1 2 #include <linux/ceph/ceph_debug.h> 3 4 #include <linux/err.h> 5 #include <linux/module.h> 6 #include <linux/random.h> 7 #include <linux/slab.h> 8 9 #include <linux/ceph/decode.h> 10 #include <linux/ceph/auth.h> 11 12 #include "crypto.h" 13 #include "auth_x.h" 14 #include "auth_x_protocol.h" 15 16 static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed); 17 18 static int ceph_x_is_authenticated(struct ceph_auth_client *ac) 19 { 20 struct ceph_x_info *xi = ac->private; 21 int need; 22 23 ceph_x_validate_tickets(ac, &need); 24 dout("ceph_x_is_authenticated want=%d need=%d have=%d\n", 25 ac->want_keys, need, xi->have_keys); 26 return (ac->want_keys & xi->have_keys) == ac->want_keys; 27 } 28 29 static int ceph_x_should_authenticate(struct ceph_auth_client *ac) 30 { 31 struct ceph_x_info *xi = ac->private; 32 int need; 33 34 ceph_x_validate_tickets(ac, &need); 35 dout("ceph_x_should_authenticate want=%d need=%d have=%d\n", 36 ac->want_keys, need, xi->have_keys); 37 return need != 0; 38 } 39 40 static int ceph_x_encrypt_buflen(int ilen) 41 { 42 return sizeof(struct ceph_x_encrypt_header) + ilen + 16 + 43 sizeof(u32); 44 } 45 46 static int ceph_x_encrypt(struct ceph_crypto_key *secret, 47 void *ibuf, int ilen, void *obuf, size_t olen) 48 { 49 struct ceph_x_encrypt_header head = { 50 .struct_v = 1, 51 .magic = cpu_to_le64(CEPHX_ENC_MAGIC) 52 }; 53 size_t len = olen - sizeof(u32); 54 int ret; 55 56 ret = ceph_encrypt2(secret, obuf + sizeof(u32), &len, 57 &head, sizeof(head), ibuf, ilen); 58 if (ret) 59 return ret; 60 ceph_encode_32(&obuf, len); 61 return len + sizeof(u32); 62 } 63 64 static int ceph_x_decrypt(struct ceph_crypto_key *secret, 65 void **p, void *end, void **obuf, size_t olen) 66 { 67 struct ceph_x_encrypt_header head; 68 size_t head_len = sizeof(head); 69 int len, ret; 70 71 len = ceph_decode_32(p); 72 if (*p + len > end) 73 return -EINVAL; 74 75 dout("ceph_x_decrypt len %d\n", len); 76 if (*obuf == NULL) { 77 *obuf = kmalloc(len, GFP_NOFS); 78 if (!*obuf) 79 return -ENOMEM; 80 olen = len; 81 } 82 83 ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len); 84 if (ret) 85 return ret; 86 if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC) 87 return -EPERM; 88 *p += len; 89 return olen; 90 } 91 92 /* 93 * get existing (or insert new) ticket handler 94 */ 95 static struct ceph_x_ticket_handler * 96 get_ticket_handler(struct ceph_auth_client *ac, int service) 97 { 98 struct ceph_x_ticket_handler *th; 99 struct ceph_x_info *xi = ac->private; 100 struct rb_node *parent = NULL, **p = &xi->ticket_handlers.rb_node; 101 102 while (*p) { 103 parent = *p; 104 th = rb_entry(parent, struct ceph_x_ticket_handler, node); 105 if (service < th->service) 106 p = &(*p)->rb_left; 107 else if (service > th->service) 108 p = &(*p)->rb_right; 109 else 110 return th; 111 } 112 113 /* add it */ 114 th = kzalloc(sizeof(*th), GFP_NOFS); 115 if (!th) 116 return ERR_PTR(-ENOMEM); 117 th->service = service; 118 rb_link_node(&th->node, parent, p); 119 rb_insert_color(&th->node, &xi->ticket_handlers); 120 return th; 121 } 122 123 static void remove_ticket_handler(struct ceph_auth_client *ac, 124 struct ceph_x_ticket_handler *th) 125 { 126 struct