[mirror_ubuntu-eoan-kernel.git] / net / ceph / auth.c

// SPDX-License-Identifier: GPL-2.0
#include <linux/ceph/ceph_debug.h>

#include <linux/module.h>
#include <linux/err.h>
#include <linux/slab.h>

#include <linux/ceph/types.h>
#include <linux/ceph/decode.h>
#include <linux/ceph/libceph.h>
#include <linux/ceph/messenger.h>
#include "auth_none.h"
#include "auth_x.h"


/*
 * get protocol handler
 */
static u32 supported_protocols[] = {
	CEPH_AUTH_NONE,
	CEPH_AUTH_CEPHX
};

static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
{
	switch (protocol) {
	case CEPH_AUTH_NONE:
		return ceph_auth_none_init(ac);
	case CEPH_AUTH_CEPHX:
		return ceph_x_init(ac);
	default:
		return -ENOENT;
	}
}

/*
 * setup, teardown.
 */
struct ceph_auth_client *ceph_auth_init(const char *name, const struct ceph_crypto_key *key)
{
	struct ceph_auth_client *ac;
	int ret;

	dout("auth_init name '%s'\n", name);

	ret = -ENOMEM;
	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	if (!ac)
		goto out;

	mutex_init(&ac->mutex);
	ac->negotiating = true;
	if (name)
		ac->name = name;
	else
		ac->name = CEPH_AUTH_NAME_DEFAULT;
	dout("auth_init name %s\n", ac->name);
	ac->key = key;
	return ac;

out:
	return ERR_PTR(ret);
}

void ceph_auth_destroy(struct ceph_auth_client *ac)
{
	dout("auth_destroy %p\n", ac);
	if (ac->ops)
		ac->ops->destroy(ac);
	kfree(ac);
}

/*
 * Reset occurs when reconnecting to the monitor.
 */
void ceph_auth_reset(struct ceph_auth_client *ac)
{
	mutex_lock(&ac->mutex);
	dout("auth_reset %p\n", ac);
	if (ac->ops && !ac->negotiating)
		ac->ops->reset(ac);
	ac->negotiating = true;
	mutex_unlock(&ac->mutex);
}

/*
 * EntityName, not to be confused with entity_name_t
 */
int ceph_auth_entity_name_encode(const char *name, void **p, void *end)
{
	int len = strlen(name);

	if (*p + 2*sizeof(u32) + len > end)
		return -ERANGE;
	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	ceph_encode_32(p, len);
	ceph_encode_copy(p, name, len);
	return 0;
}

/*
 * Initiate protocol negotiation with monitor.  Include entity name
 * and list supported protocols.
 */
int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
{
	struct ceph_mon_request_header *monhdr = buf;
	void *p = monhdr + 1, *end = buf + len, *lenp;
	int i, num;
	int ret;

	mutex_lock(&ac->mutex);
	dout("auth_build_hello\n");
	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, CEPH_AUTH_UNKNOWN);  /* no protocol, yet */

	lenp = p;
	p += sizeof(u32);

	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
	ceph_encode_8(&p, 1);
	num = ARRAY_SIZE(supported_protocols);
	ceph_encode_32(&p, num);
	ceph_decode_need(&p, end, num * sizeof(u32), bad);
	for (i = 0; i < num; i++)
		ceph_encode_32(&p, supported_protocols[i]);

	ret = ceph_auth_entity_name_encode(ac->name, &p, end);
	if (ret < 0)
		goto out;
	ceph_decode_need(&p, end, sizeof(u64), bad);
	ceph_encode_64(&p, ac->global_id);

	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
	ret = p - buf;
out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	ret = -ERANGE;
	goto out;
}

static int ceph_build_auth_request(struct ceph_auth_client *ac,
				   void *msg_buf, size_t msg_len)
{
	struct ceph_mon_request_header *monhdr = msg_buf;
	void *p = monhdr + 1;
	void *end = msg_buf + msg_len;
	int ret;

	monhdr->have_version = 0;
	monhdr->session_mon = cpu_to_le16(-1);
	monhdr->session_mon_tid = 0;

	ceph_encode_32(&p, ac->protocol);

	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	if (ret < 0) {
		pr_err("error %d building auth method %s request\n", ret,
		       ac->ops->name);
		goto out;
	}
	dout(" built request %d bytes\n", ret);
	ceph_encode_32(&p, ret);
	ret = p + ret - msg_buf;
out:
	return ret;
}

