rgw: improve error checking in Keystone-related code.

Signed-off-by: Radoslaw Zarzynski <rzarzynski@mirantis.com>

diff --git a/src/rgw/rgw_auth.cc b/src/rgw/rgw_auth.cc
index b96795d665a489acd76345a9c073509098ba4e34..192f14e34daa21459e4e9fa4d16e297df8810ed3 100644 (file)
--- a/src/rgw/rgw_auth.cc
+++ b/src/rgw/rgw_auth.cc
@@ -363,9 +363,24 @@ KeystoneToken RGWKeystoneAuthEngine::get_from_keystone(const std::string& token)
   if (ret < 0) {
     throw ret;
   }
-  token_body_bl.append((char)0); // NULL terminate for debug output
 
-  ldout(cct, 20) << "received response: " << token_body_bl.c_str() << dendl;
+  /* NULL terminate for debug output. */
+  token_body_bl.append(static_cast<char>(0));
+  ldout(cct, 20) << "received response status=" << validate.get_http_status()
+                 << ", body=" << token_body_bl.c_str() << dendl;
+
+  /* Detect Keystone rejection earlier than during the token parsing.
+   * Although failure at the parsing phase doesn't impose a threat,
+   * this allows to return proper error code (EACCESS instead of EINVAL
+   * or similar) and thus improves logging. */
+  if (validate.get_http_status() ==
+          /* Most likely: wrong admin credentials or admin token. */
+          RGWValidateKeystoneToken::HTTP_STATUS_UNAUTHORIZED ||
+      validate.get_http_status() ==
+          /* Most likely: non-existent token supplied by the client. */
+          RGWValidateKeystoneToken::HTTP_STATUS_NOTFOUND) {
+    throw -EACCES;
+  }
 
   KeystoneToken token_body;
   ret = token_body.parse(cct, token, token_body_bl);

diff --git a/src/rgw/rgw_http_client.h b/src/rgw/rgw_http_client.h
index 4a96be6caf0dcd6370c18ad7ae23828b9fde7100..683db7ba0d56f0871c2d4c4ab78d35eb13316d2a 100644 (file)
--- a/src/rgw/rgw_http_client.h
+++ b/src/rgw/rgw_http_client.h
@@ -83,6 +83,7 @@ protected:
 public:
   static const long HTTP_STATUS_NOSTATUS     = 0;
   static const long HTTP_STATUS_UNAUTHORIZED = 401;
+  static const long HTTP_STATUS_NOTFOUND     = 404;
 
   virtual ~RGWHTTPClient();
   explicit RGWHTTPClient(CephContext *cct)

diff --git a/src/rgw/rgw_keystone.cc b/src/rgw/rgw_keystone.cc
index 538a2cbc847d43745691bf6d2980b9c1ca6972ef..3fa96d2e4038efeef434bb90b3d1f6ca6d5bf912 100644 (file)
--- a/src/rgw/rgw_keystone.cc
+++ b/src/rgw/rgw_keystone.cc
@@ -224,6 +224,13 @@ int KeystoneService::get_keystone_admin_token(CephContext * const cct,
   if (ret < 0) {
     return ret;
   }
+
+  /* Detect rejection earlier than during the token parsing step. */
+  if (token_req.get_http_status() ==
+          RGWGetKeystoneAdminToken::HTTP_STATUS_UNAUTHORIZED) {
+    return -EACCES;
+  }
+
   if (t.parse(cct, token_req.get_subject_token(), token_bl) != 0) {
     return -EINVAL;
   }