ceph/src/auth/cephx/CephxKeyServer.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3 /*
   4  * Ceph - scalable distributed file system
   5  *
   6  * Copyright (C) 2004-2009 Sage Weil <sage@newdream.net>
   7  *
   8  * This is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License version 2.1, as published by the Free Software
  11  * Foundation.  See file COPYING.
  12  *
  13  */
  14
  15 #include "common/config.h"
  16 #include "CephxKeyServer.h"
  17 #include "common/dout.h"
  18 #include <sstream>
  19
  20 #define dout_subsys ceph_subsys_auth
  21 #undef dout_prefix
  22 #define dout_prefix *_dout << "cephx keyserverdata: "
  23
  24 bool KeyServerData::get_service_secret(CephContext *cct, uint32_t service_id,
  25                             ExpiringCryptoKey& secret, uint64_t& secret_id) const
  26 {
  27   map<uint32_t, RotatingSecrets>::const_iterator iter =
  28         rotating_secrets.find(service_id);
  29   if (iter == rotating_secrets.end()) {
  30     ldout(cct, 10) << "get_service_secret service " << ceph_entity_type_name(service_id) << " not found " << dendl;
  31     return false;
  32   }
  33
  34   const RotatingSecrets& secrets = iter->second;
  35
  36   // second to oldest, unless it's expired
  37   map<uint64_t, ExpiringCryptoKey>::const_iterator riter =
  38         secrets.secrets.begin();
  39   if (secrets.secrets.size() > 1)
  40     ++riter;
  41
  42   if (riter->second.expiration < ceph_clock_now())
  43     ++riter;   // "current" key has expired, use "next" key instead
  44
  45   secret_id = riter->first;
  46   secret = riter->second;
  47   ldout(cct, 30) << "get_service_secret service " << ceph_entity_type_name(service_id)
  48            << " id " << secret_id << " " << secret << dendl;
  49   return true;
  50 }
  51
  52 bool KeyServerData::get_service_secret(CephContext *cct, uint32_t service_id,
  53                                 CryptoKey& secret, uint64_t& secret_id) const
  54 {
  55   ExpiringCryptoKey e;
  56
  57   if (!get_service_secret(cct, service_id, e, secret_id))
  58     return false;
  59
  60   secret = e.key;
  61   return true;
  62 }
  63
  64 bool KeyServerData::get_service_secret(CephContext *cct, uint32_t service_id,
  65                                 uint64_t secret_id, CryptoKey& secret) const
  66 {
  67   map<uint32_t, RotatingSecrets>::const_iterator iter =
  68       rotating_secrets.find(service_id);
  69   if (iter == rotating_secrets.end())
  70     return false;
  71
  72   const RotatingSecrets& secrets = iter->second;
  73   map<uint64_t, ExpiringCryptoKey>::const_iterator riter =
  74       secrets.secrets.find(secret_id);
  75
  76   if (riter == secrets.secrets.end()) {
  77     ldout(cct, 10) << "get_service_secret service " << ceph_entity_type_name(service_id)
  78              << " secret " << secret_id << " not found" << dendl;
  79     ldout(cct, 30) << " I have:" << dendl;
  80     for (map<uint64_t, ExpiringCryptoKey>::const_iterator iter =
  81              secrets.secrets.begin();
  82         iter != secrets.secrets.end();
  83         ++iter)
  84       ldout(cct, 30) << " id " << iter->first << " " << iter->second << dendl;
  85     return false;
  86   }
  87
  88   secret = riter->second.key;
  89
  90   return true;
  91 }
  92 bool KeyServerData::get_auth(const EntityName& name, EntityAuth& auth) const {
  93   map<EntityName, EntityAuth>::const_iterator iter = secrets.find(name);
  94   if (iter != secrets.end()) {
  95     auth = iter->second;
  96     return true;
  97   }
  98   return extra_secrets->get_auth(name, auth);
