auth: authorize

diff --git a/src/auth/Auth.cc b/src/auth/Auth.cc
index f6e95eba824412fd435588bb9ae79279a8eee99f..b9629ff0acccde62adc9b11b90f0a0113cc9d271 100644 (file)
--- a/src/auth/Auth.cc
+++ b/src/auth/Auth.cc
@@ -152,6 +152,14 @@ bool AuthTicketHandler::verify_service_ticket_reply(CryptoKey& secret,
   return true;
 }
 
+bool AuthTicketsManager::has_key(uint32_t service_id)
+{
+  map<uint32_t, AuthTicketHandler>::iterator iter = tickets_map.find(service_id);
+  if (iter == tickets_map.end())
+    return false;
+  return iter->second.has_key();
+}
+
 /*
  * PRINCIPAL: verify our attempt to authenticate succeeded.  fill out
  * this ServiceTicket with the result.
@@ -259,7 +267,7 @@ bool AuthTicketHandler::decode_reply_authorizer(bufferlist::iterator& indata, Au
  */
 bool AuthTicketHandler::verify_reply_authorizer(AuthContext& ctx, AuthAuthorizeReply& reply)
 {
-  if (ctx.timestamp == reply.timestamp) {
+  if (ctx.timestamp + 1 == reply.timestamp) {
     return true;
   }
 

diff --git a/src/auth/Auth.h b/src/auth/Auth.h
index 7aaf9a77f2b292ff78d855a3cd15cc20e70890a7..8bc6f69143f277591c3d53d6074b6deb85b3ef42 100644 (file)
--- a/src/auth/Auth.h
+++ b/src/auth/Auth.h
@@ -185,6 +185,7 @@ struct AuthTicketsManager {
 
   AuthTicketHandler& get_handler(uint32_t type) { return tickets_map[type]; }
   bool build_authorizer(uint32_t service_id, bufferlist& bl, AuthContext& context);
+  bool has_key(uint32_t service_id);
 };
 
 struct AuthServiceTicketRequest {

diff --git a/src/auth/AuthClientHandler.cc b/src/auth/AuthClientHandler.cc
index bccec6849ea1bf15eb92c1ce254095e8904e6b82..aa42b0e2a510a556388a657b83a14e46cbb9ecf7 100644 (file)
--- a/src/auth/AuthClientHandler.cc
+++ b/src/auth/AuthClientHandler.cc
@@ -248,30 +248,6 @@ int AuthClientAuthenticateHandler::handle_cephx_response(bufferlist::iterator& i
     ret = 0;
     break;
 
-  case CEPHX_OPEN_SESSION:
-    {
-      AuthTicketHandler& ticket_handler = client->tickets.get_handler(CEPHX_PRINCIPAL_AUTH);
-      AuthAuthorizeReply reply;
-      if (!ticket_handler.decode_reply_authorizer(indata, reply)) {
-        ret = -EINVAL;
-        break;
-      }
-      AuthContext *ctx = client->context_map.get(reply.trans_id);
-      if (!ctx) {
-        ret = -EINVAL;
-        break;
-      }
-      bool result = ticket_handler.verify_reply_authorizer(*ctx, reply);
-      if (result)
-        ctx->status = 0;
-      else
-        ctx->status = -EPERM;
-
-       ctx->cond->Signal();
-       ret = 0;
-       break;
-    }
-    break;
   default:
     dout(0) << "header.request_type = " << hex << header.request_type << dec << dendl;
     ret = -EINVAL;
@@ -298,7 +274,7 @@ int AuthClientAuthenticateHandler::_build_request()
 int AuthClientAuthorizeHandler::_build_request()
 {
   CephXRequestHeader header;
-  if (!(client->have & service_id)) {
+  if (!client->tickets.has_key(service_id)) {
     dout(0) << "can't authorize: missing service key" << dendl;
     return -EPERM;
   }
@@ -309,32 +285,50 @@ int AuthClientAuthorizeHandler::_build_request()
 
   ::encode(header, bl);
   utime_t now;
-#if 0
+
   if (!client->tickets.build_authorizer(service_id, bl, ctx))
     return -EINVAL;
-#endif
+
   return 0;
 }
 
 int AuthClientAuthorizeHandler::_handle_response(int ret, bufferlist::iterator& iter)
 {
-  /* FIXME: implement */
+  struct CephXResponseHeader header;
+  ::decode(header, iter);
 
-  return 0;
-}
+  dout(0) << "AuthClientAuthorizeHandler::_handle_response() ret=" << ret << dendl;
 
-#if 0
-int AuthClientAuthenticateHandler::_do_request()
-{
-  Message *msg = build_authenticate_request();
-  if (!msg)
-    return -EIO;
+  if (ret) {
+    return ret;
+  }
 
