Commit cd1a677c authored by Ilya Dryomov's avatar Ilya Dryomov
Browse files

libceph, ceph: implement msgr2.1 protocol (crc and secure modes) 



Implement msgr2.1 wire protocol, available since nautilus 14.2.11
and octopus 15.2.5.  msgr2.0 wire protocol is not implemented -- it
has several security, integrity and robustness issues and therefore
considered deprecated.

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 00498b99

fs/ceph/mds_client.c

+79 −1
Original line number Diff line number Diff line
@@ -5014,7 +5014,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg) 
		return;

	}



	newmap = ceph_mdsmap_decode(&p, end, false);

	newmap = ceph_mdsmap_decode(&p, end, ceph_msgr2(mdsc->fsc->client));

	if (IS_ERR(newmap)) {

		err = PTR_ERR(newmap);

		goto bad_unlock;
@@ -5196,6 +5196,80 @@ static int invalidate_authorizer(struct ceph_connection *con) 
	return ceph_monc_validate_auth(&mdsc->fsc->client->monc);

}



static int mds_get_auth_request(struct ceph_connection *con,

				void *buf, int *buf_len,

				void **authorizer, int *authorizer_len)

{

	struct ceph_mds_session *s = con->private;

	struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;

	struct ceph_auth_handshake *auth = &s->s_auth;

	int ret;



	ret = ceph_auth_get_authorizer(ac, auth, CEPH_ENTITY_TYPE_MDS,

				       buf, buf_len);

	if (ret)

		return ret;



	*authorizer = auth->authorizer_buf;

	*authorizer_len = auth->authorizer_buf_len;

	return 0;

}



static int mds_handle_auth_reply_more(struct ceph_connection *con,

				      void *reply, int reply_len,

				      void *buf, int *buf_len,

				      void **authorizer, int *authorizer_len)

{

	struct ceph_mds_session *s = con->private;

	struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;

	struct ceph_auth_handshake *auth = &s->s_auth;

	int ret;



	ret = ceph_auth_handle_svc_reply_more(ac, auth, reply, reply_len,

					      buf, buf_len);

	if (ret)

		return ret;



	*authorizer = auth->authorizer_buf;

	*authorizer_len = auth->authorizer_buf_len;

	return 0;

}



static int mds_handle_auth_done(struct ceph_connection *con,

				u64 global_id, void *reply, int reply_len,

				u8 *session_key, int *session_key_len,

				u8 *con_secret, int *con_secret_len)

{

	struct ceph_mds_session *s = con->private;

	struct ceph_auth_client *ac = s->s_mdsc->fsc->client->monc.auth;

	struct ceph_auth_handshake *auth = &s->s_auth;



	return ceph_auth_handle_svc_reply_done(ac, auth, reply, reply_len,

					       session_key, session_key_len,

					       con_secret, con_secret_len);

}



static int mds_handle_auth_bad_method(struct ceph_connection *con,

				      int used_proto, int result,

				      const int *allowed_protos, int proto_cnt,

				      const int *allowed_modes, int mode_cnt)

{

	struct ceph_mds_session *s = con->private;

	struct ceph_mon_client *monc = &s->s_mdsc->fsc->client->monc;

	int ret;



	if (ceph_auth_handle_bad_authorizer(monc->auth, CEPH_ENTITY_TYPE_MDS,

					    used_proto, result,

					    allowed_protos, proto_cnt,

					    allowed_modes, mode_cnt)) {

		ret = ceph_monc_validate_auth(monc);

		if (ret)

			return ret;

	}



	return -EACCES;

}



static struct ceph_msg *mds_alloc_msg(struct ceph_connection *con,

				struct ceph_msg_header *hdr, int *skip)

{
@@ -5245,6 +5319,10 @@ static const struct ceph_connection_operations mds_con_ops = { 
	.alloc_msg = mds_alloc_msg,

	.sign_message = mds_sign_message,

	.check_message_signature = mds_check_message_signature,

	.get_auth_request = mds_get_auth_request,

	.handle_auth_reply_more = mds_handle_auth_reply_more,

	.handle_auth_done = mds_handle_auth_done,

	.handle_auth_bad_method = mds_handle_auth_bad_method,

};



/* eof */

include/linux/ceph/auth.h

+35 −1
Original line number Diff line number Diff line
@@ -120,8 +120,12 @@ int ceph_auth_entity_name_encode(const char *name, void **p, void *end); 


extern int ceph_build_auth(struct ceph_auth_client *ac,

		    void *msg_buf, size_t msg_len);



extern int ceph_auth_is_authenticated(struct ceph_auth_client *ac);



int __ceph_auth_get_authorizer(struct ceph_auth_client *ac,

			       struct ceph_auth_handshake *auth,

			       int peer_type, bool force_new,

			       int *proto, int *pref_mode, int *fallb_mode);

extern int ceph_auth_create_authorizer(struct ceph_auth_client *ac,

				       int peer_type,

				       struct ceph_auth_handshake *auth);
@@ -157,4 +161,34 @@ int ceph_auth_check_message_signature(struct ceph_auth_handshake *auth, 
		return auth->check_message_signature(auth, msg);

	return 0;