ceph_x_info *xi = ac->private; 127 128 dout("remove_ticket_handler %p %d\n", th, th->service); 129 rb_erase(&th->node, &xi->ticket_handlers); 130 ceph_crypto_key_destroy(&th->session_key); 131 if (th->ticket_blob) 132 ceph_buffer_put(th->ticket_blob); 133 kfree(th); 134 } 135 136 static int process_one_ticket(struct ceph_auth_client *ac, 137 struct ceph_crypto_key *secret, 138 void **p, void *end) 139 { 140 struct ceph_x_info *xi = ac->private; 141 int type; 142 u8 tkt_struct_v, blob_struct_v; 143 struct ceph_x_ticket_handler *th; 144 void *dbuf = NULL; 145 void *dp, *dend; 146 int dlen; 147 char is_enc; 148 struct timespec validity; 149 struct ceph_crypto_key old_key; 150 void *ticket_buf = NULL; 151 void *tp, *tpend; 152 struct ceph_timespec new_validity; 153 struct ceph_crypto_key new_session_key; 154 struct ceph_buffer *new_ticket_blob; 155 unsigned long new_expires, new_renew_after; 156 u64 new_secret_id; 157 int ret; 158 159 ceph_decode_need(p, end, sizeof(u32) + 1, bad); 160 161 type = ceph_decode_32(p); 162 dout(" ticket type %d %s\n", type, ceph_entity_type_name(type)); 163 164 tkt_struct_v = ceph_decode_8(p); 165 if (tkt_struct_v != 1) 166 goto bad; 167 168 th = get_ticket_handler(ac, type); 169 if (IS_ERR(th)) { 170 ret = PTR_ERR(th); 171 goto out; 172 } 173 174 /* blob for me */ 175 dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0); 176 if (dlen <= 0) { 177 ret = dlen; 178 goto out; 179 } 180 dout(" decrypted %d bytes\n", dlen); 181 dp = dbuf; 182 dend = dp + dlen; 183 184 tkt_struct_v = ceph_decode_8(&dp); 185 if (tkt_struct_v != 1) 186 goto bad; 187 188 memcpy(&old_key, &th->session_key, sizeof(old_key)); 189 ret = ceph_crypto_key_decode(&new_session_key, &dp, dend); 190 if (ret) 191 goto out; 192 193 ceph_decode_copy(&dp, &new_validity, sizeof(new_validity)); 194 ceph_decode_timespec(&validity, &new_validity); 195 new_expires = get_seconds() + validity.tv_sec; 196 new_renew_after = new_expires - (validity.tv_sec / 4); 197 dout(" expires=%lu renew_after=%lu\n", new_expires, 198 new_renew_after); 199 200 /* ticket blob for service */ 201 ceph_decode_8_safe(p, end, is_enc, bad); 202 if (is_enc) { 203 /* encrypted */ 204 dout(" encrypted ticket\n"); 205 dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0); 206 if (dlen < 0) { 207 ret = dlen; 208 goto out; 209 } 210 tp = ticket_buf; 211 dlen = ceph_decode_32(&tp); 212 } else { 213 /* unencrypted */ 214 ceph_decode_32_safe(p, end, dlen, bad); 215 ticket_buf = kmalloc(dlen, GFP_NOFS); 216 if (!ticket_buf) { 217 ret = -ENOMEM; 218 goto out; 219 } 220 tp = ticket_buf; 221 ceph_decode_need(p, end, dlen, bad); 222 ceph_decode_copy(p, ticket_buf, dlen); 223 } 224 tpend = tp + dlen; 225 dout(" ticket blob is %d bytes\n", dlen); 226 ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad); 227 blob_struct_v = ceph_decode_8(&tp); 228 new_secret_id = ceph_decode_64(&tp); 229 ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend); 230 if (ret) 231 goto out; 232 233 /* all is well, update our ticket */ 234 ceph_crypto_key_destroy(&th->session_key); 235 if (th->ticket_blob) 236 ceph_buffer_put(th->ticket_blob); 237 th->session_key = new_session_key; 238 th->ticket_blob = new_ticket_blob; 239 th->validity = new_validity; 240 th->secret_id = new_secret_id; 241 th->expires = new_expires; 242 th->renew_after = new_renew_after; 243 dout(" got ticket service %d (%s) secret_id %lld len %d\n", 244 type, ceph_entity_type_name(type), th->secret_id, 245 (int)th->ticket_blob->vec.iov_len); 246 xi->have_keys |= th->service; 247 248 out: 249 kfree(ticket_buf); 250 kfree(dbuf); 251 return ret; 252 253 bad: 254 ret = -EINVAL; 255 goto out; 256 } 257 258 static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac, 259 struct ceph_crypto_key *secret, 260 void *buf, void *end) 261 { 262 void *p = buf; 263 u8 reply_struct_v; 264 u32 num; 265 int ret; 266 267 ceph_decode_8_safe(&p, end, reply_struct_v, bad); 268 if (reply_struct_v != 1) 269 return -EINVAL; 270 271 ceph_decode_32_safe(&p, end, num, bad); 272 dout("%d tickets\n", num); 273 274 while (num--) { 275 ret = process_one_ticket(ac, secret, &p, end); 276 if (ret) 277 return ret; 278 } 279 280 return 0; 281 282 bad: 283 return -EINVAL; 284 } 285 286 static int ceph_x_build_authorizer(struct ceph_auth_client *ac, 287 struct ceph_x_ticket_handler *th, 288 struct ceph_x_authorizer *au) 289 { 290 int maxlen; 291 struct ceph_x_authorize_a *msg_a; 292 struct ceph_x_authorize_b msg_b; 293 void *p, *end; 294 int ret; 295 int ticket_blob_len = 296 (th->ticket_blob ? th->ticket_blob->vec.iov_len : 0); 297 298 dout("build_authorizer for %s %p\n", 299 ceph_entity_type_name(th->service), au); 300 301 maxlen = sizeof(*msg_a) + sizeof(msg_b) + 302 ceph_x_encrypt_buflen(ticket_blob_len); 303 dout(" need len %d\n", maxlen); 304 if (au->buf && au->buf->alloc_len < maxlen) { 305 ceph_buffer_put(au->buf); 306 au->buf = NULL; 307 } 308 if (!au->buf) { 309 au->buf = ceph_buffer_new(maxlen, GFP_NOFS); 310 if (!au->buf) 311 return -ENOMEM; 312 } 313 au->service = th->service; 314 au->secret_id = th->secret_id; 315 316 msg_a = au->buf->vec.iov_base; 317 msg_a->struct_v = 1; 318 msg_a->global_id = cpu_to_le64(ac->global_id); 319 msg_a->service_id = cpu_to_le32(th->service); 320 msg_a->ticket_blob.struct_v = 1; 321 msg_a->ticket_blob.secret_id = cpu_to_le64(th->secret_id); 322 msg_a->ticket_blob.blob_len = cpu_to_le32(ticket_blob_len); 323 if (ticket_blob_len) { 324 memcpy(msg_a->ticket_blob.blob, th->ticket_blob->vec.iov_base, 325 th->ticket_blob->vec.iov_len); 326 } 327 dout(" th %p secret_id %lld %lld\n", th, th->secret_id, 328 le64_to_cpu(msg_a->ticket_blob.secret_id)); 329 330 p = msg_a + 1; 331 p += ticket_blob_len; 332 end = au->buf->vec.iov_base + au->buf->vec.iov_len; 333 334 get_random_bytes(&au->nonce, sizeof(au->nonce)); 335 msg_b.struct_v = 1; 336 msg_b.nonce = cpu_to_le64(au->nonce); 337 ret = ceph_x_encrypt(&th->session_key, &msg_b, sizeof(msg_b), 338 p, end - p); 339 if (ret < 0) 340 goto out_buf; 341 p += ret; 342 au->buf->vec.iov_len = p - au->buf->vec.iov_base; 343 dout(" built authorizer nonce %llx len %d\n", au->nonce, 344 (int)au->buf->vec.iov_len); 345 BUG_ON(au->buf->vec.iov_len > maxlen); 346 return 0; 347 348 out_buf: 349 ceph_buffer_put(au->buf); 350 au->buf = NULL; 351 return ret; 352 } 353 354 static int ceph_x_encode_ticket(struct ceph_x_ticket_handler *th, 355 void **p, void *end) 356 { 357 ceph_decode_need(p, end, 1 + sizeof(u64), bad); 358 ceph_encode_8(p, 1); 359 ceph_encode_64(p, th->secret_id); 360 if (th->ticket_blob) { 361 const char *buf = th->ticket_blob->vec.iov_base; 362 u32 len = th->ticket_blob->vec.iov_len; 363 364 ceph_encode_32_safe(p, end, len, bad); 365 ceph_encode_copy_safe(p, end, buf, len, bad); 366 } else { 367 ceph_encode_32_safe(p, end, 0, bad); 368 } 369 370 return 0; 371 bad: 372 return -ERANGE; 373 } 374 375 static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed) 376 { 377 int want = ac->want_keys; 378 struct ceph_x_info *xi = ac->private; 379 int service; 380 381 *pneed = ac->want_keys & ~(xi->have_keys); 382 383 for (service = 1; service <= want; service <<= 1) { 384 struct ceph_x_ticket_handler *th; 385 386 if (!(ac->want_keys & service)) 387 continue; 388 389 if (*pneed & service) 390 continue; 391 392 th = get_ticket_handler(ac, service); 393 394 if (IS_ERR(th)) { 395 *pneed |= service; 396 continue; 397 } 398 399 if (get_seconds() >= th->renew_after) 400 *pneed |= service; 401 if (get_seconds() >= th->expires) 402 xi->have_keys &= ~service; 403 } 404 } 405 406 407 static int ceph_x_build_request(struct ceph_auth_client *ac, 408 void *buf, void *end) 409 { 410 struct ceph_x_info *xi = ac->private; 411 int need; 412 struct ceph_x_request_header *head = buf; 413 int ret; 414 struct ceph_x_ticket_handler *th = 415 get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); 416 417 if (IS_ERR(th)) 418 return PTR_ERR(th); 419 420 ceph_x_validate_tickets(ac, &need); 421 422 dout("build_request want %x have %x need %x\n", 423 ac->want_keys, xi->have_keys, need); 424 425 if (need & CEPH_ENTITY_TYPE_AUTH) { 426 struct ceph_x_authenticate *auth = (void *)(head + 1); 427 void *p = auth + 1; 428 struct ceph_x_challenge_blob tmp; 429 char tmp_enc[40]; 430 u64 *u; 431 432 if (p > end) 433 return -ERANGE; 434 435 dout(" get_auth_session_key\n"); 436 head->op = cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY); 437 438 /* encrypt and hash */ 439 get_random_bytes(&auth->client_challenge, sizeof(u64)); 440 tmp.client_challenge = auth->client_challenge; 441 tmp.server_challenge = cpu_to_le64(xi->server_challenge); 442 ret = ceph_x_encrypt(&xi->secret, &tmp, sizeof(tmp), 443 tmp_enc, sizeof(tmp_enc)); 444 if (ret < 0) 445 return ret; 446 447 auth->struct_v = 1; 448 auth->key = 0; 449 for (u = (u64 *)tmp_enc; u + 1 <= (u64 *)(tmp_enc + ret); u++) 450 auth->key ^= *(__le64 *)u; 451 dout(" server_challenge %llx client_challenge %llx key %llx\n", 452 xi->server_challenge, le64_to_cpu(auth->client_challenge), 453 le64_to_cpu(auth->key)); 454 455 /* now encode the old ticket if exists */ 456 ret = ceph_x_encode_ticket(th, &p, end); 457 if (ret < 0) 458 return ret; 459 460 return p - buf; 461 } 462 463 if (need) { 464 void *p = head + 1; 465 struct ceph_x_service_ticket_request *req; 466 467 if (p > end) 468 return -ERANGE; 469 head->op = cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY); 470 471 ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer); 472 if (ret) 473 return ret; 474 ceph_encode_copy(&p, xi->auth_authorizer.buf->vec.iov_base, 475 xi->auth_authorizer.buf->vec.iov_len); 