msg,cephx: establish a unique connection_secret for every connection

The session_key is unique for each time we newly authenticate with the
mon--e.g., for each client instantiation.  This is not ideal for
encryption, since we don't want to encrypt all connections with the same
key.

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/auth/Auth.h b/src/auth/Auth.h
index aac83632bf977351d91d79361359432ce38ee73d..69c488af776fb02d79202676db9ac1c2b2620f4c 100644 (file)
--- a/src/auth/Auth.h
+++ b/src/auth/Auth.h
@@ -139,7 +139,8 @@ struct AuthAuthorizer {
 
   explicit AuthAuthorizer(__u32 p) : protocol(p) {}
   virtual ~AuthAuthorizer() {}
-  virtual bool verify_reply(bufferlist::const_iterator& reply) = 0;
+  virtual bool verify_reply(bufferlist::const_iterator& reply,
+                           CryptoKey *connection_secret) = 0;
   virtual bool add_challenge(CephContext *cct, bufferlist& challenge) = 0;
 };
 

diff --git a/src/auth/AuthAuthorizeHandler.h b/src/auth/AuthAuthorizeHandler.h
index 45778836e36004d35c380076efa47a8e59592bb0..df4643c8cb072eb865355ed2eb71845e3c281db9 100644 (file)
--- a/src/auth/AuthAuthorizeHandler.h
+++ b/src/auth/AuthAuthorizeHandler.h
@@ -30,11 +30,17 @@ class KeyRing;
 
 struct AuthAuthorizeHandler {
   virtual ~AuthAuthorizeHandler() {}
-  virtual bool verify_authorizer(CephContext *cct, KeyStore *keys,
-                                bufferlist& authorizer_data, bufferlist& authorizer_reply,
-                                 EntityName& entity_name, uint64_t& global_id,
-                                AuthCapsInfo& caps_info, CryptoKey& session_key,
-                                std::unique_ptr<AuthAuthorizerChallenge> *challenge) = 0;
+  virtual bool verify_authorizer(
+    CephContext *cct,
+    KeyStore *keys,
+    bufferlist& authorizer_data,
+    bufferlist& authorizer_reply,
+    EntityName& entity_name,
+    uint64_t& global_id,
+    AuthCapsInfo& caps_info,
+    CryptoKey& session_key,
+    CryptoKey *connection_secret,
+    std::unique_ptr<AuthAuthorizerChallenge> *challenge) = 0;
   virtual int authorizer_session_crypto() = 0;
 };
 

diff --git a/src/auth/AuthSessionHandler.cc b/src/auth/AuthSessionHandler.cc
index 69fe9a7bb74f09209210f9016bb06ca8a50bed0e..3e92051455a7d7ebcc7e7dbb6d2108f4dc6342dd 100644 (file)
--- a/src/auth/AuthSessionHandler.cc
+++ b/src/auth/AuthSessionHandler.cc
@@ -24,7 +24,11 @@
 #define dout_subsys ceph_subsys_auth
 
 
-AuthSessionHandler *get_auth_session_handler(CephContext *cct, int protocol, CryptoKey key, uint64_t features)
+AuthSessionHandler *get_auth_session_handler(
+  CephContext *cct, int protocol,
+  const CryptoKey& key,
+  const CryptoKey& connection_secret,
+  uint64_t features)
 {
 
   // Should add code to only print the SHA1 hash of the key, unless in secure debugging mode
@@ -37,14 +41,14 @@ AuthSessionHandler *get_auth_session_handler(CephContext *cct, int protocol, Cry
     if (key.get_type() == CEPH_CRYPTO_NONE) {
       return nullptr;
     }
-    return new CephxSessionHandler(cct, key, features);
+    return new CephxSessionHandler(cct, key, connection_secret, features);
   case CEPH_AUTH_NONE:
-    return new AuthNoneSessionHandler(cct, key);
+    return new AuthNoneSessionHandler(cct, key, connection_secret);
   case CEPH_AUTH_UNKNOWN:
-    return new AuthUnknownSessionHandler(cct, key);
+    return new AuthUnknownSessionHandler(cct, key, connection_secret);
 #ifdef HAVE_GSSAPI
   case CEPH_AUTH_GSS: 
-    return new KrbSessionHandler(cct, key);
+    return new KrbSessionHandler(cct, key, connection_secret);
 #endif
   default:
     return nullptr;

diff --git a/src/auth/AuthSessionHandler.h b/src/auth/AuthSessionHandler.h
index 65e593c4d2ff4efdb0afaaf07e18f52e1a7e1f78..89015c839f8c923cd58bec2b8aa99fb238df6fdf 100644 (file)
--- a/src/auth/AuthSessionHandler.h
+++ b/src/auth/AuthSessionHandler.h
@@ -30,13 +30,19 @@ struct AuthSessionHandler {
 protected:
   CephContext *cct;
   int protocol;
-  CryptoKey key;
+  CryptoKey key;                // per mon authentication
+  CryptoKey connection_secret;  // per connection
 
 public:
   explicit AuthSessionHandler(CephContext *cct_) : cct(cct_), protocol(CEPH_AUTH_UNKNOWN) {}
 
