crypto: use crypto++ for aes instead of openssl

need to implement it more efficiently, currently going through a string object

diff --git a/src/Makefile.am b/src/Makefile.am
index ef33b7140d1571b2afff41f1eb50cbc4db0b778d..ee423f52409b93e1057e94badfd22c37dad88d98 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -11,25 +11,25 @@ bin_SCRIPTS = crun cclass $(srcdir)/cclsinfo cdebugpack
 
 # monitor
 cmon_SOURCES = cmon.cc msg/SimpleMessenger.cc
-cmon_LDADD = libmon.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+cmon_LDADD = libmon.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += cmon
 
 # osd
 cosd_SOURCES = cosd.cc msg/SimpleMessenger.cc objclass/class_debug.cc \
               objclass/class_api.cc
-cosd_LDADD = libosd.a libos.a libcrush.a libcommon.a -ldl -lpthread -lm $(OPENSSL_LIBS)
+cosd_LDADD = libosd.a libos.a libcrush.a libcommon.a -ldl -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += cosd
 cosd_CXXFLAGS = ${AM_CFLAGS}
 
 # mds
 cmds_SOURCES = cmds.cc msg/SimpleMessenger.cc
-cmds_LDADD = libmds.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+cmds_LDADD = libmds.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += cmds
 cmds_CXXFLAGS = ${AM_CFLAGS}
 
 # admin tools
 ceph_SOURCES = tools/ceph.cc msg/SimpleMessenger.cc
-ceph_LDADD = libcrush.a libcommon.a -ledit -lpthread -lm $(OPENSSL_LIBS)
+ceph_LDADD = libcrush.a libcommon.a -ledit -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 ceph_CXXFLAGS = ${AM_CFLAGS}
 
 if WITH_GTK2
@@ -59,17 +59,17 @@ ceph_CXXFLAGS += -DCEPH_TOOL_GUIDIR="\"${ceph_tool_guidir}\""
 endif
 
 cconf_SOURCES = cconf.cc
-cconf_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+cconf_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 cauthtool_SOURCES = cauthtool.cc
-cauthtool_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+cauthtool_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += ceph cconf cauthtool
 
 monmaptool_SOURCES = monmaptool.cc
-monmaptool_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+monmaptool_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 crushtool_SOURCES = crushtool.cc
-crushtool_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+crushtool_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 osdmaptool_SOURCES = osdmaptool.cc
-osdmaptool_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+osdmaptool_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += monmaptool crushtool osdmaptool
 
 mount_ceph_SOURCES = mount/mount.ceph.c
@@ -81,7 +81,7 @@ bin_PROGRAMS += cephfs
 
 # synthetic client
 csyn_SOURCES = csyn.cc msg/SimpleMessenger.cc
-csyn_LDADD = libclient.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+csyn_LDADD = libclient.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += csyn
 
 core: cmon cosd cmds ceph cephfs cconf monmaptool osdmaptool crushtool csyn
@@ -90,7 +90,7 @@ core: cmon cosd cmds ceph cephfs cconf monmaptool osdmaptool crushtool csyn
 # fuse targets?
 if WITH_FUSE
 cfuse_SOURCES = cfuse.cc msg/SimpleMessenger.cc client/fuse.cc client/fuse_ll.cc
-cfuse_LDADD = -lfuse libclient.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+cfuse_LDADD = -lfuse libclient.a libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 cfuse_CXXFLAGS = ${AM_CFLAGS}
 bin_PROGRAMS += cfuse
 
@@ -120,26 +120,26 @@ endif # WITH_TCMALLOC
 if WITH_DEBUG
 
 psim_SOURCES = psim.cc
-psim_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+psim_LDADD = libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += psim
 
 testmsgr_SOURCES = testmsgr.cc msg/SimpleMessenger.cc
-testmsgr_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+testmsgr_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testmsgr
 
 test_ioctls_SOURCES = client/test_ioctls.c
 bin_PROGRAMS += test_ioctls
 
 dumpjournal_SOURCES = dumpjournal.cc msg/SimpleMessenger.cc
-dumpjournal_LDADD = libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+dumpjournal_LDADD = libosdc.a libcrush.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 dupstore_SOURCES = dupstore.cc
-dupstore_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+dupstore_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 streamtest_SOURCES = streamtest.cc
-streamtest_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+streamtest_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += dumpjournal dupstore streamtest
 
 test_trans_SOURCES = test_trans.cc
-test_trans_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+test_trans_LDADD = libos.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += test_trans
 