476 477 req = p; 478 req->keys = cpu_to_le32(need); 479 p += sizeof(*req); 480 return p - buf; 481 } 482 483 return 0; 484 } 485 486 static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, 487 void *buf, void *end) 488 { 489 struct ceph_x_info *xi = ac->private; 490 struct ceph_x_reply_header *head = buf; 491 struct ceph_x_ticket_handler *th; 492 int len = end - buf; 493 int op; 494 int ret; 495 496 if (result) 497 return result; /* XXX hmm? */ 498 499 if (xi->starting) { 500 /* it's a hello */ 501 struct ceph_x_server_challenge *sc = buf; 502 503 if (len != sizeof(*sc)) 504 return -EINVAL; 505 xi->server_challenge = le64_to_cpu(sc->server_challenge); 506 dout("handle_reply got server challenge %llx\n", 507 xi->server_challenge); 508 xi->starting = false; 509 xi->have_keys &= ~CEPH_ENTITY_TYPE_AUTH; 510 return -EAGAIN; 511 } 512 513 op = le16_to_cpu(head->op); 514 result = le32_to_cpu(head->result); 515 dout("handle_reply op %d result %d\n", op, result); 516 switch (op) { 517 case CEPHX_GET_AUTH_SESSION_KEY: 518 /* verify auth key */ 519 ret = ceph_x_proc_ticket_reply(ac, &xi->secret, 520 buf + sizeof(*head), end); 521 break; 522 523 case CEPHX_GET_PRINCIPAL_SESSION_KEY: 524 th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); 525 if (IS_ERR(th)) 526 return PTR_ERR(th); 527 ret = ceph_x_proc_ticket_reply(ac, &th->session_key, 528 buf + sizeof(*head), end); 529 break; 530 531 default: 532 return -EINVAL; 533 } 534 if (ret) 535 return ret; 536 if (ac->want_keys == xi->have_keys) 537 return 0; 538 return -EAGAIN; 539 } 540 541 static int ceph_x_create_authorizer( 542 struct ceph_auth_client *ac, int peer_type, 543 struct ceph_auth_handshake *auth) 544 { 545 struct ceph_x_authorizer *au; 546 struct ceph_x_ticket_handler *th; 547 int ret; 548 549 th = get_ticket_handler(ac, peer_type); 550 if (IS_ERR(th)) 551 return PTR_ERR(th); 552 553 au = kzalloc(sizeof(*au), GFP_NOFS); 554 if (!au) 555 return -ENOMEM; 556 557 ret = ceph_x_build_authorizer(ac, th, au); 558 if (ret) { 559 kfree(au); 560 return ret; 561 } 562 563 auth->authorizer = (struct ceph_authorizer *) au; 564 auth->authorizer_buf = au->buf->vec.iov_base; 565 auth->authorizer_buf_len = au->buf->vec.iov_len; 566 auth->authorizer_reply_buf = au->reply_buf; 567 auth->authorizer_reply_buf_len = sizeof (au->reply_buf); 568 569 return 0; 570 } 571 572 static int ceph_x_update_authorizer( 573 struct ceph_auth_client *ac, int peer_type, 574 struct ceph_auth_handshake *auth) 575 { 576 struct ceph_x_authorizer *au; 577 struct ceph_x_ticket_handler *th; 578 579 th = get_ticket_handler(ac, peer_type); 580 if (IS_ERR(th)) 581 return PTR_ERR(th); 582 583 au = (struct ceph_x_authorizer *)auth->authorizer; 584 if (au->secret_id < th->secret_id) { 585 dout("ceph_x_update_authorizer service %u secret %llu < %llu\n", 586 au->service, au->secret_id, th->secret_id); 587 return ceph_x_build_authorizer(ac, th, au); 588 } 589 return 0; 590 } 591 592 static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac, 593 struct ceph_authorizer *a, size_t len) 594 { 595 struct ceph_x_authorizer *au = (void *)a; 596 struct ceph_x_ticket_handler *th; 597 int ret = 0; 598 struct