[linux.git] / net / ceph / auth.c

#include <linux/ceph/ceph_debug.h>

#include <linux/module.h>
#include <linux/err.h>
#include <linux/slab.h>

#include <linux/ceph/types.h>
#include <linux/ceph/decode.h>
#include <linux/ceph/libceph.h>
#include <linux/ceph/messenger.h>
#include "auth_none.h"
#include "auth_x.h"


/*
 * get protocol handler
 */
static u32 supported_protocols[] = {
	CEPH_AUTH_NONE,
	CEPH_AUTH_CEPHX
};

static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
{
	switch (protocol) {
	case CEPH_AUTH_NONE:
		return ceph_auth_none_init(ac);
	case CEPH_AUTH_CEPHX:
		return ceph_x_init(ac);
	default:
		return -ENOENT;
	}
}

/*
 * setup, teardown.
 */
struct ceph_auth_client *ceph_auth_init(const char *name, const struct ceph_crypto_key *key)
{
	struct ceph_auth_client *ac;
	int ret;

	dout("auth_init name '%s'\n", name);

	ret = -ENOMEM;
	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	if (!ac)
		goto out;

	mutex_init(&ac->mutex);
	ac->negotiating = true;
	if (name)
		ac->name = name;
	else
		ac->name = CEPH_AUTH_NAME_DEFAULT;
	dout("auth_init name %s\n", ac->name);
	ac->key = key;
	return ac;

out:
	return ERR_PTR(ret);
}

void ceph_auth_destroy(struct ceph_auth_client *ac)
{
	dout("auth_destroy %p\n", ac);
	if (ac->ops)
		ac->ops->destroy(ac);
	kfree(ac);
}

/*
 * Reset occurs when reconnecting to the monitor.
 */
void ceph_auth_reset(struct ceph_auth_client *ac)
{
	mutex_lock(&ac->mutex);
	dout("auth_reset %p\n", ac);
	if (ac->ops && !ac->negotiating)
		ac->ops->reset(ac);
	ac->negotiating = true;
	mutex_unlock(&ac->mutex);
}

int ceph_entity_name_encode(const char *name, void **p, void *end)
{
	int len = strlen(name);

	if (*p + 2*sizeof(u32) + len > end)
		return -ERANGE;
	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	ceph_encode_32(p, len);
	ceph_encode_copy(p, name, len);
	return 0;
}

/*
 * Initiate protocol negotiation with monitor.  Include entity name
 * and list supported protocols.
 */
int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
{
	struct ceph_mon_request_header *monhdr = buf;
	void *p = monhdr + 1, *end = buf + len, *lenp;
	int i, num;
	int ret;

	mutex_lock(&ac->mutex);
	dout("auth_build_hello\n");
	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, 0);  /* no protocol, yet */

	lenp = p;
	p += sizeof(u32);

	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
	ceph_encode_8(&p, 1);
	num = ARRAY_SIZE(supported_protocols);
	ceph_encode_32(&p, num);
	ceph_decode_need(&p, end, num * sizeof(u32), bad);
	for (i = 0; i < num; i++)
		ceph_encode_32(&p, supported_protocols[i]);

	ret = ceph_entity_name_encode(ac->name, &p, end);
	if (ret < 0)
		goto out;
	ceph_decode_need(&p, end, sizeof(u64), bad);
	ceph_encode_64(&p, ac->global_id);

	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
	ret = p - buf;
out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	ret = -ERANGE;
	goto out;
}

static int ceph_build_auth_request(struct ceph_auth_client *ac,
				   void *msg_buf, size_t msg_len)
{
	struct ceph_mon_request_header *monhdr = msg_buf;
	void *p = monhdr + 1;
	void *end = msg_buf + msg_len;
	int ret;

	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, ac->protocol);

	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	if (ret < 0) {
		pr_err("error %d building auth method %s request\n", ret,
		       ac->ops->name);
		goto out;
	}
	dout(" built request %d bytes\n", ret);
	ceph_encode_32(&p, ret);
	ret = p + ret - msg_buf;
out:
	return ret;
}

/*
 * Handle auth message from monitor.
 */
int ceph_handle_auth_reply(struct ceph_auth_client *ac,
			   void *buf, size_t len,
			   void *reply_buf, size_t reply_len)
{
	void *p = buf;
	void *end = buf + len;
	int protocol;
	s32 result;
	u64 global_id;
	void *payload, *payload_end;
	int payload_len;
	char *result_msg;
	int result_msg_len;
	int ret = -EINVAL;

	mutex_lock(&ac->mutex);
	dout("handle_auth_reply %p %p\n", p, end);
	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	protocol = ceph_decode_32(&p);
	result = ceph_decode_32(&p);
	global_id = ceph_decode_64(&p);
	payload_len = ceph_decode_32(&p);
	payload = p;
	p += payload_len;
	ceph_decode_need(&p, end, sizeof(u32), bad);
	result_msg_len = ceph_decode_32(&p);
	result_msg = p;
	p += result_msg_len;
	if (p != end)
		goto bad;

	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	     result_msg, global_id, payload_len);

	payload_end = payload + payload_len;

	if (global_id && ac->global_id != global_id) {
		dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
		ac->global_id = global_id;
	}

	if (ac->negotiating) {
		/* server does not support our protocols? */
		if (!protocol && result < 0) {
			ret = result;
			goto out;
		}
		/* set up (new) protocol handler? */
		if (ac->protocol && ac->protocol != protocol) {
			ac->ops->destroy(ac);
			ac->protocol = 0;
			ac->ops = NULL;
		}
		if (ac->protocol != protocol) {
			ret = ceph_auth_init_protocol(ac, protocol);
			if (ret) {
				pr_err("error %d on auth protocol %d init\n",
				       ret, protocol);
				goto out;
			}
		}

		ac->negotiating = false;
	}

	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	if (ret == -EAGAIN) {
		ret = ceph_build_auth_request(ac, reply_buf, reply_len);
	} else if (ret) {
		pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
	}

out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	pr_err("failed to decode auth msg\n");
	ret = -EINVAL;
	goto out;
}

int ceph_build_auth(struct ceph_auth_client *ac,
		    void *msg_buf, size_t msg_len)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (!ac->protocol)
		ret = ceph_auth_build_hello(ac, msg_buf, msg_len);
	else if (ac->ops->should_authenticate(ac))
		ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	mutex_unlock(&ac->mutex);
	return ret;
}

int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops)
		ret = ac->ops->is_authenticated(ac);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_is_authenticated);

int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *auth)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->create_authorizer)
		ret = ac->ops->create_authorizer(ac, peer_type, auth);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_create_authorizer);

void ceph_auth_destroy_authorizer(struct ceph_auth_client *ac,
				  struct ceph_authorizer *a)
{
	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->destroy_authorizer)
		ac->ops->destroy_authorizer(ac, a);
	mutex_unlock(&ac->mutex);
}
EXPORT_SYMBOL(ceph_auth_destroy_authorizer);

int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *a)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->update_authorizer)
		ret = ac->ops->update_authorizer(ac, peer_type, a);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_update_authorizer);

int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
				      struct ceph_authorizer *a, size_t len)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->verify_authorizer_reply)
		ret = ac->ops->verify_authorizer_reply(ac, a, len);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);

