auth: propagate ceph context to encrypt/decrypt

Signed-off-by: Yehuda Sadeh <ysadehwe@ibm.com>
(cherry picked from commit c73c75d34051cef09e9695dcf85a24a4d024faaf)

diff --git a/src/auth/Crypto.cc b/src/auth/Crypto.cc
index 5d68d3470bc04cf32f5902a7db3b0a3232f23045..dd0fa959ff92588f2b4f0ee7184dc86125aedfc2 100644 (file)
--- a/src/auth/Crypto.cc
+++ b/src/auth/Crypto.cc
@@ -149,6 +149,7 @@ int CryptoRandom::open_urandom()
 // interface.
 
 std::size_t CryptoKeyHandler::encrypt(
+  CephContext *cct,
   const CryptoKeyHandler::in_slice_t& in,
   const CryptoKeyHandler::out_slice_t& out) const
 {
@@ -158,7 +159,7 @@ std::size_t CryptoKeyHandler::encrypt(
 
   ceph::bufferlist ciphertext;
   std::string error;
-  const int ret = encrypt(plaintext, ciphertext, &error);
+  const int ret = encrypt(cct, plaintext, ciphertext, &error);
   if (ret != 0 || !error.empty()) {
     throw std::runtime_error(std::move(error));
   }
@@ -173,6 +174,7 @@ std::size_t CryptoKeyHandler::encrypt(
 }
 
 std::size_t CryptoKeyHandler::decrypt(
+  CephContext *cct,
   const CryptoKeyHandler::in_slice_t& in,
   const CryptoKeyHandler::out_slice_t& out) const
 {
@@ -182,7 +184,7 @@ std::size_t CryptoKeyHandler::decrypt(
 
   ceph::bufferlist plaintext;
   std::string error;
-  const int ret = decrypt(ciphertext, plaintext, &error);
+  const int ret = decrypt(cct, ciphertext, plaintext, &error);
   if (ret != 0 || !error.empty()) {
     throw std::runtime_error(std::move(error));
   }
@@ -221,12 +223,12 @@ public:
   using CryptoKeyHandler::encrypt;
   using CryptoKeyHandler::decrypt;
 
-  int encrypt(const bufferlist& in,
+  int encrypt(CephContext *cct, const bufferlist& in,
               bufferlist& out, std::string *error) const override {
     out = in;
     return 0;
   }
-  int decrypt(const bufferlist& in,
+  int decrypt(CephContext *cct, const bufferlist& in,
              bufferlist& out, std::string *error) const override {
     out = in;
     return 0;
@@ -302,7 +304,7 @@ public:
     return 0;
   }
 
-  int encrypt(const ceph::bufferlist& in,
+  int encrypt(CephContext *cct, const ceph::bufferlist& in,
              ceph::bufferlist& out,
               std::string* /* unused */) const override {
     // we need to take into account the PKCS#7 padding. There *always* will
@@ -344,7 +346,7 @@ public:
     return 0;
   }
 
-  int decrypt(const ceph::bufferlist& in,
+  int decrypt(CephContext *cct, const ceph::bufferlist& in,
              ceph::bufferlist& out,
              std::string* /* unused */) const override {
     // PKCS#7 padding enlarges even empty plain-text to take 16 bytes.
@@ -376,7 +378,7 @@ public:
     return 0;
   }
 
-  std::size_t encrypt(const in_slice_t& in,
+  std::size_t encrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) const override {
     if (out.buf == nullptr) {
       // 16 + p2align(10, 16) -> 16
@@ -417,7 +419,7 @@ public:
     return main_encrypt_size + tail_encrypt_size;
   }
 
