4 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 only,
8 * as published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * General Public License version 2 for more details (a copy is included
14 * in the LICENSE file that accompanied this code).
16 * You should have received a copy of the GNU General Public License
17 * version 2 along with this program; If not, see
18 * http://www.gnu.org/licenses/gpl-2.0.html
23 * Copyright (C) 2015, Trustees of Indiana University
25 * Author: Jeremy Filizetti <jfilizet@iu.edu>
31 #include <gssapi/gssapi.h>
33 #include <lustre/lustre_idl.h>
34 #include <openssl/dh.h>
35 #include <openssl/evp.h>
36 #include <sys/types.h>
38 #include <libcfs/libcfs_crypto.h>
41 /* Some limits and defaults */
42 #define SK_CONF_VERSION 1
43 #define SK_MSG_VERSION 1
44 #define SK_GENERATOR 2
45 #define SK_SESSION_MAX_KEYLEN_BYTES 1024
46 #define SK_MAX_KEYLEN_BYTES 128
47 #define SK_MAX_P_BYTES 2048
48 #define SK_NONCE_SIZE 4
49 #define MAX_MGSNIDS 16
51 enum sk_ctx_init_buffers {
52 /* Initiator netstring buffer ordering */
63 /* Responder netstring buffer ordering */
71 #define SK_HMAC_INVALID 0xFF
73 /* String consisting of "lustre:fsname:nodemap_hash" */
74 #define SK_DESCRIPTION_SIZE (9 + MTI_NAME_MAXLEN + LUSTRE_NODEMAP_NAME_LENGTH)
77 SK_TYPE_INVALID = 0x0,
83 /* This is the packed structure format of key files that are distributed.
84 * The on disk format should be store in big-endian. */
85 struct sk_keyfile_config {
86 /* File format version */
88 /* HMAC algorithm used for message integrity */
89 enum cfs_crypto_hash_alg skc_hmac_alg;
90 /* Crypt algorithm used for privacy mode */
91 uint16_t skc_crypt_alg;
92 /* Number of seconds that a context is valid after it is created from
95 /* Length of shared key in skc_shared_key */
96 uint32_t skc_shared_keylen;
97 /* Length of the prime used in the DHKE */
98 uint32_t skc_prime_bits;
101 /* Array of MGS NIDs to load key's for. This is for the client since
102 * the upcall only knows the target name which is MGC<IP>@<NET>
103 * Only needed when mounting with mgssec */
104 lnet_nid_t skc_mgsnids[MAX_MGSNIDS];
105 /* File system name for this key. It can be unused for MGS only keys */
106 char skc_fsname[MTI_NAME_MAXLEN + 1];
107 /* Nodemap name for this key. Used by the server side to verify the
108 * client is in the correct nodemap */
109 char skc_nodemap[LUSTRE_NODEMAP_NAME_LENGTH + 1];
111 unsigned char skc_shared_key[SK_MAX_KEYLEN_BYTES];
112 /* Prime (p) for DHKE */
113 unsigned char skc_p[SK_MAX_P_BYTES];
114 } __attribute__((packed));
116 /* Format passed to the kernel from userspace */
117 struct sk_kernel_ctx {
118 uint32_t skc_version;
119 uint16_t skc_hmac_alg;
120 uint16_t skc_crypt_alg;
122 uint32_t skc_host_random;
123 uint32_t skc_peer_random;
124 gss_buffer_desc skc_hmac_key;
125 gss_buffer_desc skc_encrypt_key;
126 gss_buffer_desc skc_shared_key;
127 gss_buffer_desc skc_session_key;
130 /* Structure used in context initiation to hold all necessary data */
133 gss_buffer_desc sc_p;
134 gss_buffer_desc sc_pub_key;
135 gss_buffer_desc sc_tgt;
136 gss_buffer_desc sc_nodemap_hash;
137 gss_buffer_desc sc_hmac;
138 gss_buffer_desc sc_dh_shared_key;
139 struct sk_kernel_ctx sc_kctx;
143 void sk_init_logging(char *program, int verbose, int fg);
144 struct sk_keyfile_config *sk_read_file(char *filename);
145 int sk_load_keyfile(char *path);
146 void sk_config_disk_to_cpu(struct sk_keyfile_config *config);
147 void sk_config_cpu_to_disk(struct sk_keyfile_config *config);
148 int sk_validate_config(const struct sk_keyfile_config *config);
149 uint32_t sk_verify_hash(const char *string, const EVP_MD *hash_alg,
150 const gss_buffer_desc *current_hash);
151 struct sk_cred *sk_create_cred(const char *fsname, const char *cluster,
152 const uint32_t flags);
153 uint32_t sk_gen_params(struct sk_cred *skc);
154 int sk_sign_bufs(gss_buffer_desc *key, gss_buffer_desc *bufs, const int numbufs,
155 const EVP_MD *hash_alg, gss_buffer_desc *hmac);
156 uint32_t sk_verify_hmac(struct sk_cred *skc, gss_buffer_desc *bufs,
157 const int numbufs, const EVP_MD *hash_alg,
158 gss_buffer_desc *hmac);
159 void sk_free_cred(struct sk_cred *skc);
160 int sk_session_kdf(struct sk_cred *skc, lnet_nid_t client_nid,
161 gss_buffer_desc *client_token, gss_buffer_desc *server_token);
162 uint32_t sk_compute_dh_key(struct sk_cred *skc, const gss_buffer_desc *pub_key);
163 int sk_compute_keys(struct sk_cred *skc);
164 int sk_serialize_kctx(struct sk_cred *skc, gss_buffer_desc *ctx_token);
165 int sk_decode_netstring(gss_buffer_desc *bufs, int numbufs,
166 gss_buffer_desc *ns);
167 int sk_encode_netstring(gss_buffer_desc *bufs, int numbufs,
168 gss_buffer_desc *ns);
170 #endif /* SK_UTILS_H */