auth: rewrite second authentication stage

diff --git a/src/auth/Auth.cc b/src/auth/Auth.cc
index c3692a2daa6034381e34060990a9873070291988..f25fc8e9c29a797402883876916d9ba1b107d1b2 100644 (file)
--- a/src/auth/Auth.cc
+++ b/src/auth/Auth.cc
@@ -164,27 +164,24 @@ bool build_get_tgt_reply(PrincipalTicket& principal_ticket, CryptoKey& principal
  *        F= {principal/service session key, validity}^principal/auth session key
  *
  */
-bool build_ticket_reply(ServiceTicket service_ticket, CryptoKey auth_session_key, CryptoKey& service_secret,
+bool build_ticket_reply(ServiceTicket service_ticket,
+                        CryptoKey session_key,
+                        CryptoKey auth_session_key,
+                        CryptoKey& service_secret,
                        bufferlist& reply)
 {
-  bufferlist ticket, enc_ticket;
+  AuthMsg_E e;
 
-  /* E */
-  ::encode(service_ticket, ticket);
-  if (service_secret.encrypt(ticket, enc_ticket) < 0) {
+  e.ticket = service_ticket;
+  if (e.encode_encrypt(service_secret, reply) < 0)
     return false;
-  }
-
-  bufferlist principal, principal_enc;
 
-  ::encode(service_ticket.session_key, principal);
-  
-  if (service_secret.encrypt(principal, principal_enc) < 0) {
-    return false;
-  }
 
-  ::encode(enc_ticket, reply);
-  ::encode(principal_enc, reply);
+   AuthMsg_F f;
+   f.session_key = session_key;
+   f.validity = 0; /* FIXME */
+   if (f.encode_encrypt(auth_session_key, reply) < 0)
+     return false;
   
   return true;
 }

diff --git a/src/auth/Auth.h b/src/auth/Auth.h
index b5c43e0fb690331e8cd3e796afe164847402c914..80d871932cf45f77f10df63f42bf6f9a76c7b6c1 100644 (file)
--- a/src/auth/Auth.h
+++ b/src/auth/Auth.h
@@ -261,7 +261,10 @@ WRITE_CLASS_ENCODER(AuthMsg_F);
 extern bool verify_get_session_keys_request(CryptoKey& service_secret,
                                      CryptoKey& session_key, uint32_t& keys, bufferlist::iterator& indata);
 
-extern bool build_ticket_reply(ServiceTicket service_ticket, CryptoKey auth_session_key, CryptoKey& service_secret,
+extern bool build_ticket_reply(ServiceTicket service_ticket,
+                        CryptoKey session_key,
+                        CryptoKey auth_session_key,
+                        CryptoKey& service_secret,
                        bufferlist& reply);
 /*
  * Verify authenticator and generate reply authenticator

diff --git a/src/auth/AuthServiceManager.cc b/src/auth/AuthServiceManager.cc
index eb14a56d7310129864e86a492c63ad3d65a8353a..abf03e89d9c8c5f789e96c51f0fee1a270e5244b 100644 (file)
--- a/src/auth/AuthServiceManager.cc
+++ b/src/auth/AuthServiceManager.cc
@@ -25,6 +25,7 @@
 /* FIXME */
 #define SERVICE_SECRET   "0123456789ABCDEF"
 #define AUTH_SESSION_KEY "23456789ABCDEF01"
+#define TEST_SESSION_KEY "456789ABCDEF0123"
 
 #define PRINCIPAL_CLIENT_SECRET "123456789ABCDEF0"
 #define PRINCIPAL_OSD_SECRET "3456789ABCDEF012"
@@ -36,6 +37,7 @@ class CephAuthServer {
   CryptoKey osd_secret;
   CryptoKey auth_session_key;
   CryptoKey service_secret;
+  CryptoKey test_session_key;
   
 public:
   CephAuthServer() {
@@ -50,7 +52,10 @@ public:
 
     bufferptr ptr4(AUTH_SESSION_KEY, sizeof(AUTH_SESSION_KEY) - 1);
     auth_session_key.set_secret(CEPH_SECRET_AES, ptr3);
-  }
+
+    bufferptr ptr5(TEST_SESSION_KEY, sizeof(TEST_SESSION_KEY) - 1);
+    test_session_key.set_secret(CEPH_SECRET_AES, ptr5);
+   }
 
 /* FIXME: temporary stabs */
   int get_client_secret(CryptoKey& secret) {
@@ -68,10 +73,15 @@ public:
     return 0;
   }
 
-  int get_session_key(CryptoKey& key) {
+  int get_auth_session_key(CryptoKey& key) {
     key = auth_session_key; 
     return 0;
   }
+
+  int get_test_session_key(CryptoKey& key) {
+    key = test_session_key; 
+    return 0;
+  }
 };
 
 
@@ -160,7 +170,7 @@ int CephAuthService_X::handle_cephx_protocol(bufferlist::iterator& indata, buffe
       ticket.expires = g_clock.now();
 
       auth_server.get_client_secret(principal_secret);
-      auth_server.get_session_key(session_key);
+      auth_server.get_auth_session_key(session_key);
       auth_server.get_service_secret(service_secret);
 
       build_cephx_response_header(request_type, 0, result_bl);
@@ -187,15 +197,17 @@ int CephAuthService_X::handle_cephx_protocol(bufferlist::iterator& indata, buffe
     {
       EntityName name; /* FIXME should take it from the request */
       entity_addr_t addr;
+      CryptoKey auth_session_key;
       CryptoKey session_key;
       CryptoKey service_secret;
       uint32_t keys;
 
-      auth_server.get_session_key(session_key);
+      auth_server.get_auth_session_key(session_key);
       auth_server.get_service_secret(service_secret);
+      auth_server.get_test_session_key(session_key);
 
       if (!verify_get_session_keys_request(service_secret,
-                                     session_key, keys, indata)) {
+                                     auth_session_key, keys, indata)) {
         ret = -EPERM;
       }
 
@@ -206,7 +218,7 @@ int CephAuthService_X::handle_cephx_protocol(bufferlist::iterator& indata, buffe
       auth_server.get_osd_secret(osd_secret);
       build_cephx_response_header(request_type, ret, result_bl);
 
-      build_ticket_reply(service_ticket, session_key, osd_secret, result_bl);
+      build_ticket_reply(service_ticket, session_key, auth_session_key, osd_secret, result_bl);
     }
     break;
   default: