key;     /* our secret key */
0099     unsigned want_keys;     /* which services we want */
0100
0101     int preferred_mode; /* CEPH_CON_MODE_* */
0102     int fallback_mode;  /* ditto */
0103
0104     struct mutex mutex;
0105 };
0106
0107 void ceph_auth_set_global_id(struct ceph_auth_client *ac, u64 global_id);
0108
0109 struct ceph_auth_client *ceph_auth_init(const char *name,
0110                     const struct ceph_crypto_key *key,
0111                     const int *con_modes);
0112 extern void ceph_auth_destroy(struct ceph_auth_client *ac);
0113
0114 extern void ceph_auth_reset(struct ceph_auth_client *ac);
0115
0116 extern int ceph_auth_build_hello(struct ceph_auth_client *ac,
0117                  void *buf, size_t len);
0118 extern int ceph_handle_auth_reply(struct ceph_auth_client *ac,
0119                   void *buf, size_t len,
0120                   void *reply_buf, size_t reply_len);
0121 int ceph_auth_entity_name_encode(const char *name, void **p, void *end);
0122
0123 extern int ceph_build_auth(struct ceph_auth_client *ac,
0124             void *msg_buf, size_t msg_len);
0125 extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac);
0126
0127 int __ceph_auth_get_authorizer(struct ceph_auth_client *ac,
0128                    struct ceph_auth_handshake *auth,
0129                    int peer_type, bool force_new,
0130                    int *proto, int *pref_mode, int *fallb_mode);
0131 void ceph_auth_destroy_authorizer(struct ceph_authorizer *a);
0132 int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac,
0133                        struct ceph_authorizer *a,
0134                        void *challenge_buf,
0135                        int challenge_buf_len);
0136 int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
0137                       struct ceph_authorizer *a,
0138                       void *reply, int reply_len,
0139                       u8 *session_key, int *session_key_len,
0140                       u8 *con_secret, int *con_secret_len);
0141 extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac,
0142                         int peer_type);
0143
0144 static inline int ceph_auth_sign_message(struct ceph_auth_handshake *auth,
0145                      struct ceph_msg *msg)
0146 {
0147     if (auth->sign_message)
0148         return auth->sign_message(auth, msg);
0149     return 0;
0150 }
0151
0152 static inline
0153 int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth,
0154                       struct ceph_msg *msg)
0155 {
0156     if (auth->check_message_signature)
0157         return auth->check_message_signature(auth, msg);
0158     return 0;
0159 }
0160
0161 int ceph_auth_get_request(struct ceph_auth_client *ac, void *buf, int buf_len);
0162 int ceph_auth_handle_reply_more(struct ceph_auth_client *ac, void *reply,
0163                 int reply_len, void *buf, int buf_len);
0164 int ceph_auth_handle_reply_done(struct ceph_auth_client *ac,
0165                 u64 global_id, void *reply, int reply_len,
0166                 u8 *session_key, int *session_key_len,
0167                 u8 *con_secret, int *con_secret_len);
0168 bool ceph_auth_handle_bad_method(struct ceph_auth_client *ac,
0169                  int used_proto, int result,
0170                  const int *allowed_protos, int proto_cnt,
0171                  const int *allowed_modes, int mode_cnt);
0172
0173 int ceph_auth_get_authorizer(struct ceph_auth_client *ac,
0174                  struct ceph_auth_handshake *auth,
0175                  int peer_type, void *buf, int *buf_len);
0176 int ceph_auth_handle_svc_reply_more(struct ceph_auth_client *ac,
0177                     struct ceph_auth_handshake *auth,
0178                     void *reply, int reply_len,
0179                     void *buf, int *buf_len);
0180 int ceph_auth_handle_svc_reply_done(struct ceph_auth_client *ac,
0181                     struct ceph_auth_handshake *auth,
0182                     void *reply, int reply_len,
0183                     u8 *session_key, int *session_key_len,
0184                     u8 *con_secret, int *con_secret_len);
0185 bool ceph_auth_handle_bad_authorizer(struct ceph_auth_client *ac,
0186                      int peer_type, int used_proto, int result,
0187                      const int *allowed_protos, int proto_cnt,
0188                      const int *allowed_modes, int mode_cnt);
0189
0190 #endif