/*
 * Handle auth message from monitor.
 */
int ceph_handle_auth_reply(struct ceph_auth_client *ac,
			   void *buf, size_t len,
			   void *reply_buf, size_t reply_len)
{
	void *p = buf;
	void *end = buf + len;
	int protocol;
	s32 result;
	u64 global_id;
	void *payload, *payload_end;
	int payload_len;
	char *result_msg;
	int result_msg_len;
	int ret = -EINVAL;

	mutex_lock(&ac->mutex);
	dout("handle_auth_reply %p %p\n", p, end);
	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	protocol = ceph_decode_32(&p);
	result = ceph_decode_32(&p);
	global_id = ceph_decode_64(&p);
	payload_len = ceph_decode_32(&p);
	payload = p;
	p += payload_len;
	ceph_decode_need(&p, end, sizeof(u32), bad);
	result_msg_len = ceph_decode_32(&p);
	result_msg = p;
	p += result_msg_len;
	if (p != end)
		goto bad;

	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	     result_msg, global_id, payload_len);

	payload_end = payload + payload_len;

	if (global_id && ac->global_id != global_id) {
		dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
		ac->global_id = global_id;
	}

	if (ac->negotiating) {
		/* server does not support our protocols? */
		if (!protocol && result < 0) {
			ret = result;
			goto out;
		}
		/* set up (new) protocol handler? */
		if (ac->protocol && ac->protocol != protocol) {
			ac->ops->destroy(ac);
			ac->protocol = 0;
			ac->ops = NULL;
		}
		if (ac->protocol != protocol) {
			ret = ceph_auth_init_protocol(ac, protocol);
			if (ret) {
				pr_err("error %d on auth protocol %d init\n",
				       ret, protocol);
				goto out;
			}
		}

		ac->negotiating = false;
	}

	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	if (ret == -EAGAIN) {
		ret = ceph_build_auth_request(ac, reply_buf, reply_len);
	} else if (ret) {
		pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
	}

out:
	mutex_unlock(&ac->mutex);
	return ret;

bad:
	pr_err("failed to decode auth msg\n");
	ret = -EINVAL;
	goto out;
}

int ceph_build_auth(struct ceph_auth_client *ac,
		    void *msg_buf, size_t msg_len)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops->should_authenticate(ac))
		ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	mutex_unlock(&ac->mutex);
	return ret;
}

int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops)
		ret = ac->ops->is_authenticated(ac);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_is_authenticated);

int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *auth)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->create_authorizer)
		ret = ac->ops->create_authorizer(ac, peer_type, auth);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_create_authorizer);

void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
{
	a->destroy(a);
}
EXPORT_SYMBOL(ceph_auth_destroy_authorizer);

int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
				int peer_type,
				struct ceph_auth_handshake *a)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->update_authorizer)
		ret = ac->ops->update_authorizer(ac, peer_type, a);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_update_authorizer);

int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
				      struct ceph_authorizer *a)
{
	int ret = 0;

	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->verify_authorizer_reply)
		ret = ac->ops->verify_authorizer_reply(ac, a);
	mutex_unlock(&ac->mutex);
	return ret;
}
EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);