void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
{
	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->invalidate_authorizer)
		ac->ops->invalidate_authorizer(ac, peer_type);
	mutex_unlock(&ac->mutex);
}
EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);
Commit	Line	Data
3d14c5d2	1	#include <linux/ceph/ceph_debug.h>
4e7a5dcd SW	2
	3	#include <linux/module.h>
	4	#include <linux/err.h>
d45d0d97	5	#include <linux/slab.h>
4e7a5dcd	6
3d14c5d2 YS	7	#include <linux/ceph/types.h>
	8	#include <linux/ceph/decode.h>
	9	#include <linux/ceph/libceph.h>
	10	#include <linux/ceph/messenger.h>
4e7a5dcd	11	#include "auth_none.h"
ec0994e4	12	#include "auth_x.h"
4e7a5dcd	13
4e7a5dcd SW	14
	15	/*
	16	* get protocol handler
	17	*/
	18	static u32 supported_protocols[] = {
ec0994e4 SW	19	CEPH_AUTH_NONE,
ec0994e4 SW	20	CEPH_AUTH_CEPHX
4e7a5dcd SW	21	};
4e7a5dcd SW	22
cd84db6e	23	static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
4e7a5dcd SW	24	{
	25	switch (protocol) {
	26	case CEPH_AUTH_NONE:
	27	return ceph_auth_none_init(ac);
ec0994e4 SW	28	case CEPH_AUTH_CEPHX:
ec0994e4 SW	29	return ceph_x_init(ac);
4e7a5dcd SW	30	default:
	31	return -ENOENT;
	32	}
	33	}
	34
	35	/*
	36	* setup, teardown.
	37	*/
8323c3aa	38	struct ceph_auth_client ceph_auth_init(const char name, const struct ceph_crypto_key *key)
4e7a5dcd SW	39	{
	40	struct ceph_auth_client *ac;
	41	int ret;
	42
8323c3aa	43	dout("auth_init name '%s'\n", name);
4e7a5dcd SW	44
	45	ret = -ENOMEM;
	46	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	47	if (!ac)
	48	goto out;
	49
e9966076	50	mutex_init(&ac->mutex);
4e7a5dcd SW	51	ac->negotiating = true;
	52	if (name)
	53	ac->name = name;
	54	else
	55	ac->name = CEPH_AUTH_NAME_DEFAULT;
8323c3aa TV	56	dout("auth_init name %s\n", ac->name);
8323c3aa TV	57	ac->key = key;
4e7a5dcd SW	58	return ac;
	59
	60	out:
	61	return ERR_PTR(ret);
	62	}
	63
	64	void ceph_auth_destroy(struct ceph_auth_client *ac)
	65	{
	66	dout("auth_destroy %p\n", ac);
	67	if (ac->ops)
	68	ac->ops->destroy(ac);
	69	kfree(ac);
	70	}
	71
	72	/*
	73	* Reset occurs when reconnecting to the monitor.
	74	*/
	75	void ceph_auth_reset(struct ceph_auth_client *ac)
	76	{
e9966076	77	mutex_lock(&ac->mutex);
4e7a5dcd SW	78	dout("auth_reset %p\n", ac);
	79	if (ac->ops && !ac->negotiating)
	80	ac->ops->reset(ac);
	81	ac->negotiating = true;
e9966076	82	mutex_unlock(&ac->mutex);
4e7a5dcd SW	83	}
	84
	85	int ceph_entity_name_encode(const char name, void p, void end)
	86	{
	87	int len = strlen(name);
	88
	89	if (p + 2sizeof(u32) + len > end)
	90	return -ERANGE;
	91	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	92	ceph_encode_32(p, len);
	93	ceph_encode_copy(p, name, len);
	94	return 0;
	95	}
	96
	97	/*
	98	* Initiate protocol negotiation with monitor. Include entity name
	99	* and list supported protocols.
	100	*/
	101	int ceph_auth_build_hello(struct ceph_auth_client ac, void buf, size_t len)
	102	{
	103	struct ceph_mon_request_header *monhdr = buf;
	104	void p = monhdr + 1, end = buf + len, *lenp;
	105	int i, num;
	106	int ret;
	107
e9966076	108	mutex_lock(&ac->mutex);
4e7a5dcd SW	109	dout("auth_build_hello\n");
	110	monhdr->have_version = 0;
	111	monhdr->session_mon = cpu_to_le16(-1);
	112	monhdr->session_mon_tid = 0;
	113
	114	ceph_encode_32(&p, 0); /* no protocol, yet */
	115
	116	lenp = p;
	117	p += sizeof(u32);
	118
07c8739c SW	119	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
07c8739c SW	120	ceph_encode_8(&p, 1);