 
@@ -176,17 +176,17 @@ libceph_la_SOURCES = \
        ${libosdc_a_SOURCES}
 libceph_la_CFLAGS = ${AM_CFLAGS}
 libceph_la_CXXFLAGS= ${AM_CXXFLAGS}
-libceph_la_LIBADD = libcrush.la -lpthread $(OPENSSL_LIBS)
+libceph_la_LIBADD = libcrush.la -lpthread $(OPENSSL_LIBS) -lcrypto++
 libceph_la_LDFLAGS = ${AM_LDFLAGS} -version-info 1:0:0 -export-symbols-regex '^ceph_.*'
 lib_LTLIBRARIES += libceph.la
 
 if WITH_DEBUG
 testceph_SOURCES = client/testceph.cc
-testceph_LDADD = libceph.la libcrush.la -lpthread -lm $(OPENSSL_LIBS)
+testceph_LDADD = libceph.la libcrush.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testceph
 
 testtimers_SOURCES = test/TestTimers.cc
-testtimers_LDADD = libceph.la libcrush.la -lpthread -lm $(OPENSSL_LIBS)
+testtimers_LDADD = libceph.la libcrush.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testtimers
 
 testencoding_SOURCES = test/TestEncoding.cc
@@ -204,7 +204,7 @@ librados_SOURCES = \
 librados_la_SOURCES = ${librados_SOURCES}
 librados_la_CFLAGS = ${AM_CFLAGS}
 librados_la_CXXFLAGS = ${AM_CXXFLAGS}
-librados_la_LIBADD = libcrush.la -lpthread $(OPENSSL_LIBS)
+librados_la_LIBADD = libcrush.la -lpthread $(OPENSSL_LIBS) -lcrypto++
 librados_la_LDFLAGS = ${AM_LDFLAGS} -version-info 1:0:0 -export-symbols-regex '^rados_.*'
 lib_LTLIBRARIES += librados.la
 
@@ -213,21 +213,21 @@ librados_a_CFLAGS = ${AM_CFLAGS}
 librados_a_CXXFLAGS = ${AM_CXXFLAGS}
 
 rados_SOURCES = rados.cc
-rados_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS)
+rados_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += rados
 
 if WITH_DEBUG
 testrados_SOURCES = testrados.c
-testrados_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS)
+testrados_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 testradospp_SOURCES = testradospp.cc
-testradospp_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS)
+testradospp_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testrados testradospp
 endif
 
 radosacl_SOURCES = radosacl.cc
-radosacl_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS)
+radosacl_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 rbd_SOURCES = rbd.cc common/fiemap.cc
-rbd_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS)
+rbd_LDADD = librados.la -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += radosacl rbd
 
 if WITH_RADOSGW
@@ -244,19 +244,19 @@ libradosgw_a_CFLAGS = ${AM_CFLAGS}
 # lib_LTLIBRARIES += libradosgw.a
 
 radosgw_SOURCES = rgw/rgw_main.cc
-radosgw_LDADD = libradosgw.a librados.a libcrush.a -lfcgi $(OPENSSL_LIBS) -lexpat -lpthread -lm
+radosgw_LDADD = libradosgw.a librados.a libcrush.a -lfcgi $(OPENSSL_LIBS) -lexpat -lpthread -lm -lcrypto++
 radosgw_admin_SOURCES = rgw/rgw_admin.cc
-radosgw_admin_LDADD = libradosgw.a librados.a libcrush.a -lfcgi $(OPENSSL_LIBS) -lexpat -lpthread -lm
+radosgw_admin_LDADD = libradosgw.a librados.a libcrush.a -lfcgi $(OPENSSL_LIBS) -lexpat -lpthread -lm -lcrypto++
 bin_PROGRAMS += radosgw radosgw_admin
 endif
 
 if WITH_DEBUG
 testcrypto_SOURCES = testcrypto.cc
-testcrypto_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+testcrypto_LDADD = libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testcrypto
 
 testkeys_SOURCES = testkeys.cc
-testkeys_LDADD = libmon.a libcommon.a -lpthread -lm $(OPENSSL_LIBS)
+testkeys_LDADD = libmon.a libcommon.a -lpthread -lm $(OPENSSL_LIBS) -lcrypto++
 bin_PROGRAMS += testkeys
 endif
 

diff --git a/src/auth/Crypto.cc b/src/auth/Crypto.cc
index 26b7b5ccc616719bd5fdc25d38256ee25427804b..1d1c8330c4865f0b3b238cf6aa2c897ef1604e33 100644 (file)
--- a/src/auth/Crypto.cc
+++ b/src/auth/Crypto.cc
@@ -11,10 +11,17 @@
  * 
  */
 
-#include "Crypto.h"
+#define CRYPTOPP
 
+#include "Crypto.h"
+#ifdef CRYPTOPP
+#include "cryptopp/modes.h"
+#include "cryptopp/aes.h"
+#include "cryptopp/filters.h"
+#else
 #include "openssl/evp.h"
 #include "openssl/aes.h"
+#endif
 
 #include "include/ceph_fs.h"
 #include "config.h"
@@ -22,6 +29,10 @@
 
 #include <errno.h>
 
+#ifdef CRYPTOPP
+using namespace CryptoPP;
+#endif
+
 int get_random_bytes(char *buf, int len)
 {
   char *t = buf;
@@ -94,8 +105,13 @@ int CryptoNone::decrypt(bufferptr& secret, const bufferlist& in, bufferlist& out
 
 
 // ---------------------------------------------------
-
+#ifdef CRYPTOPP
+#define AES_KEY_LEN     ((size_t)AES::DEFAULT_KEYLENGTH)
+#define AES_BLOCK_LEN   ((size_t)AES::BLOCKSIZE)
+#else
 #define AES_KEY_LEN     AES_BLOCK_SIZE
+#define AES_BLOCK_LEN   AES_BLOCK_SIZE
+#endif
 
 class CryptoAES : public CryptoHandler {
 public:
@@ -121,7 +137,7 @@ int CryptoAES::create(bufferptr& secret)
 
 int CryptoAES::validate_secret(bufferptr& secret)
 {
-  if (secret.length() < AES_KEY_LEN) {
+  if (secret.length() < (size_t)AES_KEY_LEN) {
     dout(0) << "key is too short" << dendl;
     return -EINVAL;
   }
@@ -134,7 +150,7 @@ int CryptoAES::encrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
   const unsigned char *key = (const unsigned char *)secret.c_str();
   int in_len = in.length();
   const unsigned char *in_buf;
-  int max_out = (in_len + AES_BLOCK_SIZE) & ~(AES_BLOCK_SIZE -1);
+  int max_out = (in_len + AES_BLOCK_LEN) & ~(AES_BLOCK_LEN - 1);
   int total_out = 0;
   int outlen;
 #define OUT_BUF_EXTRA 128
@@ -144,7 +160,24 @@ int CryptoAES::encrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
     derr(0) << "key is too short" << dendl;
     return false;
   }
+#ifdef CRYPTOPP
+  string ciphertext;
+  CryptoPP::AES::Encryption aesEncryption(key, CryptoPP::AES::DEFAULT_KEYLENGTH);
+  CryptoPP::CBC_Mode_ExternalCipher::Encryption cbcEncryption( aesEncryption, aes_iv );
+  CryptoPP::StreamTransformationFilter stfEncryptor(cbcEncryption, new CryptoPP::StringSink( ciphertext ) );
+
+  for (std::list<bufferptr>::const_iterator it = in.buffers().begin(); 
+       it != in.buffers().end(); it++) {
+    in_buf = (const unsigned char *)it->c_str();
+
+    stfEncryptor.Put(in_buf, it->length());
+  }
+  stfEncryptor.MessageEnd();
+
+  out.append((const char *)ciphertext.c_str(), ciphertext.length());
 
+  return true;
+#else
   EVP_CIPHER_CTX ctx;
   EVP_CIPHER_CTX_init(&ctx);
   EVP_EncryptInit_ex(&ctx, EVP_aes_128_cbc(), NULL, key, aes_iv);
@@ -161,12 +194,12 @@ int CryptoAES::encrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
   if (!EVP_EncryptFinal_ex(&ctx, outbuf + total_out, &outlen))
     goto out;
   total_out += outlen;
-
   out.append((const char *)outbuf, total_out);
   ret = true;
- out:
+out:
   EVP_CIPHER_CTX_cleanup(&ctx);
   return ret;
+#endif
 }
 
 int CryptoAES::decrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
@@ -180,6 +213,26 @@ int CryptoAES::decrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
   unsigned char dec_data[in_len];
   int result = 0;
 
+#ifdef CRYPTOPP
+  dout(0) << "CryptoPP!" << dendl;
+
+  CryptoPP::AES::Decryption aesDecryption(key, CryptoPP::AES::DEFAULT_KEYLENGTH);
+  CryptoPP::CBC_Mode_ExternalCipher::Decryption cbcDecryption( aesDecryption, aes_iv );
+
+  string decryptedtext;
+
+  CryptoPP::StreamTransformationFilter stfDecryptor(cbcDecryption, new CryptoPP::StringSink( decryptedtext ) );
+  for (std::list<bufferptr>::const_iterator it = in.buffers().begin(); 
+       it != in.buffers().end(); it++) {
+      const unsigned char *in_buf = (const unsigned char *)it->c_str();
+      stfDecryptor.Put(in_buf, it->length());
+  }
+
+  stfDecryptor.MessageEnd();
+
+  out.append((const char *)decryptedtext.c_str(), decryptedtext.length());
+  return decryptedtext.length();
+#else
   EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
   EVP_CIPHER_CTX_init(ctx);
 
@@ -212,7 +265,9 @@ int CryptoAES::decrypt(bufferptr& secret, const bufferlist& in, bufferlist& out)
   }
 
   EVP_CIPHER_CTX_free(ctx);
+
   return result;
+#endif
 }