ceph_x_authorize_reply reply; 599 void *preply = &reply; 600 void *p = au->reply_buf; 601 void *end = p + sizeof(au->reply_buf); 602 603 th = get_ticket_handler(ac, au->service); 604 if (IS_ERR(th)) 605 return PTR_ERR(th); 606 ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply)); 607 if (ret < 0) 608 return ret; 609 if (ret != sizeof(reply)) 610 return -EPERM; 611 612 if (au->nonce + 1 != le64_to_cpu(reply.nonce_plus_one)) 613 ret = -EPERM; 614 else 615 ret = 0; 616 dout("verify_authorizer_reply nonce %llx got %llx ret %d\n", 617 au->nonce, le64_to_cpu(reply.nonce_plus_one), ret); 618 return ret; 619 } 620 621 static void ceph_x_destroy_authorizer(struct ceph_auth_client *ac, 622 struct ceph_authorizer *a) 623 { 624 struct ceph_x_authorizer *au = (void *)a; 625 626 ceph_buffer_put(au->buf); 627 kfree(au); 628 } 629 630 631 static void ceph_x_reset(struct ceph_auth_client *ac) 632 { 633 struct ceph_x_info *xi = ac->private; 634 635 dout("reset\n"); 636 xi->starting = true; 637 xi->server_challenge = 0; 638 } 639 640 static void ceph_x_destroy(struct ceph_auth_client *ac) 641 { 642 struct ceph_x_info *xi = ac->private; 643 struct rb_node *p; 644 645 dout("ceph_x_destroy %p\n", ac); 646 ceph_crypto_key_destroy(&xi->secret); 647 648 while ((p = rb_first(&xi->ticket_handlers)) != NULL) { 649 struct ceph_x_ticket_handler *th = 650 rb_entry(p, struct ceph_x_ticket_handler, node); 651 remove_ticket_handler(ac, th); 652 } 653 654 if (xi->auth_authorizer.buf) 655 ceph_buffer_put(xi->auth_authorizer.buf); 656 657 kfree(ac->private); 658 ac->private = NULL; 659 } 660 661 static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac, 662 int peer_type) 663 { 664 struct ceph_x_ticket_handler *th; 665 666 th = get_ticket_handler(ac, peer_type); 667 if (!IS_ERR(th)) 668 memset(&th->validity, 0, sizeof(th->validity)); 669 } 670 671 672 static const struct ceph_auth_client_ops ceph_x_ops = { 673 .name = "x", 674 .is_authenticated = ceph_x_is_authenticated, 675 .should_authenticate = ceph_x_should_authenticate, 676 .build_request = ceph_x_build_request, 677 .handle_reply = ceph_x_handle_reply, 678 .create_authorizer = ceph_x_create_authorizer, 679 .update_authorizer = ceph_x_update_authorizer, 680 .verify_authorizer_reply = ceph_x_verify_authorizer_reply, 681 .destroy_authorizer = ceph_x_destroy_authorizer, 682 .invalidate_authorizer = ceph_x_invalidate_authorizer, 683 .reset = ceph_x_reset, 684 .destroy = ceph_x_destroy, 685 }; 686 687 688 int ceph_x_init(struct ceph_auth_client *ac) 689 { 690 struct ceph_x_info *xi; 691 int ret; 692 693 dout("ceph_x_init %p\n", ac); 694 ret = -ENOMEM; 695 xi = kzalloc(sizeof(*xi), GFP_NOFS); 696 if (!xi) 697 goto out; 698 699 ret = -EINVAL; 700 if (!ac->key) { 701 pr_err("no secret set (for auth_x protocol)\n"); 702 goto out_nomem; 703 } 704 705 ret = ceph_crypto_key_clone(&xi->secret, ac->key); 706 if (ret < 0) { 707 pr_err("cannot clone key: %d\n", ret); 708 goto out_nomem; 709 } 710 711 xi->starting = true; 712 xi->ticket_handlers = RB_ROOT; 713 714 ac->protocol = CEPH_AUTH_CEPHX; 715 ac->private = xi; 716 ac->ops = &ceph_x_ops; 717 return 0; 718 719 out_nomem: 720 kfree(xi); 721 out: 722 return ret; 723 } 724 725 726