void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
{
	mutex_lock(&ac->mutex);
	if (ac->ops && ac->ops->invalidate_authorizer)
		ac->ops->invalidate_authorizer(ac, peer_type);
	mutex_unlock(&ac->mutex);
}
EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);
Commit	Line	Data
b2441318	1	// SPDX-License-Identifier: GPL-2.0
3d14c5d2	2	#include <linux/ceph/ceph_debug.h>
4e7a5dcd SW	3
	4	#include <linux/module.h>
	5	#include <linux/err.h>
d45d0d97	6	#include <linux/slab.h>
4e7a5dcd	7
3d14c5d2 YS	8	#include <linux/ceph/types.h>
	9	#include <linux/ceph/decode.h>
	10	#include <linux/ceph/libceph.h>
	11	#include <linux/ceph/messenger.h>
4e7a5dcd	12	#include "auth_none.h"
ec0994e4	13	#include "auth_x.h"
4e7a5dcd	14
4e7a5dcd SW	15
	16	/*
	17	* get protocol handler
	18	*/
	19	static u32 supported_protocols[] = {
ec0994e4 SW	20	CEPH_AUTH_NONE,
ec0994e4 SW	21	CEPH_AUTH_CEPHX
4e7a5dcd SW	22	};
4e7a5dcd SW	23
cd84db6e	24	static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
4e7a5dcd SW	25	{
	26	switch (protocol) {
	27	case CEPH_AUTH_NONE:
	28	return ceph_auth_none_init(ac);
ec0994e4 SW	29	case CEPH_AUTH_CEPHX:
ec0994e4 SW	30	return ceph_x_init(ac);
4e7a5dcd SW	31	default:
	32	return -ENOENT;
	33	}
	34	}
	35
	36	/*
	37	* setup, teardown.
	38	*/
8323c3aa	39	struct ceph_auth_client ceph_auth_init(const char name, const struct ceph_crypto_key *key)
4e7a5dcd SW	40	{
	41	struct ceph_auth_client *ac;
	42	int ret;
	43
8323c3aa	44	dout("auth_init name '%s'\n", name);
4e7a5dcd SW	45
	46	ret = -ENOMEM;
	47	ac = kzalloc(sizeof(*ac), GFP_NOFS);
	48	if (!ac)
	49	goto out;
	50
e9966076	51	mutex_init(&ac->mutex);
4e7a5dcd SW	52	ac->negotiating = true;
	53	if (name)
	54	ac->name = name;
	55	else
	56	ac->name = CEPH_AUTH_NAME_DEFAULT;
8323c3aa TV	57	dout("auth_init name %s\n", ac->name);
8323c3aa TV	58	ac->key = key;
4e7a5dcd SW	59	return ac;
	60
	61	out:
	62	return ERR_PTR(ret);
	63	}
	64
	65	void ceph_auth_destroy(struct ceph_auth_client *ac)
	66	{
	67	dout("auth_destroy %p\n", ac);
	68	if (ac->ops)
	69	ac->ops->destroy(ac);
	70	kfree(ac);
	71	}
	72
	73	/*
	74	* Reset occurs when reconnecting to the monitor.
	75	*/
	76	void ceph_auth_reset(struct ceph_auth_client *ac)
	77	{
e9966076	78	mutex_lock(&ac->mutex);
4e7a5dcd SW	79	dout("auth_reset %p\n", ac);
	80	if (ac->ops && !ac->negotiating)
	81	ac->ops->reset(ac);
	82	ac->negotiating = true;
e9966076	83	mutex_unlock(&ac->mutex);
4e7a5dcd SW	84	}
4e7a5dcd SW	85
f01d5cb2 ID	86	/*
	87	* EntityName, not to be confused with entity_name_t
	88	*/
	89	int ceph_auth_entity_name_encode(const char name, void p, void end)
4e7a5dcd SW	90	{
	91	int len = strlen(name);
	92
	93	if (p + 2sizeof(u32) + len > end)
	94	return -ERANGE;
	95	ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
	96	ceph_encode_32(p, len);
	97	ceph_encode_copy(p, name, len);
	98	return 0;
	99	}
	100
	101	/*
	102	* Initiate protocol negotiation with monitor. Include entity name
	103	* and list supported protocols.
	104	*/
	105	int ceph_auth_build_hello(struct ceph_auth_client ac, void buf, size_t len)
	106	{
	107	struct ceph_mon_request_header *monhdr = buf;
	108	void p = monhdr + 1, end = buf + len, *lenp;
	109	int i, num;
	110	int ret;
	111
e9966076	112	mutex_lock(&ac->mutex);
4e7a5dcd SW	113	dout("auth_build_hello\n");
	114	monhdr->have_version = 0;
	115	monhdr->session_mon = cpu_to_le16(-1);
	116	monhdr->session_mon_tid = 0;
	117