-  int ret = _do_request_generic(timeout, msg);
+  switch (header.request_type & CEPHX_REQUEST_TYPE_MASK) {
+  case CEPHX_OPEN_SESSION:
+    {
+      AuthTicketHandler& ticket_handler = client->tickets.get_handler(service_id);
+      AuthAuthorizeReply reply;
+      if (!ticket_handler.decode_reply_authorizer(iter, reply)) {
+        ret = -EINVAL;
+        break;
+      }
+      ret = 0;
+      bool result = ticket_handler.verify_reply_authorizer(ctx, reply);
+      if (!result) {
+        ret = -EPERM;
+      }
+
+       break;
+    }
+    break;
+  default:
+    dout(0) << "header.request_type = " << hex << header.request_type << dec << dendl;
+    ret = -EINVAL;
+    break;
+  }
 
   return ret;
 }
-#endif
 
 AuthClientProtocolHandler *AuthClientHandler::_get_proto_handler(uint32_t id)
 {
@@ -404,6 +398,7 @@ int AuthClientHandler::start_session(AuthClient *client, double timeout)
 
 int AuthClientHandler::authorize(uint32_t service_id, double timeout)
 {
+  Mutex::Locker l(lock);
   AuthClientAuthorizeHandler handler(this, service_id);
 
   int ret = handler.build_request();
@@ -412,6 +407,8 @@ int AuthClientHandler::authorize(uint32_t service_id, double timeout)
 
   ret = handler.do_request(timeout);
 
+  dout(0) << "authorize returned " << ret << dendl;
+
   return ret;
 }
 
@@ -424,34 +421,3 @@ void AuthClientHandler::tick()
 
 }
 
-AuthContext& AuthContextMap::create()
-{
-  Mutex::Locker l(lock);
-  AuthContext& ctx = m[max_id];
-  ctx.id = max_id;
-  ctx.cond = NULL;
-  ++max_id;
-  
-  return ctx;
-}
-
-void AuthContextMap::remove(int id)
-{
-  Mutex::Locker l(lock);
-  std::map<int, AuthContext>::iterator iter = m.find(id);
-  if (iter != m.end()) {
-    m.erase(iter);
-  }
-}
-
-AuthContext *AuthContextMap::get(int id)
-{
-  Mutex::Locker l(lock);
-  std::map<int, AuthContext>::iterator iter = m.find(id);
-  if (iter != m.end())
-    return &iter->second;
-
-  return NULL;
-}
-
-

diff --git a/src/auth/AuthClientHandler.h b/src/auth/AuthClientHandler.h
index 93d459503ddb11741aaf5bc6a7b3b27059489cd4..4acc4e7b99f1ba7348276011c8fbeda6179758a4 100644 (file)
--- a/src/auth/AuthClientHandler.h
+++ b/src/auth/AuthClientHandler.h
@@ -29,19 +29,6 @@ class MAuthReply;
 class Message;
 class AuthClient;
 
-class AuthContextMap {
-  map<int, AuthContext> m;
-
-  Mutex lock;
-  int max_id;
-
-public:
-  AuthContextMap() : lock("AuthorizeMap") {}
-  AuthContext& create();
-  void remove(int id);
-  AuthContext *get(int id);
-};
-
 class AuthClientHandler;
 
 class AuthClientProtocolHandler {
@@ -130,6 +117,7 @@ public:
 
 class AuthClientAuthorizeHandler : public AuthClientProtocolHandler {
   uint32_t service_id;
+  AuthContext ctx;
 protected:
   int _build_request();
   int _handle_response(int ret, bufferlist::iterator& iter);
@@ -169,7 +157,6 @@ public:
   uint32_t have;
   CryptoKey secret;
 
-  AuthContextMap context_map;
   AuthTicketsManager tickets;
 
   AuthClientHandler() : lock("AuthClientHandler::lock"),

diff --git a/src/auth/AuthServiceManager.cc b/src/auth/AuthServiceManager.cc
index 774132566cf7b62dd45ee239cbffa987fe8ef49f..a6c3ecf40c17314bbd47d0d9e5812c904d23cea9 100644 (file)
--- a/src/auth/AuthServiceManager.cc
+++ b/src/auth/AuthServiceManager.cc
@@ -265,6 +265,23 @@ int CephAuthService_X::handle_cephx_protocol(bufferlist::iterator& indata, buffe
       ret = 0;
     }
     break;
+  case CEPHX_OPEN_SESSION:
+    {
+      CryptoKey service_secret;
+
+      auth_server.get_service_secret(service_secret, CEPHX_PRINCIPAL_MON);
+
+      ret = 0;
+      bufferlist tmp_bl;
+      if (!verify_authorizer(service_secret, indata, tmp_bl)) {
+        ret = -EPERM;
+      }
+      build_cephx_response_header(request_type, ret, result_bl);
+      result_bl.claim_append(tmp_bl);
+
+      break;
+    }
+    break;
   default:
     ret = -EINVAL;
     build_cephx_response_header(request_type, -EINVAL, result_bl);

diff --git a/src/librados.cc b/src/librados.cc
index d4e11229b8f60b3979b954415f595b4ad175dc9d..f38bef19025699a1cd68bb025847454559c41b7d 100644 (file)
--- a/src/librados.cc
+++ b/src/librados.cc
@@ -306,6 +306,7 @@ bool RadosClient::init()
   dout(0) << "librados: before monclient.authenticate()" << dendl;
   monclient.auth.set_want_keys(CEPHX_PRINCIPAL_MON | CEPHX_PRINCIPAL_OSD);
   monclient.authenticate(g_conf.client_mount_timeout);
+  monclient.authorize(g_conf.client_mount_timeout);
   monclient.mount(g_conf.client_mount_timeout);
 
   lock.Lock();