-  AuthSessionHandler(CephContext *cct_, int protocol_, CryptoKey key_) : cct(cct_),
-    protocol(protocol_), key(key_) {}
+  AuthSessionHandler(CephContext *cct_, int protocol_,
+                    const CryptoKey& key_,
+                    const CryptoKey& cs_)
+    : cct(cct_),
+      protocol(protocol_),
+      key(key_),
+      connection_secret(cs_) {}
   virtual ~AuthSessionHandler() { }
 
   virtual bool no_security() = 0;
@@ -60,7 +66,10 @@ public:
 
 };
 
-extern AuthSessionHandler *get_auth_session_handler(CephContext *cct, int protocol, CryptoKey key,
-                                                   uint64_t features);
+extern AuthSessionHandler *get_auth_session_handler(
+  CephContext *cct, int protocol,
+  const CryptoKey& key,
+  const CryptoKey& connection_secret,
+  uint64_t features);
 
 #endif

diff --git a/src/auth/cephx/CephxAuthorizeHandler.cc b/src/auth/cephx/CephxAuthorizeHandler.cc
index 8e1c778dceea829fe8b189874334e96192ce2250..46fd050abdab18a2c8f6713343ae17895f78cb91 100644 (file)
--- a/src/auth/cephx/CephxAuthorizeHandler.cc
+++ b/src/auth/cephx/CephxAuthorizeHandler.cc
@@ -7,10 +7,15 @@
 
 
 bool CephxAuthorizeHandler::verify_authorizer(
-  CephContext *cct, KeyStore *keys,
-  bufferlist& authorizer_data, bufferlist& authorizer_reply,
-  EntityName& entity_name, uint64_t& global_id, AuthCapsInfo& caps_info,
+  CephContext *cct,
+  KeyStore *keys,
+  bufferlist& authorizer_data,
+  bufferlist& authorizer_reply,
+  EntityName& entity_name,
+  uint64_t& global_id,
+  AuthCapsInfo& caps_info,
   CryptoKey& session_key,
+  CryptoKey *connection_secret,
   std::unique_ptr<AuthAuthorizerChallenge> *challenge)
 {
   auto iter = authorizer_data.cbegin();
@@ -22,7 +27,8 @@ bool CephxAuthorizeHandler::verify_authorizer(
 
   CephXServiceTicketInfo auth_ticket_info;
 
-  bool isvalid = cephx_verify_authorizer(cct, keys, iter, auth_ticket_info, challenge,
+  bool isvalid = cephx_verify_authorizer(cct, keys, iter, auth_ticket_info,
+                                        challenge, connection_secret,
                                         authorizer_reply);
 
   if (isvalid) {

diff --git a/src/auth/cephx/CephxAuthorizeHandler.h b/src/auth/cephx/CephxAuthorizeHandler.h
index ab11d2c37cb1fc424c120d3168ff4ebc0886613c..446906849ddc1422ab016610996d2ca17507e683 100644 (file)
--- a/src/auth/cephx/CephxAuthorizeHandler.h
+++ b/src/auth/cephx/CephxAuthorizeHandler.h
@@ -20,11 +20,17 @@
 class CephContext;
 
 struct CephxAuthorizeHandler : public AuthAuthorizeHandler {
-  bool verify_authorizer(CephContext *cct, KeyStore *keys,
-                        bufferlist& authorizer_data, bufferlist& authorizer_reply,
-                         EntityName& entity_name, uint64_t& global_id,
-                        AuthCapsInfo& caps_info, CryptoKey& session_key,
-                        std::unique_ptr<AuthAuthorizerChallenge> *challenge) override;
+  bool verify_authorizer(
+    CephContext *cct,
+    KeyStore *keys,
+    bufferlist& authorizer_data,
+    bufferlist& authorizer_reply,
+    EntityName& entity_name,
+    uint64_t& global_id,
+    AuthCapsInfo& caps_info,
+    CryptoKey& session_key,
+    CryptoKey *connection_secret,
+    std::unique_ptr<AuthAuthorizerChallenge> *challenge) override;
   int authorizer_session_crypto() override;
 };
 

diff --git a/src/auth/cephx/CephxProtocol.cc b/src/auth/cephx/CephxProtocol.cc
index d57c6e768eedde614e70c03c291423452fe32e36..07cfb00ec8022cbeca5478b6fd00adb3aa6c681d 100644 (file)
--- a/src/auth/cephx/CephxProtocol.cc
+++ b/src/auth/cephx/CephxProtocol.cc
@@ -394,6 +394,7 @@ bool cephx_verify_authorizer(CephContext *cct, KeyStore *keys,
                             bufferlist::const_iterator& indata,
                             CephXServiceTicketInfo& ticket_info,
                             std::unique_ptr<AuthAuthorizerChallenge> *challenge,
+                            CryptoKey *connection_secret,
                             bufferlist& reply_bl)
 {
   __u8 authorizer_v;
@@ -403,7 +404,6 @@ bool cephx_verify_authorizer(CephContext *cct, KeyStore *keys,
   // ticket blob
   CephXTicketBlob ticket;
 
-
   try {
     decode(authorizer_v, indata);
     decode(global_id, indata);
@@ -492,6 +492,16 @@ bool cephx_verify_authorizer(CephContext *cct, KeyStore *keys,
   CephXAuthorizeReply reply;
   // reply.trans_id = auth_msg.trans_id;
   reply.nonce_plus_one = auth_msg.nonce + 1;
+  if (connection_secret) {
+    // generate a connection secret
+    bufferptr bp;
+    CryptoHandler *crypto = cct->get_crypto_handler(CEPH_CRYPTO_AES);
+    assert(crypto);
+    int r = crypto->create(cct->random(), bp);
+    assert(r >= 0);
+    connection_secret->set_secret(CEPH_CRYPTO_AES, bp, ceph_clock_now());
+    reply.connection_secret = *connection_secret;
+  }
   if (encode_encrypt(cct, reply, ticket_info.session_key, reply_bl, error)) {
     ldout(cct, 10) << "verify_authorizer: encode_encrypt error: " << error << dendl;
     return false;
@@ -502,7 +512,8 @@ bool cephx_verify_authorizer(CephContext *cct, KeyStore *keys,
   return true;
 }
 
-bool CephXAuthorizer::verify_reply(bufferlist::const_iterator& indata)
+bool CephXAuthorizer::verify_reply(bufferlist::const_iterator& indata,
+                                  CryptoKey *connection_secret)
 {
   CephXAuthorizeReply reply;
 
@@ -518,6 +529,11 @@ bool CephXAuthorizer::verify_reply(bufferlist::const_iterator& indata)
            << " sent " << nonce << dendl;
     return false;
   }
+
+  if (connection_secret &&
+      reply.connection_secret.get_type()) {
+    *connection_secret = reply.connection_secret;
+  }
   return true;
 }
 

diff --git a/src/auth/cephx/CephxProtocol.h b/src/auth/cephx/CephxProtocol.h
index 4629bba80add486b9d6cee80b0a5ee55f5f71b6d..f1268d730a67a5367baa06064b78654ed45bf5c6 100644 (file)
--- a/src/auth/cephx/CephxProtocol.h
+++ b/src/auth/cephx/CephxProtocol.h
@@ -268,17 +268,28 @@ WRITE_CLASS_ENCODER(CephXServiceTicketRequest)
 
 struct CephXAuthorizeReply {
   uint64_t nonce_plus_one;
+  CryptoKey connection_secret;
   void encode(bufferlist& bl) const {
     using ceph::encode;
     __u8 struct_v = 1;
+    if (connection_secret.get_type()) {
+      struct_v = 2;
+    }
     encode(struct_v, bl);
     encode(nonce_plus_one, bl);
+    if (struct_v >= 2) {
+      struct_v = 2;
+      encode(connection_secret, bl);
+    }
   }
   void decode(bufferlist::const_iterator& bl) {
     using ceph::decode;
     __u8 struct_v;
     decode(struct_v, bl);
     decode(nonce_plus_one, bl);
+    if (struct_v >= 2) {
+      decode(connection_secret, bl);
+    }
   }
 };
 WRITE_CLASS_ENCODER(CephXAuthorizeReply)
@@ -295,7 +306,8 @@ public:
     : AuthAuthorizer(CEPH_AUTH_CEPHX), cct(cct_), nonce(0) {}
 
   bool build_authorizer();
-  bool verify_reply(bufferlist::const_iterator& reply) override;
+  bool verify_reply(bufferlist::const_iterator& reply,
+                   CryptoKey *connection_secret) override;
   bool add_challenge(CephContext *cct, bufferlist& challenge) override;
 };
 
