auth, msg: dissect AuthStreamHandler from AuthSessionHandler.

Signed-off-by: Radoslaw Zarzynski <rzarzyns@redhat.com>

diff --git a/src/auth/AuthSessionHandler.cc b/src/auth/AuthSessionHandler.cc
index 1be86fb0950ff33415b7a0096f8e5800ef1ba6f3..528b4ac698a57dc9c297edf88554bf0840c03fe5 100644 (file)
--- a/src/auth/AuthSessionHandler.cc
+++ b/src/auth/AuthSessionHandler.cc
@@ -27,7 +27,6 @@
 AuthSessionHandler *get_auth_session_handler(
   CephContext *cct, int protocol,
   const CryptoKey& key,
-  const std::string& connection_secret,
   uint64_t features)
 {
 
@@ -41,7 +40,7 @@ AuthSessionHandler *get_auth_session_handler(
     if (key.get_type() == CEPH_CRYPTO_NONE) {
       return nullptr;
     }
-    return new CephxSessionHandler(cct, key, connection_secret, features);
+    return new CephxSessionHandler(cct, key, features);
   case CEPH_AUTH_NONE:
     return new AuthNoneSessionHandler();
   case CEPH_AUTH_UNKNOWN:
@@ -54,3 +53,10 @@ AuthSessionHandler *get_auth_session_handler(
     return nullptr;
   }
 }
+
+std::unique_ptr<AuthStreamHandler> AuthStreamHandler::create_stream_handler(
+    CephContext* ctx,
+    const class AuthConnectionMeta& auth_meta)
+{
+  return std::make_unique<AuthStreamHandler>();
+}

diff --git a/src/auth/AuthSessionHandler.h b/src/auth/AuthSessionHandler.h
index abc733cace1184227ff8e5811958f9f58b24fc82..b291e9e067d92aa73a5c4a007a232b5f20288f2e 100644 (file)
--- a/src/auth/AuthSessionHandler.h
+++ b/src/auth/AuthSessionHandler.h
@@ -30,13 +30,6 @@ struct AuthSessionHandler {
   virtual ~AuthSessionHandler() = default;
   virtual int sign_message(Message *message) = 0;
   virtual int check_message_signature(Message *message) = 0;
-
-  virtual int encrypt_bufferlist(bufferlist &in, bufferlist &out) {
-    return 0;
-  }
-  virtual int decrypt_bufferlist(bufferlist &in, bufferlist &out) {
-    return 0;
-  }
 };
 
 struct DummyAuthSessionHandler : AuthSessionHandler {
@@ -48,10 +41,29 @@ struct DummyAuthSessionHandler : AuthSessionHandler {
   }
 };
 
+// TODO: make this a static member of AuthSessionHandler.
 extern AuthSessionHandler *get_auth_session_handler(
   CephContext *cct, int protocol,
   const CryptoKey& key,
-  const std::string& connection_secret,
   uint64_t features);
 
+
+struct AuthStreamHandler {
+  virtual ~AuthStreamHandler() = default;
+  //virtual ceph::bufferlist authenticated_encrypt(ceph::bufferlist& in) = 0;
+  //virtual ceph::bufferlist authenticated_decrypt(ceph::bufferlist& in) = 0;
+
+  // TODO: kill the dummies
+  int encrypt_bufferlist(bufferlist &in, bufferlist &out) {
+    return 0;
+  }
+  int decrypt_bufferlist(bufferlist &in, bufferlist &out) {
+    return 0;
+  }
+
+  static std::unique_ptr<AuthStreamHandler> create_stream_handler(
+    CephContext* ctx,
+    const class AuthConnectionMeta& auth_meta);
+};
+
 #endif

diff --git a/src/auth/cephx/CephxSessionHandler.cc b/src/auth/cephx/CephxSessionHandler.cc
index 4b0c1cfd0d5b415d87c752fc9549b57a6a1c14c3..bf5ffe1a48ed189dae67274918886f991ccb4dad 100644 (file)
--- a/src/auth/cephx/CephxSessionHandler.cc
+++ b/src/auth/cephx/CephxSessionHandler.cc
@@ -184,7 +184,6 @@ int CephxSessionHandler::check_message_signature(Message *m)
 int CephxSessionHandler::encrypt_bufferlist(bufferlist &in, bufferlist &out) {
   std::string error;
   try {
-#warning fixme key
     key.encrypt(cct, in, out, &error);
   } catch (std::exception &e) {
     lderr(cct) << __func__ << " failed to encrypt buffer: " << error << dendl;
@@ -196,7 +195,6 @@ int CephxSessionHandler::encrypt_bufferlist(bufferlist &in, bufferlist &out) {
 int CephxSessionHandler::decrypt_bufferlist(bufferlist &in, bufferlist &out) {
   std::string error;
   try {
-#warning fixme key
     key.decrypt(cct, in, out, &error);
   } catch (std::exception &e) {
     lderr(cct) << __func__ << " failed to decrypt buffer: " << error << dendl;

diff --git a/src/auth/cephx/CephxSessionHandler.h b/src/auth/cephx/CephxSessionHandler.h
index 2829ba14b70286fa06476f3d7d8c46dd83d26e42..32a143a818b88405e3e7acc302123ea9785ccc19 100644 (file)
--- a/src/auth/cephx/CephxSessionHandler.h
+++ b/src/auth/cephx/CephxSessionHandler.h
@@ -22,8 +22,7 @@ class Message;
 class CephxSessionHandler  : public AuthSessionHandler {
   CephContext *cct;
   int protocol;
-  CryptoKey key;                  // per mon authentication
-  std::string connection_secret;  // per connection
+  CryptoKey key;                // per mon authentication
   uint64_t features;
 
   int _calc_signature(Message *m, uint64_t *psig);
@@ -31,12 +30,10 @@ class CephxSessionHandler  : public AuthSessionHandler {
 public:
   CephxSessionHandler(CephContext *cct,
                      const CryptoKey& session_key,
-                     const std::string& connection_secret,
                      const uint64_t features)
     : cct(cct),
       protocol(CEPH_AUTH_CEPHX),
       key(session_key),
-      connection_secret(connection_secret),
       features(features) {
   }
   ~CephxSessionHandler() override = default;
@@ -44,7 +41,7 @@ public:
   int sign_message(Message *m) override;
   int check_message_signature(Message *m) override ;
 