-  std::size_t decrypt(const in_slice_t& in,
+  std::size_t decrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) const override {
     if (in.length % AES_BLOCK_LEN != 0 || in.length < AES_BLOCK_LEN) {
       throw std::runtime_error("input not aligned to AES_BLOCK_LEN");

diff --git a/src/auth/Crypto.h b/src/auth/Crypto.h
index 3ce655a12562c903ef60069e966dcf729857aa80..7c5ffc1fef336996c9752a0acded9fc5c8c93184 100644 (file)
--- a/src/auth/Crypto.h
+++ b/src/auth/Crypto.h
@@ -70,16 +70,20 @@ public:
 
   virtual ~CryptoKeyHandler() {}
 
-  virtual int encrypt(const ceph::buffer::list& in,
+  virtual int encrypt(CephContext *cct,
+                      const ceph::buffer::list& in,
                      ceph::buffer::list& out, std::string *error) const = 0;
-  virtual int decrypt(const ceph::buffer::list& in,
+  virtual int decrypt(CephContext *cct,
+                      const ceph::buffer::list& in,
                      ceph::buffer::list& out, std::string *error) const = 0;
 
   // TODO: provide nullptr in the out::buf to get/estimate size requirements?
   // Or maybe dedicated methods?
-  virtual std::size_t encrypt(const in_slice_t& in,
+  virtual std::size_t encrypt(CephContext *cct,
+                              const in_slice_t& in,
                              const out_slice_t& out) const;
-  virtual std::size_t decrypt(const in_slice_t& in,
+  virtual std::size_t decrypt(CephContext *cct,
+                              const in_slice_t& in,
                              const out_slice_t& out) const;
 
   sha256_digest_t hmac_sha256(const ceph::bufferlist& in) const;
@@ -160,27 +164,27 @@ public:
              ceph::buffer::list& out,
              std::string *error) const {
     ceph_assert(ckh); // Bad key?
-    return ckh->encrypt(in, out, error);
+    return ckh->encrypt(cct, in, out, error);
   }
   int decrypt(CephContext *cct, const ceph::buffer::list& in,
              ceph::buffer::list& out,
              std::string *error) const {
     ceph_assert(ckh); // Bad key?
-    return ckh->decrypt(in, out, error);
+    return ckh->decrypt(cct, in, out, error);
   }
 
   using in_slice_t = CryptoKeyHandler::in_slice_t;
   using out_slice_t = CryptoKeyHandler::out_slice_t;
 
-  std::size_t encrypt(CephContext*, const in_slice_t& in,
+  std::size_t encrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) {
     ceph_assert(ckh);
-    return ckh->encrypt(in, out);
+    return ckh->encrypt(cct, in, out);
   }
-  std::size_t decrypt(CephContext*, const in_slice_t& in,
+  std::size_t decrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) {
     ceph_assert(ckh);
-    return ckh->encrypt(in, out);
+    return ckh->encrypt(cct, in, out);
   }
 
   sha256_digest_t hmac_sha256(CephContext*, const ceph::buffer::list& in) {

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 0ff827f22e62441c4a251e8b5dd3aeb1911d3201..05f9a828843b8a22085e39e1eabbb2309c9688dd 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -7034,7 +7034,7 @@ rgw::auth::s3::STSEngine::get_session_token(const DoutPrefixProvider* dpp, const
   buffer::list en_input, dec_output;
   en_input = buffer::list::static_from_string(decodedSessionToken);
 
-  ret = keyhandler->decrypt(en_input, dec_output, &error);
+  ret = keyhandler->decrypt(cct, en_input, dec_output, &error);
   if (ret < 0) {
     ldpp_dout(dpp, 0) << "ERROR: Decryption failed: " << error << dendl;
     return -EPERM;

diff --git a/src/rgw/rgw_sts.cc b/src/rgw/rgw_sts.cc
index 951af012b482f7184b648f6592320264f7fb489d..6c025ddd52fd4b436c9323680f99c0d9336b208f 100644 (file)
--- a/src/rgw/rgw_sts.cc
+++ b/src/rgw/rgw_sts.cc
@@ -140,7 +140,7 @@ int Credentials::generateCredentials(const DoutPrefixProvider *dpp,
   buffer::list input, enc_output;
   encode(token, input);
 
-  if (ret = keyhandler->encrypt(input, enc_output, &error); ret < 0) {
+  if (ret = keyhandler->encrypt(cct, input, enc_output, &error); ret < 0) {
     ldpp_dout(dpp, 0) << "ERROR: Encrypting session token returned an error !" << dendl;
     return ret;
   }