@@ -463,6 +475,7 @@ extern bool cephx_verify_authorizer(
   bufferlist::const_iterator& indata,
   CephXServiceTicketInfo& ticket_info,
   std::unique_ptr<AuthAuthorizerChallenge> *challenge,
+  CryptoKey *connection_secret,
   bufferlist& reply_bl);
 
 

diff --git a/src/auth/cephx/CephxServiceHandler.cc b/src/auth/cephx/CephxServiceHandler.cc
index c7c75a04a6d315dfe5b7ee42316ad4571e4b9e7a..4bd197ae5a746687ceed47055ceae3812cca6810 100644 (file)
--- a/src/auth/cephx/CephxServiceHandler.cc
+++ b/src/auth/cephx/CephxServiceHandler.cc
@@ -151,8 +151,11 @@ int CephxServiceHandler::handle_request(bufferlist::const_iterator& indata, buff
       bufferlist tmp_bl;
       CephXServiceTicketInfo auth_ticket_info;
       // note: no challenge here.
-      if (!cephx_verify_authorizer(cct, key_server, indata, auth_ticket_info, nullptr,
-                                  tmp_bl)) {
+      if (!cephx_verify_authorizer(
+           cct, key_server, indata, auth_ticket_info, nullptr,
+#warning FIXME mon connection needs connection_secret too
+           nullptr,
+           tmp_bl)) {
         ret = -EPERM;
        break;
       }

diff --git a/src/auth/cephx/CephxSessionHandler.h b/src/auth/cephx/CephxSessionHandler.h
index 5e37e1656728668a436d81fd36e32c4e412b11b6..19147b8a1699c229a2a82844b1f1baa983c9aac0 100644 (file)
--- a/src/auth/cephx/CephxSessionHandler.h
+++ b/src/auth/cephx/CephxSessionHandler.h
@@ -23,8 +23,11 @@ class CephxSessionHandler  : public AuthSessionHandler {
   uint64_t features;
 
 public:
-  CephxSessionHandler(CephContext *cct_, CryptoKey session_key, uint64_t features)
-    : AuthSessionHandler(cct_, CEPH_AUTH_CEPHX, session_key),
+  CephxSessionHandler(CephContext *cct_,
+                     const CryptoKey& session_key,
+                     const CryptoKey& connection_secret,
+                     uint64_t features)
+    : AuthSessionHandler(cct_, CEPH_AUTH_CEPHX, session_key, connection_secret),
       features(features) {}
   ~CephxSessionHandler() override {}
 

diff --git a/src/auth/krb/KrbAuthorizeHandler.cpp b/src/auth/krb/KrbAuthorizeHandler.cpp
index cd84b8a9f0e9fc9069d9c5b231eab76efe3f7887..3720266028007e195bd0362e6aea45970b178b0e 100644 (file)
--- a/src/auth/krb/KrbAuthorizeHandler.cpp
+++ b/src/auth/krb/KrbAuthorizeHandler.cpp
@@ -26,7 +26,8 @@ bool KrbAuthorizeHandler::verify_authorizer(CephContext* ceph_ctx,
                                             EntityName& entity_name, 
                                             uint64_t& global_id,  
                                             AuthCapsInfo& caps_info, 
-                                            CryptoKey& session_key, 
+                                            CryptoKey& session_key,
+                                           CryptoKey *connection_secret,
                                             std::unique_ptr<
                                               AuthAuthorizerChallenge>* challenge)
 {

diff --git a/src/auth/krb/KrbAuthorizeHandler.hpp b/src/auth/krb/KrbAuthorizeHandler.hpp
index d5f16eef850a66cb1e8d07acd40333d1e87a7afa..03277a2f19cdf3b6d8d3e52ec84b676e15092243 100644 (file)
--- a/src/auth/krb/KrbAuthorizeHandler.hpp
+++ b/src/auth/krb/KrbAuthorizeHandler.hpp
@@ -22,7 +22,8 @@ class KrbAuthorizeHandler : public AuthAuthorizeHandler {
   bool verify_authorizer(CephContext*, KeyStore*, 
                          bufferlist&, bufferlist&,
                          EntityName&, uint64_t&, 
-                         AuthCapsInfo&, CryptoKey&, 
+                         AuthCapsInfo&, CryptoKey&,
+                        CryptoKey *connection_secret,
                          std::unique_ptr<
                           AuthAuthorizerChallenge>* = nullptr) override;
 

diff --git a/src/auth/krb/KrbProtocol.hpp b/src/auth/krb/KrbProtocol.hpp
index 0081dfcfa108c3e0b0c4afe381d334131d03f07c..5b91d153869106b7205fd3316bea300940dbf4b8 100644 (file)
--- a/src/auth/krb/KrbProtocol.hpp
+++ b/src/auth/krb/KrbProtocol.hpp
@@ -85,7 +85,8 @@ class KrbAuthorizer : public AuthAuthorizer {
       return false;
     }
 