4e7a5dcd SW	121	num = ARRAY_SIZE(supported_protocols);
4e7a5dcd SW	122	ceph_encode_32(&p, num);
07c8739c	123	ceph_decode_need(&p, end, num * sizeof(u32), bad);
4e7a5dcd SW	124	for (i = 0; i < num; i++)
	125	ceph_encode_32(&p, supported_protocols[i]);
	126
	127	ret = ceph_entity_name_encode(ac->name, &p, end);
	128	if (ret < 0)
e9966076	129	goto out;
4e7a5dcd SW	130	ceph_decode_need(&p, end, sizeof(u64), bad);
	131	ceph_encode_64(&p, ac->global_id);
	132
	133	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
e9966076 SW	134	ret = p - buf;
	135	out:
	136	mutex_unlock(&ac->mutex);
	137	return ret;
4e7a5dcd SW	138
4e7a5dcd SW	139	bad:
e9966076 SW	140	ret = -ERANGE;
e9966076 SW	141	goto out;
4e7a5dcd SW	142	}
4e7a5dcd SW	143
cd84db6e YS	144	static int ceph_build_auth_request(struct ceph_auth_client *ac,
cd84db6e YS	145	void *msg_buf, size_t msg_len)
9bd2e6f8 SW	146	{
	147	struct ceph_mon_request_header *monhdr = msg_buf;
	148	void *p = monhdr + 1;
	149	void *end = msg_buf + msg_len;
	150	int ret;
	151
	152	monhdr->have_version = 0;
	153	monhdr->session_mon = cpu_to_le16(-1);
	154	monhdr->session_mon_tid = 0;
	155
	156	ceph_encode_32(&p, ac->protocol);
	157
	158	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	159	if (ret < 0) {
559c1e00 SW	160	pr_err("error %d building auth method %s request\n", ret,
559c1e00 SW	161	ac->ops->name);
e9966076	162	goto out;
9bd2e6f8 SW	163	}
	164	dout(" built request %d bytes\n", ret);
	165	ceph_encode_32(&p, ret);
e9966076 SW	166	ret = p + ret - msg_buf;
	167	out:
	168	return ret;
9bd2e6f8 SW	169	}
9bd2e6f8 SW	170
4e7a5dcd SW	171	/*
	172	* Handle auth message from monitor.
	173	*/
	174	int ceph_handle_auth_reply(struct ceph_auth_client *ac,
	175	void *buf, size_t len,
	176	void *reply_buf, size_t reply_len)
	177	{
	178	void *p = buf;
	179	void *end = buf + len;
	180	int protocol;
	181	s32 result;
	182	u64 global_id;
	183	void payload, payload_end;
	184	int payload_len;
	185	char *result_msg;
	186	int result_msg_len;
	187	int ret = -EINVAL;
	188
e9966076	189	mutex_lock(&ac->mutex);
4e7a5dcd SW	190	dout("handle_auth_reply %p %p\n", p, end);
	191	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	192	protocol = ceph_decode_32(&p);
	193	result = ceph_decode_32(&p);
	194	global_id = ceph_decode_64(&p);
	195	payload_len = ceph_decode_32(&p);
	196	payload = p;
	197	p += payload_len;
	198	ceph_decode_need(&p, end, sizeof(u32), bad);
	199	result_msg_len = ceph_decode_32(&p);
	200	result_msg = p;
	201	p += result_msg_len;
	202	if (p != end)
	203	goto bad;
	204
	205	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	206	result_msg, global_id, payload_len);
	207
	208	payload_end = payload + payload_len;
	209
	210	if (global_id && ac->global_id != global_id) {
	211	dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
	212	ac->global_id = global_id;
	213	}
	214
	215	if (ac->negotiating) {
dc14657c YS	216	/* server does not support our protocols? */
	217	if (!protocol && result < 0) {
	218	ret = result;
	219	goto out;
	220	}
4e7a5dcd SW	221	/* set up (new) protocol handler? */
	222	if (ac->protocol && ac->protocol != protocol) {
	223	ac->ops->destroy(ac);
	224	ac->protocol = 0;
	225	ac->ops = NULL;
	226	}
	227	if (ac->protocol != protocol) {
	228	ret = ceph_auth_init_protocol(ac, protocol);
	229	if (ret) {
e95e9a7a SW	230	pr_err("error %d on auth protocol %d init\n",
e95e9a7a SW	231	ret, protocol);
4e7a5dcd SW	232	goto out;
