Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 | /* SPDX-License-Identifier: GPL-2.0 */ #ifndef _FS_CEPH_AUTH_H #define _FS_CEPH_AUTH_H #include <linux/ceph/types.h> #include <linux/ceph/buffer.h> /* * Abstract interface for communicating with the authenticate module. * There is some handshake that takes place between us and the monitor * to acquire the necessary keys. These are used to generate an * 'authorizer' that we use when connecting to a service (mds, osd). */ struct ceph_auth_client; struct ceph_msg; struct ceph_authorizer { void (*destroy)(struct ceph_authorizer *); }; struct ceph_auth_handshake { struct ceph_authorizer *authorizer; void *authorizer_buf; size_t authorizer_buf_len; void *authorizer_reply_buf; size_t authorizer_reply_buf_len; int (*sign_message)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); int (*check_message_signature)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); }; struct ceph_auth_client_ops { /* * true if we are authenticated and can connect to * services. */ int (*is_authenticated)(struct ceph_auth_client *ac); /* * true if we should (re)authenticate, e.g., when our tickets * are getting old and crusty. */ int (*should_authenticate)(struct ceph_auth_client *ac); /* * build requests and process replies during monitor * handshake. if handle_reply returns -EAGAIN, we build * another request. */ int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end); int (*handle_reply)(struct ceph_auth_client *ac, u64 global_id, void *buf, void *end, u8 *session_key, int *session_key_len, u8 *con_secret, int *con_secret_len); /* * Create authorizer for connecting to a service, and verify * the response to authenticate the service. */ int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *auth); /* ensure that an existing authorizer is up to date */ int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type, struct ceph_auth_handshake *auth); int (*add_authorizer_challenge)(struct ceph_auth_client *ac, struct ceph_authorizer *a, void *challenge_buf, int challenge_buf_len); int (*verify_authorizer_reply)(struct ceph_auth_client *ac, struct ceph_authorizer *a, void *reply, int reply_len, u8 *session_key, int *session_key_len, u8 *con_secret, int *con_secret_len); void (*invalidate_authorizer)(struct ceph_auth_client *ac, int peer_type); /* reset when we (re)connect to a monitor */ void (*reset)(struct ceph_auth_client *ac); void (*destroy)(struct ceph_auth_client *ac); int (*sign_message)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); int (*check_message_signature)(struct ceph_auth_handshake *auth, struct ceph_msg *msg); }; struct ceph_auth_client { u32 protocol; /* CEPH_AUTH_* */ void *private; /* for use by protocol implementation */ const struct ceph_auth_client_ops *ops; /* null iff protocol==0 */ bool negotiating; /* true if negotiating protocol */ const char *name; /* entity name */ u64 global_id; /* our unique id in system */ const struct ceph_crypto_key *key; /* our secret key */ unsigned want_keys; /* which services we want */ int preferred_mode; /* CEPH_CON_MODE_* */ int fallback_mode; /* ditto */ struct mutex mutex; }; void ceph_auth_set_global_id(struct ceph_auth_client *ac, u64 global_id); struct ceph_auth_client *ceph_auth_init(const char *name, const struct ceph_crypto_key *key, const int *con_modes); extern void ceph_auth_destroy(struct ceph_auth_client *ac); extern void ceph_auth_reset(struct ceph_auth_client *ac); extern int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len); extern int ceph_handle_auth_reply(struct ceph_auth_client *ac, void *buf, size_t len, void *reply_buf, size_t reply_len); int ceph_auth_entity_name_encode(const char *name, void **p, void *end); extern int ceph_build_auth(struct ceph_auth_client *ac, void *msg_buf, size_t msg_len); extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac); int __ceph_auth_get_authorizer(struct ceph_auth_client *ac, struct ceph_auth_handshake *auth, int peer_type, bool force_new, int *proto, int *pref_mode, int *fallb_mode); void ceph_auth_destroy_authorizer(struct ceph_authorizer *a); int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac, struct ceph_authorizer *a, void *challenge_buf, int challenge_buf_len); int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac, struct ceph_authorizer *a, void *reply, int reply_len, u8 *session_key, int *session_key_len, u8 *con_secret, int *con_secret_len); extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type); static inline int ceph_auth_sign_message(struct ceph_auth_handshake *auth, struct ceph_msg *msg) { if (auth->sign_message) return auth->sign_message(auth, msg); return 0; } static inline int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth, struct ceph_msg *msg) { if (auth->check_message_signature) return auth->check_message_signature(auth, msg); return 0; } int ceph_auth_get_request(struct ceph_auth_client *ac, void *buf, int buf_len); int ceph_auth_handle_reply_more(struct ceph_auth_client *ac, void *reply, int reply_len, void *buf, int buf_len); int ceph_auth_handle_reply_done(struct ceph_auth_client *ac, u64 global_id, void *reply, int reply_len, u8 *session_key, int *session_key_len, u8 *con_secret, int *con_secret_len); bool ceph_auth_handle_bad_method(struct ceph_auth_client *ac, int used_proto, int result, const int *allowed_protos, int proto_cnt, const int *allowed_modes, int mode_cnt); int ceph_auth_get_authorizer(struct ceph_auth_client *ac, struct ceph_auth_handshake *auth, int peer_type, void *buf, int *buf_len); int ceph_auth_handle_svc_reply_more(struct ceph_auth_client *ac, struct ceph_auth_handshake *auth, void *reply, int reply_len, void *buf, int *buf_len); int ceph_auth_handle_svc_reply_done(struct ceph_auth_client *ac, struct ceph_auth_handshake *auth, void *reply, int reply_len, u8 *session_key, int *session_key_len, u8 *con_secret, int *con_secret_len); bool ceph_auth_handle_bad_authorizer(struct ceph_auth_client *ac, int peer_type, int used_proto, int result, const int *allowed_protos, int proto_cnt, const int *allowed_modes, int mode_cnt); #endif |