-  int encrypt_bufferlist(bufferlist &in, bufferlist &out) override;
-  int decrypt_bufferlist(bufferlist &in, bufferlist &out) override;
+  int encrypt_bufferlist(bufferlist &in, bufferlist &out);
+  int decrypt_bufferlist(bufferlist &in, bufferlist &out);
 };
 

diff --git a/src/crimson/net/SocketConnection.cc b/src/crimson/net/SocketConnection.cc
index b9a4fecb5eb3f6030d674b5347a58843ed4397f0..2907c48687140bdd05bef8b94f4afd94122a8ed9 100644 (file)
--- a/src/crimson/net/SocketConnection.cc
+++ b/src/crimson/net/SocketConnection.cc
@@ -710,14 +710,10 @@ SocketConnection::handle_connect_reply(msgr_tag_t tag)
         h.backoff = 0ms;
         set_features(h.reply.features & h.connect.features);
         if (h.authorizer) {
-          std::string connection_secret;  // this is not used here, we just need
-                                        // to make get_auth_session_handler
-                                        // call happy
           session_security.reset(
               get_auth_session_handler(nullptr,
                                        h.authorizer->protocol,
                                        h.authorizer->session_key,
-                                       connection_secret,
                                        features));
         }
         h.authorizer.reset();

diff --git a/src/msg/async/ProtocolV1.cc b/src/msg/async/ProtocolV1.cc
index 773eac11acd808eac0a14a46f1b5755110495ef9..dac1bbd5840126cf9c5ed2bdff989cb5365d6db5 100644 (file)
--- a/src/msg/async/ProtocolV1.cc
+++ b/src/msg/async/ProtocolV1.cc
@@ -1683,7 +1683,6 @@ CtPtr ProtocolV1::client_ready() {
     session_security.reset(get_auth_session_handler(
         cct, authorizer->protocol,
        authorizer->session_key,
-       string() /* connection_secret */,
         connection->get_features()));
   } else {
     // We have no authorizer, so we shouldn't be applying security to messages
@@ -2355,7 +2354,6 @@ CtPtr ProtocolV1::open(ceph_msg_connect_reply &reply,
   session_security.reset(
       get_auth_session_handler(cct, connect_msg.authorizer_protocol,
                                session_key,
-                              string() /* connection secret */,
                               connection->get_features()));
 
   bufferlist reply_bl;

diff --git a/src/msg/async/ProtocolV2.cc b/src/msg/async/ProtocolV2.cc
index 62db34e5a2ad57be6a52e63cd38c0c60452c4e57..19e0169d2fb5cc1a6ec950a2961f7cf0b5d490d2 100644 (file)
--- a/src/msg/async/ProtocolV2.cc
+++ b/src/msg/async/ProtocolV2.cc
@@ -2245,10 +2245,7 @@ CtPtr ProtocolV2::handle_auth_done(char *payload, uint32_t length) {
     return _fault();
   }
   session_security.reset(
-    get_auth_session_handler(
-      cct, auth_meta->auth_method, auth_meta->session_key,
-      auth_meta->connection_secret,
-      CEPH_FEATURE_MSG_AUTH | CEPH_FEATURE_CEPHX_V2));
+    AuthStreamHandler::create_stream_handler(cct, auth_meta).release());
 
   if (!server_cookie) {
     ceph_assert(connect_seq == 0);

diff --git a/src/msg/async/ProtocolV2.h b/src/msg/async/ProtocolV2.h
index 7970e07752036831c44449e653a77c073e29c069..2bb7dc4dce70987d8de9fc4e25b7a2129e64a55a 100644 (file)
--- a/src/msg/async/ProtocolV2.h
+++ b/src/msg/async/ProtocolV2.h
@@ -75,7 +75,7 @@ private:
   char *temp_buffer;
   State state;
   uint64_t peer_required_features;
-  std::shared_ptr<AuthSessionHandler> session_security;
+  std::shared_ptr<AuthStreamHandler> session_security;
 
   uint64_t client_cookie;
   uint64_t server_cookie;

diff --git a/src/msg/simple/Pipe.cc b/src/msg/simple/Pipe.cc
index 271dec8e13a96a9d561fe23d7caab6d8bc824203..1a06ab04d1dc9fd7e9acd6ab589a27c7c28041fe 100644 (file)
--- a/src/msg/simple/Pipe.cc
+++ b/src/msg/simple/Pipe.cc
@@ -820,7 +820,6 @@ int Pipe::accept()
       get_auth_session_handler(msgr->cct,
                               connect.authorizer_protocol,
                               session_key,
-                              string(), /* connection_secret */
                               connection_state->get_features()));
 
   // notify
@@ -1347,7 +1346,6 @@ int Pipe::connect()
              msgr->cct,
              authorizer->protocol,
              authorizer->session_key,
-             string() /* connection secret*/,
              connection_state->get_features()));
       }  else {
         // We have no authorizer, so we shouldn't be applying security to messages in this pipe.  PLR