	233	}
	234	}
9bd2e6f8 SW	235
9bd2e6f8 SW	236	ac->negotiating = false;
4e7a5dcd SW	237	}
	238
	239	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	240	if (ret == -EAGAIN) {
e9966076	241	ret = ceph_build_auth_request(ac, reply_buf, reply_len);
4e7a5dcd	242	} else if (ret) {
559c1e00	243	pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
4e7a5dcd	244	}
4e7a5dcd	245
4e7a5dcd	246	out:
e9966076	247	mutex_unlock(&ac->mutex);
4e7a5dcd	248	return ret;
e9966076 SW	249
	250	bad:
	251	pr_err("failed to decode auth msg\n");
	252	ret = -EINVAL;
	253	goto out;
4e7a5dcd SW	254	}
4e7a5dcd SW	255
9bd2e6f8 SW	256	int ceph_build_auth(struct ceph_auth_client *ac,
	257	void *msg_buf, size_t msg_len)
	258	{
e9966076 SW	259	int ret = 0;
	260
	261	mutex_lock(&ac->mutex);
9bd2e6f8	262	if (!ac->protocol)
e9966076 SW	263	ret = ceph_auth_build_hello(ac, msg_buf, msg_len);
	264	else if (ac->ops->should_authenticate(ac))
	265	ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	266	mutex_unlock(&ac->mutex);
	267	return ret;
9bd2e6f8	268	}
4e7a5dcd	269
9bd2e6f8 SW	270	int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
9bd2e6f8 SW	271	{
e9966076 SW	272	int ret = 0;
	273
	274	mutex_lock(&ac->mutex);
	275	if (ac->ops)
	276	ret = ac->ops->is_authenticated(ac);
	277	mutex_unlock(&ac->mutex);
	278	return ret;
9bd2e6f8	279	}
27859f97 SW	280	EXPORT_SYMBOL(ceph_auth_is_authenticated);
	281
	282	int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
	283	int peer_type,
	284	struct ceph_auth_handshake *auth)
	285	{
e9966076 SW	286	int ret = 0;
	287
	288	mutex_lock(&ac->mutex);
27859f97	289	if (ac->ops && ac->ops->create_authorizer)
e9966076 SW	290	ret = ac->ops->create_authorizer(ac, peer_type, auth);
	291	mutex_unlock(&ac->mutex);
	292	return ret;
27859f97 SW	293	}
	294	EXPORT_SYMBOL(ceph_auth_create_authorizer);
	295
	296	void ceph_auth_destroy_authorizer(struct ceph_auth_client *ac,
	297	struct ceph_authorizer *a)
	298	{
e9966076	299	mutex_lock(&ac->mutex);
27859f97 SW	300	if (ac->ops && ac->ops->destroy_authorizer)
27859f97 SW	301	ac->ops->destroy_authorizer(ac, a);
e9966076	302	mutex_unlock(&ac->mutex);
27859f97 SW	303	}
	304	EXPORT_SYMBOL(ceph_auth_destroy_authorizer);
	305
	306	int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
	307	int peer_type,
	308	struct ceph_auth_handshake *a)
	309	{
	310	int ret = 0;
	311
e9966076	312	mutex_lock(&ac->mutex);
27859f97 SW	313	if (ac->ops && ac->ops->update_authorizer)
27859f97 SW	314	ret = ac->ops->update_authorizer(ac, peer_type, a);
e9966076	315	mutex_unlock(&ac->mutex);
27859f97 SW	316	return ret;
	317	}
	318	EXPORT_SYMBOL(ceph_auth_update_authorizer);
	319
	320	int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
	321	struct ceph_authorizer *a, size_t len)
	322	{
e9966076 SW	323	int ret = 0;
	324
	325	mutex_lock(&ac->mutex);
27859f97	326	if (ac->ops && ac->ops->verify_authorizer_reply)
e9966076 SW	327	ret = ac->ops->verify_authorizer_reply(ac, a, len);
	328	mutex_unlock(&ac->mutex);
	329	return ret;
27859f97 SW	330	}
	331	EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);
	332
	333	void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
	334	{
e9966076	335	mutex_lock(&ac->mutex);
27859f97 SW	336	if (ac->ops && ac->ops->invalidate_authorizer)
27859f97 SW	337	ac->ops->invalidate_authorizer(ac, peer_type);
e9966076	338	mutex_unlock(&ac->mutex);
27859f97 SW	339	}
27859f97 SW	340	EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);