-    bool verify_reply(bufferlist::const_iterator& buff_list) override { 
+    bool verify_reply(bufferlist::const_iterator& buff_list,
+                     CryptoKey *connection_secret) override { 
       return true; 
     }
     bool add_challenge(CephContext* ceph_ctx, 

diff --git a/src/auth/krb/KrbSessionHandler.hpp b/src/auth/krb/KrbSessionHandler.hpp
index e01b6de5128e5aeb468f9bb2520109c64dfdafab..a38bbbba10e84b894b83aa2b4e61f8a8c5100607 100644 (file)
--- a/src/auth/krb/KrbSessionHandler.hpp
+++ b/src/auth/krb/KrbSessionHandler.hpp
@@ -36,8 +36,11 @@ class Message;
 class KrbSessionHandler : public AuthSessionHandler {
 
   public:
-    KrbSessionHandler(CephContext* ceph_ctx, CryptoKey session_key) : 
-        AuthSessionHandler(ceph_ctx, CEPH_AUTH_GSS, session_key) { }
+    KrbSessionHandler(CephContext* ceph_ctx,
+                     const CryptoKey& session_key,
+                     const CryptoKey& connection_secret) : 
+      AuthSessionHandler(ceph_ctx, CEPH_AUTH_GSS, session_key,
+                        connection_secret) { }
     ~KrbSessionHandler() override = default; 
 
     bool no_security() override { return true; }

diff --git a/src/auth/none/AuthNoneAuthorizeHandler.cc b/src/auth/none/AuthNoneAuthorizeHandler.cc
index 723b463fe9260317f81d0ccd4cdff69c466891d3..4e0974086f80667b76b74c5ba696b1344e375652 100644 (file)
--- a/src/auth/none/AuthNoneAuthorizeHandler.cc
+++ b/src/auth/none/AuthNoneAuthorizeHandler.cc
@@ -22,6 +22,7 @@ bool AuthNoneAuthorizeHandler::verify_authorizer(
   bufferlist& authorizer_data, bufferlist& authorizer_reply,
   EntityName& entity_name, uint64_t& global_id, AuthCapsInfo& caps_info,
   CryptoKey& session_key,
+  CryptoKey *connection_secret,
   std::unique_ptr<AuthAuthorizerChallenge> *challenge)
 {
   auto iter = authorizer_data.cbegin();

diff --git a/src/auth/none/AuthNoneAuthorizeHandler.h b/src/auth/none/AuthNoneAuthorizeHandler.h
index 7dcd029b8e39648652a0e9003eab2ad1e3b9333a..d6853c4884a25cc80ae8f7bbee761261d9bff32c 100644 (file)
--- a/src/auth/none/AuthNoneAuthorizeHandler.h
+++ b/src/auth/none/AuthNoneAuthorizeHandler.h
@@ -20,11 +20,13 @@
 class CephContext;
 
 struct AuthNoneAuthorizeHandler : public AuthAuthorizeHandler {
-  bool verify_authorizer(CephContext *cct, KeyStore *keys,
-                        bufferlist& authorizer_data, bufferlist& authorizer_reply,
-                         EntityName& entity_name, uint64_t& global_id,
-                        AuthCapsInfo& caps_info, CryptoKey& session_key,
-                        std::unique_ptr<AuthAuthorizerChallenge> *challenge) override;
+  bool verify_authorizer(
+    CephContext *cct, KeyStore *keys,
+    bufferlist& authorizer_data, bufferlist& authorizer_reply,
+    EntityName& entity_name, uint64_t& global_id,
+    AuthCapsInfo& caps_info, CryptoKey& session_key,
+    CryptoKey *connection_secret,
+    std::unique_ptr<AuthAuthorizerChallenge> *challenge) override;
   int authorizer_session_crypto() override;
 };
 

diff --git a/src/auth/none/AuthNoneProtocol.h b/src/auth/none/AuthNoneProtocol.h
index 64865355eae9cfb2ba8e49700fe14376523ea24f..d5c2677a6810c7678f84236a53b3f30899000cfd 100644 (file)
--- a/src/auth/none/AuthNoneProtocol.h
+++ b/src/auth/none/AuthNoneProtocol.h
@@ -28,7 +28,8 @@ struct AuthNoneAuthorizer : public AuthAuthorizer {
     encode(global_id, bl);
     return 0;
   }
-  bool verify_reply(bufferlist::const_iterator& reply) override { return true; }
+  bool verify_reply(bufferlist::const_iterator& reply,
+                   CryptoKey *connection_secret) override { return true; }
   bool add_challenge(CephContext *cct, bufferlist& ch) override { return true; }
 };
 

diff --git a/src/auth/none/AuthNoneSessionHandler.h b/src/auth/none/AuthNoneSessionHandler.h
index a65b227fd5137df97057ce58d53aa288f7695b24..d4b033a9c451edacb2ca2fbc01f523c788a84cfb 100644 (file)
--- a/src/auth/none/AuthNoneSessionHandler.h
+++ b/src/auth/none/AuthNoneSessionHandler.h
@@ -19,8 +19,10 @@ class CephContext;
 
 class AuthNoneSessionHandler  : public AuthSessionHandler {
 public:
-  AuthNoneSessionHandler(CephContext *cct_, CryptoKey session_key)
-    : AuthSessionHandler(cct_, CEPH_AUTH_NONE, session_key) {}
+  AuthNoneSessionHandler(CephContext *cct_,
+                        const CryptoKey& session_key,
+                        const CryptoKey& connection_secret)
+    : AuthSessionHandler(cct_, CEPH_AUTH_NONE, session_key, connection_secret) {}
   ~AuthNoneSessionHandler() override {}
   
   bool no_security() override {

diff --git a/src/auth/unknown/AuthUnknownAuthorizeHandler.cc b/src/auth/unknown/AuthUnknownAuthorizeHandler.cc
index 1f59401fe41cdbb82e937b188ff9a8c932c217f2..af7bd2d25b1b2858a88c82f8bacc8028673d786e 100644 (file)
--- a/src/auth/unknown/AuthUnknownAuthorizeHandler.cc
+++ b/src/auth/unknown/AuthUnknownAuthorizeHandler.cc
@@ -19,6 +19,7 @@ bool AuthUnknownAuthorizeHandler::verify_authorizer(
   bufferlist& authorizer_data, bufferlist& authorizer_reply,
   EntityName& entity_name, uint64_t& global_id, AuthCapsInfo& caps_info,
   CryptoKey& session_key,
+  CryptoKey *connection_secret,
   std::unique_ptr<AuthAuthorizerChallenge> *challenge)
 {
   // For unknown authorizers, there's nothing to verify.  They're "OK" by definition.  PLR

diff --git a/src/auth/unknown/AuthUnknownAuthorizeHandler.h b/src/auth/unknown/AuthUnknownAuthorizeHandler.h
index fdbcd1c3d95b85c93bace7b8365638db70363a8b..6c9d056ac10b6448dbd796406518d5b3a2c4efdb 100644 (file)
--- a/src/auth/unknown/AuthUnknownAuthorizeHandler.h
+++ b/src/auth/unknown/AuthUnknownAuthorizeHandler.h
@@ -24,6 +24,7 @@ struct AuthUnknownAuthorizeHandler : public AuthAuthorizeHandler {
                         bufferlist& authorizer_data, bufferlist& authorizer_reply,
                          EntityName& entity_name, uint64_t& global_id,
                         AuthCapsInfo& caps_info, CryptoKey& session_key,
+                        CryptoKey *connection_secret,
                         std::unique_ptr<AuthAuthorizerChallenge> *challenge) override;
   int authorizer_session_crypto() override;
 };

diff --git a/src/auth/unknown/AuthUnknownSessionHandler.h b/src/auth/unknown/AuthUnknownSessionHandler.h
index d78a6d21aaa36c32347c5013c64df9f5fc10336e..e7810562c0bfe407377de4b335336d7adf5bfe00 100644 (file)
--- a/src/auth/unknown/AuthUnknownSessionHandler.h
+++ b/src/auth/unknown/AuthUnknownSessionHandler.h
@@ -21,8 +21,11 @@ class CephContext;
 
 class AuthUnknownSessionHandler  : public AuthSessionHandler {
 public:
-  AuthUnknownSessionHandler(CephContext *cct_, CryptoKey session_key)
-    : AuthSessionHandler(cct_, CEPH_AUTH_UNKNOWN, session_key) {}
+  AuthUnknownSessionHandler(CephContext *cct_,
+                           const CryptoKey& session_key,
+                           const CryptoKey& connection_secret)
+    : AuthSessionHandler(cct_, CEPH_AUTH_UNKNOWN,
+                        session_key, connection_secret) {}
   ~AuthUnknownSessionHandler() override {}
   