fdc723e7	118	ceph_encode_32(&p, CEPH_AUTH_UNKNOWN); /* no protocol, yet */
4e7a5dcd SW	119
	120	lenp = p;
	121	p += sizeof(u32);
	122
07c8739c SW	123	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
07c8739c SW	124	ceph_encode_8(&p, 1);
4e7a5dcd SW	125	num = ARRAY_SIZE(supported_protocols);
4e7a5dcd SW	126	ceph_encode_32(&p, num);
07c8739c	127	ceph_decode_need(&p, end, num * sizeof(u32), bad);
4e7a5dcd SW	128	for (i = 0; i < num; i++)
	129	ceph_encode_32(&p, supported_protocols[i]);
	130
f01d5cb2	131	ret = ceph_auth_entity_name_encode(ac->name, &p, end);
4e7a5dcd	132	if (ret < 0)
e9966076	133	goto out;
4e7a5dcd SW	134	ceph_decode_need(&p, end, sizeof(u64), bad);
	135	ceph_encode_64(&p, ac->global_id);
	136
	137	ceph_encode_32(&lenp, p - lenp - sizeof(u32));
e9966076 SW	138	ret = p - buf;
	139	out:
	140	mutex_unlock(&ac->mutex);
	141	return ret;
4e7a5dcd SW	142
4e7a5dcd SW	143	bad:
e9966076 SW	144	ret = -ERANGE;
e9966076 SW	145	goto out;
4e7a5dcd SW	146	}
4e7a5dcd SW	147
cd84db6e YS	148	static int ceph_build_auth_request(struct ceph_auth_client *ac,
cd84db6e YS	149	void *msg_buf, size_t msg_len)
9bd2e6f8 SW	150	{
	151	struct ceph_mon_request_header *monhdr = msg_buf;
	152	void *p = monhdr + 1;
	153	void *end = msg_buf + msg_len;
	154	int ret;
	155
	156	monhdr->have_version = 0;
	157	monhdr->session_mon = cpu_to_le16(-1);
	158	monhdr->session_mon_tid = 0;
	159
	160	ceph_encode_32(&p, ac->protocol);
	161
	162	ret = ac->ops->build_request(ac, p + sizeof(u32), end);
	163	if (ret < 0) {
559c1e00 SW	164	pr_err("error %d building auth method %s request\n", ret,
559c1e00 SW	165	ac->ops->name);
e9966076	166	goto out;
9bd2e6f8 SW	167	}
	168	dout(" built request %d bytes\n", ret);
	169	ceph_encode_32(&p, ret);
e9966076 SW	170	ret = p + ret - msg_buf;
	171	out:
	172	return ret;
9bd2e6f8 SW	173	}
9bd2e6f8 SW	174
4e7a5dcd SW	175	/*
	176	* Handle auth message from monitor.
	177	*/
	178	int ceph_handle_auth_reply(struct ceph_auth_client *ac,
	179	void *buf, size_t len,
	180	void *reply_buf, size_t reply_len)
	181	{
	182	void *p = buf;
	183	void *end = buf + len;
	184	int protocol;
	185	s32 result;
	186	u64 global_id;
	187	void payload, payload_end;
	188	int payload_len;
	189	char *result_msg;
	190	int result_msg_len;
	191	int ret = -EINVAL;
	192
e9966076	193	mutex_lock(&ac->mutex);
4e7a5dcd SW	194	dout("handle_auth_reply %p %p\n", p, end);
	195	ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
	196	protocol = ceph_decode_32(&p);
	197	result = ceph_decode_32(&p);
	198	global_id = ceph_decode_64(&p);
	199	payload_len = ceph_decode_32(&p);
	200	payload = p;
	201	p += payload_len;
	202	ceph_decode_need(&p, end, sizeof(u32), bad);
	203	result_msg_len = ceph_decode_32(&p);
	204	result_msg = p;
	205	p += result_msg_len;
	206	if (p != end)
	207	goto bad;
	208
	209	dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
	210	result_msg, global_id, payload_len);
	211
	212	payload_end = payload + payload_len;
	213
	214	if (global_id && ac->global_id != global_id) {
	215	dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
	216	ac->global_id = global_id;
	217	}
	218
	219	if (ac->negotiating) {
dc14657c YS	220	/* server does not support our protocols? */
	221	if (!protocol && result < 0) {
	222	ret = result;
	223	goto out;
	224	}
4e7a5dcd SW	225	/* set up (new) protocol handler? */
	226	if (ac->protocol && ac->protocol != protocol) {
	227	ac->ops->destroy(ac);
	228	ac->protocol = 0;
	229	ac->ops = NULL;
	230	}
