Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 | #ifndef _FS_CEPH_AUTH_H #define _FS_CEPH_AUTH_H #include <linux/ceph/types.h> #include <linux/ceph/buffer.h> /* * Abstract interface for communicating with the authenticate module. * There is some handshake that takes place between us and the monitor * to acquire the necessary keys. These are used to generate an * 'authorizer' that we use when connecting to a service (mds, osd). */ struct ceph_auth_client; struct ceph_authorizer; struct ceph_msg; struct ceph_auth_handshake { struct ceph_authorizer *authorizer; void *authorizer_buf; size_t authorizer_buf_len; void *authorizer_reply_buf; size_t authorizer_reply_buf_len; int (*sign_message)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); int (*check_message_signature)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); }; struct ceph_auth_client_ops { const char *name; /* * true if we are authenticated and can connect to * services. */ int (*is_authenticated)(struct ceph_auth_client *ac); /* * true if we should (re)authenticate, e.g., when our tickets * are getting old and crusty. */ int (*should_authenticate)(struct ceph_auth_client *ac); /* * build requests and process replies during monitor * handshake. if handle_reply returns -EAGAIN, we build * another request. */ int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end); int (*handle_reply)(struct ceph_auth_client *ac, int result, void *buf, void *end); /* * Create authorizer for connecting to a service, and verify * the response to authenticate the service. */ int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *auth); /* ensure that an existing authorizer is up to date */ int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *auth); int (*verify_authorizer_reply)(struct ceph_auth_client *ac, struct ceph_authorizer *a, size_t len); void (*destroy_authorizer)(struct ceph_auth_client *ac, struct ceph_authorizer *a); void (*invalidate_authorizer)(struct ceph_auth_client *ac, int peer_type); /* reset when we (re)connect to a monitor */ void (*reset)(struct ceph_auth_client *ac); void (*destroy)(struct ceph_auth_client *ac); int (*sign_message)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); int (*check_message_signature)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); }; struct ceph_auth_client { u32 protocol; /* CEPH_AUTH_* */ void *private; /* for use by protocol implementation */ const struct ceph_auth_client_ops *ops; /* null iff protocol==0 */ bool negotiating; /* true if negotiating protocol */ const char *name; /* entity name */ u64 global_id; /* our unique id in system */ const struct ceph_crypto_key *key; /* our secret key */ unsigned want_keys; /* which services we want */ struct mutex mutex; }; extern struct ceph_auth_client *ceph_auth_init(const char *name, const struct ceph_crypto_key *key); extern void ceph_auth_destroy(struct ceph_auth_client *ac); extern void ceph_auth_reset(struct ceph_auth_client *ac); extern int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len); extern int ceph_handle_auth_reply(struct ceph_auth_client *ac, void *buf, size_t len, void *reply_buf, size_t reply_len); extern int ceph_entity_name_encode(const char *name, void **p, void *end); extern int ceph_build_auth(struct ceph_auth_client *ac, void *msg_buf, size_t msg_len); extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac); extern int ceph_auth_create_authorizer(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *auth); extern void ceph_auth_destroy_authorizer(struct ceph_auth_client *ac, struct ceph_authorizer *a); extern int ceph_auth_update_authorizer(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *a); extern int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac, struct ceph_authorizer *a, size_t len); extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type); static inline int ceph_auth_sign_message(struct ceph_auth_handshake *auth, struct ceph_msg *msg) { if (auth->sign_message) return auth->sign_message(auth, msg); return 0; } static inline int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth, struct ceph_msg *msg) { if (auth->check_message_signature) return auth->check_message_signature(auth, msg); return 0; } #endif |