   bool no_security() override {

diff --git a/src/msg/Messenger.cc b/src/msg/Messenger.cc
index d7dc58fc0a6c714fe2311e65e683fe87384f3179..7569acbb34155e22c5dc9a2527f789e38dc2d709 100644 (file)
--- a/src/msg/Messenger.cc
+++ b/src/msg/Messenger.cc
@@ -157,6 +157,7 @@ bool Messenger::ms_deliver_verify_authorizer(
   bufferlist& authorizer_reply,
   bool& isvalid,
   CryptoKey& session_key,
+  CryptoKey *connection_secret,
   std::unique_ptr<AuthAuthorizerChallenge> *challenge)
 {
   if (authorizer.length() == 0) {
@@ -203,6 +204,7 @@ bool Messenger::ms_deliver_verify_authorizer(
        con->peer_global_id,
        con->peer_caps_info,
        session_key,
+       connection_secret,
        challenge);
       if (isvalid) {
        dis->ms_handle_authentication(con);

diff --git a/src/msg/Messenger.h b/src/msg/Messenger.h
index 6e26bf52827171d32f610d1d7a7a3eee63dab828..4c41dfce95ed899919741687c9ff5513d6a7da96 100644 (file)
--- a/src/msg/Messenger.h
+++ b/src/msg/Messenger.h
@@ -784,6 +784,7 @@ public:
     Connection *con, int peer_type,
     int protocol, bufferlist& authorizer, bufferlist& authorizer_reply,
     bool& isvalid, CryptoKey& session_key,
+    CryptoKey *connection_secret,
     std::unique_ptr<AuthAuthorizerChallenge> *challenge);
 
   /**

diff --git a/src/msg/async/ProtocolV1.cc b/src/msg/async/ProtocolV1.cc
index cccaa6183b855fccf0f69dbd2c11aeaa56efe5ad..781518c132235751784804a5e7641d71d953dfb8 100644 (file)
--- a/src/msg/async/ProtocolV1.cc
+++ b/src/msg/async/ProtocolV1.cc
@@ -1525,7 +1525,8 @@ CtPtr ProtocolV1::handle_connect_reply_auth(char *buffer, int r) {
   }
 
   auto iter = authorizer_reply.cbegin();
-  if (authorizer && !authorizer->verify_reply(iter)) {
+  if (authorizer && !authorizer->verify_reply(iter,
+                                             nullptr /* connection_secret */)) {
     ldout(cct, 0) << __func__ << " failed verifying authorize reply" << dendl;
     return _fault();
   }
@@ -1681,6 +1682,7 @@ CtPtr ProtocolV1::client_ready() {
                   << authorizer << dendl;
     session_security.reset(get_auth_session_handler(
         cct, authorizer->protocol, authorizer->session_key,
+       authorizer->session_key /* connection_secret */,
         connection->get_features()));
   } else {
     // We have no authorizer, so we shouldn't be applying security to messages
@@ -1913,6 +1915,7 @@ CtPtr ProtocolV1::handle_connect_message_2() {
   if (!messenger->ms_deliver_verify_authorizer(
           connection, connection->peer_type, connect_msg.authorizer_protocol,
           authorizer_buf, authorizer_reply, authorizer_valid, session_key,
+         nullptr /* connection_secret */,
           need_challenge ? &authorizer_challenge : nullptr) ||
       !authorizer_valid) {
     connection->lock.lock();
@@ -2346,7 +2349,9 @@ CtPtr ProtocolV1::open(ceph_msg_connect_reply &reply,
 
   session_security.reset(
       get_auth_session_handler(cct, connect_msg.authorizer_protocol,
-                               session_key, connection->get_features()));
+                               session_key,
+                              session_key /* connection secret */,
+                              connection->get_features()));
 
   bufferlist reply_bl;
   reply_bl.append((char *)&reply, sizeof(reply));

diff --git a/src/msg/async/ProtocolV2.cc b/src/msg/async/ProtocolV2.cc
index ddb37afba1ab8548c4046e6096d420a3612c7a87..856c450e6cb3e436d67fdb892e7f165ddb05be6d 100644 (file)
--- a/src/msg/async/ProtocolV2.cc
+++ b/src/msg/async/ProtocolV2.cc
@@ -2128,10 +2128,10 @@ CtPtr ProtocolV2::handle_auth_done(char *payload, uint32_t length) {
   ldout(cct, 20) << __func__ << " payload_len=" << length << dendl;
 