	231	if (ac->protocol != protocol) {
	232	ret = ceph_auth_init_protocol(ac, protocol);
	233	if (ret) {
e95e9a7a SW	234	pr_err("error %d on auth protocol %d init\n",
e95e9a7a SW	235	ret, protocol);
4e7a5dcd SW	236	goto out;
	237	}
	238	}
9bd2e6f8 SW	239
9bd2e6f8 SW	240	ac->negotiating = false;
4e7a5dcd SW	241	}
	242
	243	ret = ac->ops->handle_reply(ac, result, payload, payload_end);
	244	if (ret == -EAGAIN) {
e9966076	245	ret = ceph_build_auth_request(ac, reply_buf, reply_len);
4e7a5dcd	246	} else if (ret) {
559c1e00	247	pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
4e7a5dcd	248	}
4e7a5dcd	249
4e7a5dcd	250	out:
e9966076	251	mutex_unlock(&ac->mutex);
4e7a5dcd	252	return ret;
e9966076 SW	253
	254	bad:
	255	pr_err("failed to decode auth msg\n");
	256	ret = -EINVAL;
	257	goto out;
4e7a5dcd SW	258	}
4e7a5dcd SW	259
9bd2e6f8 SW	260	int ceph_build_auth(struct ceph_auth_client *ac,
	261	void *msg_buf, size_t msg_len)
	262	{
e9966076 SW	263	int ret = 0;
	264
	265	mutex_lock(&ac->mutex);
464691bd	266	if (ac->ops->should_authenticate(ac))
e9966076 SW	267	ret = ceph_build_auth_request(ac, msg_buf, msg_len);
	268	mutex_unlock(&ac->mutex);
	269	return ret;
9bd2e6f8	270	}
4e7a5dcd	271
9bd2e6f8 SW	272	int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
9bd2e6f8 SW	273	{
e9966076 SW	274	int ret = 0;
	275
	276	mutex_lock(&ac->mutex);
	277	if (ac->ops)
	278	ret = ac->ops->is_authenticated(ac);
	279	mutex_unlock(&ac->mutex);
	280	return ret;
9bd2e6f8	281	}
27859f97 SW	282	EXPORT_SYMBOL(ceph_auth_is_authenticated);
	283
	284	int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
	285	int peer_type,
	286	struct ceph_auth_handshake *auth)
	287	{
e9966076 SW	288	int ret = 0;
	289
	290	mutex_lock(&ac->mutex);
27859f97	291	if (ac->ops && ac->ops->create_authorizer)
e9966076 SW	292	ret = ac->ops->create_authorizer(ac, peer_type, auth);
	293	mutex_unlock(&ac->mutex);
	294	return ret;
27859f97 SW	295	}
	296	EXPORT_SYMBOL(ceph_auth_create_authorizer);
	297
6c1ea260	298	void ceph_auth_destroy_authorizer(struct ceph_authorizer *a)
27859f97	299	{
6c1ea260	300	a->destroy(a);
27859f97 SW	301	}
	302	EXPORT_SYMBOL(ceph_auth_destroy_authorizer);
	303
	304	int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
	305	int peer_type,
	306	struct ceph_auth_handshake *a)
	307	{
	308	int ret = 0;
	309
e9966076	310	mutex_lock(&ac->mutex);
27859f97 SW	311	if (ac->ops && ac->ops->update_authorizer)
27859f97 SW	312	ret = ac->ops->update_authorizer(ac, peer_type, a);
e9966076	313	mutex_unlock(&ac->mutex);
27859f97 SW	314	return ret;
	315	}
	316	EXPORT_SYMBOL(ceph_auth_update_authorizer);
	317
	318	int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
0dde5848	319	struct ceph_authorizer *a)
27859f97	320	{
e9966076 SW	321	int ret = 0;
	322
	323	mutex_lock(&ac->mutex);
27859f97	324	if (ac->ops && ac->ops->verify_authorizer_reply)
0dde5848	325	ret = ac->ops->verify_authorizer_reply(ac, a);
e9966076 SW	326	mutex_unlock(&ac->mutex);
e9966076 SW	327	return ret;
27859f97 SW	328	}
	329	EXPORT_SYMBOL(ceph_auth_verify_authorizer_reply);
	330
	331	void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac, int peer_type)
	332	{
e9966076	333	mutex_lock(&ac->mutex);
27859f97 SW	334	if (ac->ops && ac->ops->invalidate_authorizer)
27859f97 SW	335	ac->ops->invalidate_authorizer(ac, peer_type);
e9966076	336	mutex_unlock(&ac->mutex);
27859f97 SW	337	}
27859f97 SW	338	EXPORT_SYMBOL(ceph_auth_invalidate_authorizer);