  99 }
 100
 101 bool KeyServerData::get_secret(const EntityName& name, CryptoKey& secret) const {
 102   map<EntityName, EntityAuth>::const_iterator iter = secrets.find(name);
 103   if (iter != secrets.end()) {
 104     secret = iter->second.key;
 105     return true;
 106   }
 107   return extra_secrets->get_secret(name, secret);
 108 }
 109
 110 bool KeyServerData::get_caps(CephContext *cct, const EntityName& name,
 111                              const string& type, AuthCapsInfo& caps_info) const
 112 {
 113   caps_info.allow_all = false;
 114
 115   ldout(cct, 10) << "get_caps: name=" << name.to_str() << dendl;
 116   map<EntityName, EntityAuth>::const_iterator iter = secrets.find(name);
 117   if (iter != secrets.end()) {
 118     ldout(cct, 10) << "get_secret: num of caps=" << iter->second.caps.size() << dendl;
 119     map<string, bufferlist>::const_iterator capsiter = iter->second.caps.find(type);
 120     if (capsiter != iter->second.caps.end()) {
 121       caps_info.caps = capsiter->second;
 122     }
 123     return true;
 124   }
 125
 126   return extra_secrets->get_caps(name, type, caps_info);
 127 }
 128
 129
 130 #undef dout_prefix
 131 #define dout_prefix *_dout << "cephx keyserver: "
 132
 133
 134 KeyServer::KeyServer(CephContext *cct_, KeyRing *extra_secrets)
 135   : cct(cct_),
 136     data(extra_secrets),
 137     lock{ceph::make_mutex("KeyServer::lock")}
 138 {
 139 }
 140
 141 int KeyServer::start_server()
 142 {
 143   std::scoped_lock l{lock};
 144
 145   _check_rotating_secrets();
 146   _dump_rotating_secrets();
 147   return 0;
 148 }
 149
 150 bool KeyServer::_check_rotating_secrets()
 151 {
 152   ldout(cct, 10) << "_check_rotating_secrets" << dendl;
 153
 154   int added = 0;
 155   added += _rotate_secret(CEPH_ENTITY_TYPE_AUTH);
 156   added += _rotate_secret(CEPH_ENTITY_TYPE_MON);
 157   added += _rotate_secret(CEPH_ENTITY_TYPE_OSD);
 158   added += _rotate_secret(CEPH_ENTITY_TYPE_MDS);
 159   added += _rotate_secret(CEPH_ENTITY_TYPE_MGR);
 160
 161   if (added) {
 162     ldout(cct, 10) << __func__ << " added " << added << dendl;
 163     data.rotating_ver++;
 164     //data.next_rotating_time = ceph_clock_now(cct);
 165     //data.next_rotating_time += std::min(cct->_conf->auth_mon_ticket_ttl, cct->_conf->auth_service_ticket_ttl);
 166     _dump_rotating_secrets();
 167     return true;
 168   }
 169   return false;
 170 }
 171
 172 void KeyServer::_dump_rotating_secrets()
 173 {
 174   ldout(cct, 30) << "_dump_rotating_secrets" << dendl;
 175   for (map<uint32_t, RotatingSecrets>::iterator iter = data.rotating_secrets.begin();
 176        iter != data.rotating_secrets.end();
 177        ++iter) {
 178     RotatingSecrets& key = iter->second;
 179     for (map<uint64_t, ExpiringCryptoKey>::iterator mapiter = key.secrets.begin();
 180          mapiter != key.secrets.end();
 181          ++mapiter)
 182       ldout(cct, 30) << "service " << ceph_entity_type_name(iter->first)
 183                      << " id " << mapiter->first
 184                      << " key " << mapiter->second << dendl;
 185   }
 186 }
 187
 188 int KeyServer::_rotate_secret(uint32_t service_id)
 189 {
 190   RotatingSecrets& r = data.rotating_secrets[service_id];
 191   int added = 0;
 192   utime_t now = ceph_clock_now();
 193   double ttl = service_id == CEPH_ENTITY_TYPE_AUTH ? cct->_conf->auth_mon_ticket_ttl : cct->_conf->auth_service_ticket_ttl;
 194
 195   while (r.need_new_secrets(now)) {
 196     ExpiringCryptoKey ek;
 197     generate_secret(ek.key);
 198     if (r.empty()) {
 199       ek.expiration = now;