   AuthDoneFrame auth_done(payload, length);
-
+  CryptoKey connection_secret;
   if (authorizer) {
     auto iter = auth_done.auth_payload().cbegin();
-    if (!authorizer->verify_reply(iter)) {
+    if (!authorizer->verify_reply(iter, &connection_secret)) {
       ldout(cct, 0) << __func__ << " failed verifying authorize reply" << dendl;
       return _fault();
     }
@@ -2146,6 +2146,7 @@ CtPtr ProtocolV2::handle_auth_done(char *payload, uint32_t length) {
                    << authorizer << dendl;
     session_security.reset(get_auth_session_handler(
         cct, authorizer->protocol, authorizer->session_key,
+       connection_secret,
         CEPH_FEATURE_MSG_AUTH | CEPH_FEATURE_CEPHX_V2));
     auth_flags = auth_done.flags();
   } else {
@@ -2365,9 +2366,10 @@ CtPtr ProtocolV2::handle_cephx_auth(bufferlist &auth_payload) {
 
   connection->lock.unlock();
   if (!messenger->ms_deliver_verify_authorizer(
-          connection, connection->peer_type, auth_method, auth_payload,
-          authorizer_reply, authorizer_valid, session_key,
-          &authorizer_challenge) ||
+       connection, connection->peer_type, auth_method, auth_payload,
+       authorizer_reply, authorizer_valid, session_key,
+       &connection_secret,
+       &authorizer_challenge) ||
       !authorizer_valid) {
     connection->lock.lock();
 
@@ -2389,6 +2391,7 @@ CtPtr ProtocolV2::handle_cephx_auth(bufferlist &auth_payload) {
 
   session_security.reset(
       get_auth_session_handler(cct, auth_method, session_key,
+                              connection_secret,
                                CEPH_FEATURE_MSG_AUTH | CEPH_FEATURE_CEPHX_V2));
 
   if (cct->_conf.get_val<bool>("ms_msgr2_sign_messages")) {
@@ -2446,7 +2449,9 @@ CtPtr ProtocolV2::handle_auth_request(char *payload, uint32_t length) {
     messenger->ms_deliver_verify_authorizer(
         connection, connection->peer_type, auth_method,
         auth_request.auth_payload(), authorizer_reply, authorizer_valid,
-        session_key, nullptr);
+        session_key,
+       nullptr /* connection_secret */,
+       nullptr);
     connection->lock.lock();
 
     if (!authorizer_valid) {

diff --git a/src/msg/async/ProtocolV2.h b/src/msg/async/ProtocolV2.h
index 718eb1f225ba0ca5aae406aa09b2914f6b27a674..c45b429d959dba7cd010b27d5212edbd311f415d 100644 (file)
--- a/src/msg/async/ProtocolV2.h
+++ b/src/msg/async/ProtocolV2.h
@@ -78,6 +78,7 @@ private:
   bool got_bad_auth;
   uint32_t got_bad_method;
   CryptoKey session_key;
+  CryptoKey connection_secret;
   std::shared_ptr<AuthSessionHandler> session_security;
   std::unique_ptr<AuthAuthorizerChallenge> authorizer_challenge;
   uint64_t auth_flags;

diff --git a/src/msg/simple/Pipe.cc b/src/msg/simple/Pipe.cc
index de933aa49df338b78d0b5c9e19f2ecbb7986339a..44886ce361c41e27ff545fbf01de8153dc2843dd 100644 (file)
--- a/src/msg/simple/Pipe.cc
+++ b/src/msg/simple/Pipe.cc
@@ -526,6 +526,7 @@ int Pipe::accept()
     if (!msgr->ms_deliver_verify_authorizer(
          connection_state.get(), peer_type, connect.authorizer_protocol, authorizer,
          authorizer_reply, authorizer_valid, session_key,
+         nullptr /* connection_secret */,
          need_challenge ? &authorizer_challenge : nullptr) ||
        !authorizer_valid) {
       pipe_lock.Lock();
@@ -817,6 +818,7 @@ int Pipe::accept()
       get_auth_session_handler(msgr->cct,
                               connect.authorizer_protocol,
                               session_key,
+                              session_key, /* connection_secret */
                               connection_state->get_features()));
 
   // notify
@@ -1223,7 +1225,7 @@ int Pipe::connect()
 
     if (authorizer) {
       auto iter = authorizer_reply.cbegin();
-      if (!authorizer->verify_reply(iter)) {
+      if (!authorizer->verify_reply(iter, nullptr /* connection_secret */)) {
         ldout(msgr->cct,0) << "failed verifying authorize reply" << dendl;
        goto fail;
       }
@@ -1339,10 +1341,12 @@ int Pipe::connect()
 
       if (authorizer != NULL) {
        session_security.reset(
-            get_auth_session_handler(msgr->cct,
-                                    authorizer->protocol,
-                                    authorizer->session_key,
-                                    connection_state->get_features()));
+            get_auth_session_handler(
+             msgr->cct,
+             authorizer->protocol,
+             authorizer->session_key,
+             authorizer->session_key /* connection secret*/,
+             connection_state->get_features()));
       }  else {
         // We have no authorizer, so we shouldn't be applying security to messages in this pipe.  PLR
        session_security.reset();