}



int ceph_auth_get_request(struct ceph_auth_client *ac, void *buf, int buf_len);

int ceph_auth_handle_reply_more(struct ceph_auth_client *ac, void *reply,

				int reply_len, void *buf, int buf_len);

int ceph_auth_handle_reply_done(struct ceph_auth_client *ac,

				u64 global_id, void *reply, int reply_len,

				u8 *session_key, int *session_key_len,

				u8 *con_secret, int *con_secret_len);

bool ceph_auth_handle_bad_method(struct ceph_auth_client *ac,

				 int used_proto, int result,

				 const int *allowed_protos, int proto_cnt,

				 const int *allowed_modes, int mode_cnt);



int ceph_auth_get_authorizer(struct ceph_auth_client *ac,

			     struct ceph_auth_handshake *auth,

			     int peer_type, void *buf, int *buf_len);

int ceph_auth_handle_svc_reply_more(struct ceph_auth_client *ac,

				    struct ceph_auth_handshake *auth,

				    void *reply, int reply_len,

				    void *buf, int *buf_len);

int ceph_auth_handle_svc_reply_done(struct ceph_auth_client *ac,

				    struct ceph_auth_handshake *auth,

				    void *reply, int reply_len,

				    u8 *session_key, int *session_key_len,

				    u8 *con_secret, int *con_secret_len);

bool ceph_auth_handle_bad_authorizer(struct ceph_auth_client *ac,

				     int peer_type, int used_proto, int result,

				     const int *allowed_protos, int proto_cnt,

				     const int *allowed_modes, int mode_cnt);



#endif

include/linux/ceph/ceph_fs.h

+4 −0
Original line number Diff line number Diff line
@@ -93,6 +93,10 @@ struct ceph_dir_layout { 
#define CEPH_AUTH_NONE	 	0x1

#define CEPH_AUTH_CEPHX	 	0x2



#define CEPH_AUTH_MODE_NONE		0

#define CEPH_AUTH_MODE_AUTHORIZER	1

#define CEPH_AUTH_MODE_MON		10



/* msgr2 protocol modes */

#define CEPH_CON_MODE_UNKNOWN	0x0

#define CEPH_CON_MODE_CRC	0x1

include/linux/ceph/decode.h

+4 −0
Original line number Diff line number Diff line
@@ -221,6 +221,7 @@ static inline void ceph_encode_timespec64(struct ceph_timespec *tv, 
#define CEPH_ENTITY_ADDR_TYPE_NONE	0

#define CEPH_ENTITY_ADDR_TYPE_LEGACY	__cpu_to_le32(1)

#define CEPH_ENTITY_ADDR_TYPE_MSGR2	__cpu_to_le32(2)

#define CEPH_ENTITY_ADDR_TYPE_ANY	__cpu_to_le32(3)



static inline void ceph_encode_banner_addr(struct ceph_entity_addr *a)

{
@@ -243,6 +244,9 @@ extern int ceph_decode_entity_addr(void **p, void *end, 
int ceph_decode_entity_addrvec(void **p, void *end, bool msgr2,

			       struct ceph_entity_addr *addr);



int ceph_entity_addr_encoding_len(const struct ceph_entity_addr *addr);

void ceph_encode_entity_addr(void **p, const struct ceph_entity_addr *addr);



/*

 * encoders

 */

include/linux/ceph/libceph.h

+7 −2
Original line number Diff line number Diff line
@@ -31,10 +31,10 @@ 
#define CEPH_OPT_FSID             (1<<0)

#define CEPH_OPT_NOSHARE          (1<<1) /* don't share client with other sbs */

#define CEPH_OPT_MYIP             (1<<2) /* specified my ip */

#define CEPH_OPT_NOCRC            (1<<3) /* no data crc on writes */

#define CEPH_OPT_NOCRC            (1<<3) /* no data crc on writes (msgr1) */

#define CEPH_OPT_NOMSGAUTH	  (1<<4) /* don't require msg signing feat */

#define CEPH_OPT_TCP_NODELAY	  (1<<5) /* TCP_NODELAY on TCP sockets */

#define CEPH_OPT_NOMSGSIGN	  (1<<6) /* don't sign msgs */

#define CEPH_OPT_NOMSGSIGN	  (1<<6) /* don't sign msgs (msgr1) */

#define CEPH_OPT_ABORT_ON_FULL	  (1<<7) /* abort w/ ENOSPC when full */



#define CEPH_OPT_DEFAULT   (CEPH_OPT_TCP_NODELAY)
@@ -84,6 +84,7 @@ struct ceph_options { 
#define CEPH_MONC_HUNT_BACKOFF		2

#define CEPH_MONC_HUNT_MAX_MULT		10



#define CEPH_MSG_MAX_CONTROL_LEN (16*1024*1024)

#define CEPH_MSG_MAX_FRONT_LEN	(16*1024*1024)

#define CEPH_MSG_MAX_MIDDLE_LEN	(16*1024*1024)
@@ -152,6 +153,10 @@ struct ceph_client { 


#define from_msgr(ms)	container_of(ms, struct ceph_client, msgr)



static inline bool ceph_msgr2(struct ceph_client *client)

{

	return client->options->con_modes[0] != CEPH_CON_MODE_UNKNOWN;

}



/*

 * snapshots