 200     } else {
 201       utime_t next_ttl = now;
 202       next_ttl += ttl;
 203       ek.expiration = std::max(next_ttl, r.next().expiration);
 204     }
 205     ek.expiration += ttl;
 206     uint64_t secret_id = r.add(ek);
 207     ldout(cct, 10) << "_rotate_secret adding " << ceph_entity_type_name(service_id) << dendl;
 208     ldout(cct, 30) << "_rotate_secret adding " << ceph_entity_type_name(service_id)
 209                    << " id " << secret_id << " " << ek
 210                    << dendl;
 211     added++;
 212   }
 213   return added;
 214 }
 215
 216 bool KeyServer::get_secret(const EntityName& name, CryptoKey& secret) const
 217 {
 218   std::scoped_lock l{lock};
 219   return data.get_secret(name, secret);
 220 }
 221
 222 bool KeyServer::get_auth(const EntityName& name, EntityAuth& auth) const
 223 {
 224   std::scoped_lock l{lock};
 225   return data.get_auth(name, auth);
 226 }
 227
 228 bool KeyServer::get_caps(const EntityName& name, const string& type,
 229               AuthCapsInfo& caps_info) const
 230 {
 231   std::scoped_lock l{lock};
 232
 233   return data.get_caps(cct, name, type, caps_info);
 234 }
 235
 236 bool KeyServer::get_service_secret(uint32_t service_id,
 237                 CryptoKey& secret, uint64_t& secret_id) const
 238 {
 239   std::scoped_lock l{lock};
 240
 241   return data.get_service_secret(cct, service_id, secret, secret_id);
 242 }
 243
 244 bool KeyServer::get_service_secret(uint32_t service_id,
 245                 uint64_t secret_id, CryptoKey& secret) const
 246 {
 247   std::scoped_lock l{lock};
 248
 249   return data.get_service_secret(cct, service_id, secret_id, secret);
 250 }
 251
 252 bool KeyServer::generate_secret(CryptoKey& secret)
 253 {
 254   bufferptr bp;
 255   CryptoHandler *crypto = cct->get_crypto_handler(CEPH_CRYPTO_AES);
 256   if (!crypto)
 257     return false;
 258
 259   if (crypto->create(cct->random(), bp) < 0)
 260     return false;
 261
 262   secret.set_secret(CEPH_CRYPTO_AES, bp, ceph_clock_now());
 263
 264   return true;
 265 }
 266
 267 bool KeyServer::generate_secret(EntityName& name, CryptoKey& secret)
 268 {
 269   if (!generate_secret(secret))
 270     return false;
 271
 272   std::scoped_lock l{lock};
 273
 274   EntityAuth auth;
 275   auth.key = secret;
 276
 277   data.add_auth(name, auth);
 278
 279   return true;
 280 }
 281
 282 bool KeyServer::contains(const EntityName& name) const
 283 {
 284   std::scoped_lock l{lock};
 285
 286   return data.contains(name);
 287 }
 288
 289 int KeyServer::encode_secrets(Formatter *f, stringstream *ds) const
 290 {
 291   std::scoped_lock l{lock};
 292   map<EntityName, EntityAuth>::const_iterator mapiter = data.secrets_begin();
 293
 294   if (mapiter == data.secrets_end())
 295     return -ENOENT;
 296
 297   if (f)
 298     f->open_array_section("auth_dump");
 299
 300   while (mapiter != data.secrets_end()) {
 301     const EntityName& name = mapiter->first;
 302     if (ds) {
 303       *ds << name.to_str() << std::endl;
 304       *ds << "\tkey: " << mapiter->second.key << std::endl;
 305     }
 306     if (f) {
 307       f->open_object_section("auth_entities");
 308       f->dump_string("entity", name.to_str());
 309       f->dump_stream("key") << mapiter->second.key;
 310       f->open_object_section("caps");
 311     }
 312
 313     map<string, bufferlist>::const_iterator capsiter =
 314         mapiter->second.caps.begin();
 315     for (; capsiter != mapiter->second.caps.end(); ++capsiter) {
 316       // FIXME: need a const_iterator for bufferlist, but it doesn't exist yet.
