auth.h 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. #ifndef _FS_CEPH_AUTH_H
  3. #define _FS_CEPH_AUTH_H
  4. #include <linux/ceph/types.h>
  5. #include <linux/ceph/buffer.h>
  6. /*
  7. * Abstract interface for communicating with the authenticate module.
  8. * There is some handshake that takes place between us and the monitor
  9. * to acquire the necessary keys. These are used to generate an
  10. * 'authorizer' that we use when connecting to a service (mds, osd).
  11. */
  12. struct ceph_auth_client;
  13. struct ceph_msg;
  14. struct ceph_authorizer {
  15. void (*destroy)(struct ceph_authorizer *);
  16. };
  17. struct ceph_auth_handshake {
  18. struct ceph_authorizer *authorizer;
  19. void *authorizer_buf;
  20. size_t authorizer_buf_len;
  21. void *authorizer_reply_buf;
  22. size_t authorizer_reply_buf_len;
  23. int (*sign_message)(struct ceph_auth_handshake *auth,
  24. struct ceph_msg *msg);
  25. int (*check_message_signature)(struct ceph_auth_handshake *auth,
  26. struct ceph_msg *msg);
  27. };
  28. struct ceph_auth_client_ops {
  29. const char *name;
  30. /*
  31. * true if we are authenticated and can connect to
  32. * services.
  33. */
  34. int (*is_authenticated)(struct ceph_auth_client *ac);
  35. /*
  36. * true if we should (re)authenticate, e.g., when our tickets
  37. * are getting old and crusty.
  38. */
  39. int (*should_authenticate)(struct ceph_auth_client *ac);
  40. /*
  41. * build requests and process replies during monitor
  42. * handshake. if handle_reply returns -EAGAIN, we build
  43. * another request.
  44. */
  45. int (*build_request)(struct ceph_auth_client *ac, void *buf, void *end);
  46. int (*handle_reply)(struct ceph_auth_client *ac, int result,
  47. void *buf, void *end);
  48. /*
  49. * Create authorizer for connecting to a service, and verify
  50. * the response to authenticate the service.
  51. */
  52. int (*create_authorizer)(struct ceph_auth_client *ac, int peer_type,
  53. struct ceph_auth_handshake *auth);
  54. /* ensure that an existing authorizer is up to date */
  55. int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type,
  56. struct ceph_auth_handshake *auth);
  57. int (*add_authorizer_challenge)(struct ceph_auth_client *ac,
  58. struct ceph_authorizer *a,
  59. void *challenge_buf,
  60. int challenge_buf_len);
  61. int (*verify_authorizer_reply)(struct ceph_auth_client *ac,
  62. struct ceph_authorizer *a);
  63. void (*invalidate_authorizer)(struct ceph_auth_client *ac,
  64. int peer_type);
  65. /* reset when we (re)connect to a monitor */
  66. void (*reset)(struct ceph_auth_client *ac);
  67. void (*destroy)(struct ceph_auth_client *ac);
  68. int (*sign_message)(struct ceph_auth_handshake *auth,
  69. struct ceph_msg *msg);
  70. int (*check_message_signature)(struct ceph_auth_handshake *auth,
  71. struct ceph_msg *msg);
  72. };
  73. struct ceph_auth_client {
  74. u32 protocol; /* CEPH_AUTH_* */
  75. void *private; /* for use by protocol implementation */
  76. const struct ceph_auth_client_ops *ops; /* null iff protocol==0 */
  77. bool negotiating; /* true if negotiating protocol */
  78. const char *name; /* entity name */
  79. u64 global_id; /* our unique id in system */
  80. const struct ceph_crypto_key *key; /* our secret key */
  81. unsigned want_keys; /* which services we want */
  82. struct mutex mutex;
  83. };
  84. extern struct ceph_auth_client *ceph_auth_init(const char *name,
  85. const struct ceph_crypto_key *key);
  86. extern void ceph_auth_destroy(struct ceph_auth_client *ac);
  87. extern void ceph_auth_reset(struct ceph_auth_client *ac);
  88. extern int ceph_auth_build_hello(struct ceph_auth_client *ac,
  89. void *buf, size_t len);
  90. extern int ceph_handle_auth_reply(struct ceph_auth_client *ac,
  91. void *buf, size_t len,
  92. void *reply_buf, size_t reply_len);
  93. int ceph_auth_entity_name_encode(const char *name, void **p, void *end);
  94. extern int ceph_build_auth(struct ceph_auth_client *ac,
  95. void *msg_buf, size_t msg_len);
  96. extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac);
  97. extern int ceph_auth_create_authorizer(struct ceph_auth_client *ac,
  98. int peer_type,
  99. struct ceph_auth_handshake *auth);
  100. void ceph_auth_destroy_authorizer(struct ceph_authorizer *a);
  101. extern int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
  102. int peer_type,
  103. struct ceph_auth_handshake *a);
  104. int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac,
  105. struct ceph_authorizer *a,
  106. void *challenge_buf,
  107. int challenge_buf_len);
  108. extern int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
  109. struct ceph_authorizer *a);
  110. extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac,
  111. int peer_type);
  112. static inline int ceph_auth_sign_message(struct ceph_auth_handshake *auth,
  113. struct ceph_msg *msg)
  114. {
  115. if (auth->sign_message)
  116. return auth->sign_message(auth, msg);
  117. return 0;
  118. }
  119. static inline
  120. int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth,
  121. struct ceph_msg *msg)
  122. {
  123. if (auth->check_message_signature)
  124. return auth->check_message_signature(auth, msg);
  125. return 0;
  126. }
  127. #endif