 317       bufferlist *bl = const_cast<bufferlist*>(&capsiter->second);
 318       auto dataiter = bl->cbegin();
 319       string caps;
 320       using ceph::decode;
 321       decode(caps, dataiter);
 322       if (ds)
 323         *ds << "\tcaps: [" << capsiter->first << "] " << caps << std::endl;
 324       if (f)
 325         f->dump_string(capsiter->first.c_str(), caps);
 326     }
 327     if (f) {
 328       f->close_section(); // caps
 329       f->close_section(); // auth_entities
 330     }
 331
 332     ++mapiter;
 333   }
 334
 335   if (f)
 336     f->close_section(); // auth_dump
 337   return 0;
 338 }
 339
 340 void KeyServer::encode_formatted(string label, Formatter *f, bufferlist &bl)
 341 {
 342   ceph_assert(f != NULL);
 343   f->open_object_section(label.c_str());
 344   encode_secrets(f, NULL);
 345   f->close_section();
 346   f->flush(bl);
 347 }
 348
 349 void KeyServer::encode_plaintext(bufferlist &bl)
 350 {
 351   stringstream os;
 352   encode_secrets(NULL, &os);
 353   bl.append(os.str());
 354 }
 355
 356 bool KeyServer::updated_rotating(bufferlist& rotating_bl, version_t& rotating_ver)
 357 {
 358   std::scoped_lock l{lock};
 359
 360   _check_rotating_secrets();
 361
 362   if (data.rotating_ver <= rotating_ver)
 363     return false;
 364
 365   data.encode_rotating(rotating_bl);
 366
 367   rotating_ver = data.rotating_ver;
 368
 369   return true;
 370 }
 371
 372 bool KeyServer::get_rotating_encrypted(const EntityName& name,
 373         bufferlist& enc_bl) const
 374 {
 375   std::scoped_lock l{lock};
 376
 377   map<EntityName, EntityAuth>::const_iterator mapiter = data.find_name(name);
 378   if (mapiter == data.secrets_end())
 379     return false;
 380
 381   const CryptoKey& specific_key = mapiter->second.key;
 382
 383   map<uint32_t, RotatingSecrets>::const_iterator rotate_iter =
 384     data.rotating_secrets.find(name.get_type());
 385   if (rotate_iter == data.rotating_secrets.end())
 386     return false;
 387
 388   RotatingSecrets secrets = rotate_iter->second;
 389
 390   std::string error;
 391   if (encode_encrypt(cct, secrets, specific_key, enc_bl, error))
 392     return false;
 393
 394   return true;
 395 }
 396
 397 bool KeyServer::_get_service_caps(const EntityName& name, uint32_t service_id,
 398                                   AuthCapsInfo& caps_info) const
 399 {
 400   string s = ceph_entity_type_name(service_id);
 401
 402   return data.get_caps(cct, name, s, caps_info);
 403 }
 404
 405 bool KeyServer::get_service_caps(const EntityName& name, uint32_t service_id,
 406                                  AuthCapsInfo& caps_info) const
 407 {
 408   std::scoped_lock l{lock};
 409   return _get_service_caps(name, service_id, caps_info);
 410 }
 411
 412
 413 int KeyServer::_build_session_auth_info(uint32_t service_id,
 414                                         const AuthTicket& parent_ticket,
 415                                         CephXSessionAuthInfo& info)
 416 {
 417   info.service_id = service_id;
 418   info.ticket = parent_ticket;
 419   info.ticket.init_timestamps(ceph_clock_now(),
 420                               cct->_conf->auth_service_ticket_ttl);
 421
 422   generate_secret(info.session_key);
 423
 424   // mon keys are stored externally.  and the caps are blank anyway.
 425   if (service_id != CEPH_ENTITY_TYPE_MON) {
 426     string s = ceph_entity_type_name(service_id);
 427     if (!data.get_caps(cct, info.ticket.name, s, info.ticket.caps)) {
 428       return -EINVAL;
 429     }
 430   }
 431   return 0;
 432 }
 433
 434 int KeyServer::build_session_auth_info(uint32_t service_id,
 435                                        const AuthTicket& parent_ticket,
 436                                        CephXSessionAuthInfo& info)
 437 {
 438   if (!get_service_secret(service_id, info.service_secret, info.secret_id)) {
 439     return -EACCES;
 440   }
 441
 442   std::scoped_lock l{lock};
 443
 444   return _build_session_auth_info(service_id, parent_ticket, info);
 445 }
 446
 447 int KeyServer::build_session_auth_info(uint32_t service_id,
 448                                        const AuthTicket& parent_ticket,
 449                                        CephXSessionAuthInfo& info,
 450                                        CryptoKey& service_secret,
 451                                        uint64_t secret_id)
 452 {
 453   info.service_secret = service_secret;
 454   info.secret_id = secret_id;
 455
 456   std::scoped_lock l{lock};
 457   return _build_session_auth_info(service_id, parent_ticket, info);
 458 }
 459