auth/AuthServiceHandler: take session_key and connection_secret as args

Allow these methods to populate session and connection secrets.

No functional change (yet).

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/src/auth/AuthServiceHandler.h b/src/auth/AuthServiceHandler.h
index a4464049c9e7479786ace4512ccf92ec5bef07c4..a787663c29935bccaa203059cce89cc60bca4df9 100644 (file)
--- a/src/auth/AuthServiceHandler.h
+++ b/src/auth/AuthServiceHandler.h
@@ -22,6 +22,7 @@
 
 class CephContext;
 class KeyServer;
+class CryptoKey;
 struct AuthCapsInfo;
 
 struct AuthServiceHandler {
@@ -37,11 +38,15 @@ public:
 
   virtual int start_session(const EntityName& name,
                            bufferlist *result,
-                           AuthCapsInfo *caps) = 0;
+                           AuthCapsInfo *caps,
+                           CryptoKey *session_key,
+                           CryptoKey *connection_secret) = 0;
   virtual int handle_request(bufferlist::const_iterator& indata,
                             bufferlist *result,
                             uint64_t *global_id,
-                            AuthCapsInfo *caps) = 0;
+                            AuthCapsInfo *caps,
+                            CryptoKey *session_key,
+                            CryptoKey *connection_secret) = 0;
 
   EntityName& get_entity_name() { return entity_name; }
 };

diff --git a/src/auth/cephx/CephxServiceHandler.cc b/src/auth/cephx/CephxServiceHandler.cc
index b470cd39130ab9314c73a8f9d2c51ac66d7dcf92..22426d383293832868e2fc4c91201200f73ec29e 100644 (file)
--- a/src/auth/cephx/CephxServiceHandler.cc
+++ b/src/auth/cephx/CephxServiceHandler.cc
@@ -29,7 +29,9 @@
 
 int CephxServiceHandler::start_session(const EntityName& name,
                                       bufferlist *result_bl,
-                                      AuthCapsInfo *caps)
+                                      AuthCapsInfo *caps,
+                                      CryptoKey *session_key,
+                                      CryptoKey *connection_secret)
 {
   entity_name = name;
 
@@ -49,7 +51,9 @@ int CephxServiceHandler::handle_request(
   bufferlist::const_iterator& indata,
   bufferlist *result_bl,
   uint64_t *global_id,
-  AuthCapsInfo *caps)
+  AuthCapsInfo *caps,
+  CryptoKey *session_key,
+  CryptoKey *connection_secret)
 {
   int ret = 0;
 

diff --git a/src/auth/cephx/CephxServiceHandler.h b/src/auth/cephx/CephxServiceHandler.h
index b6acb3c71d8f7e1b62d99c65dfd5fcd4ae40306b..2a5af6f7af74ffe5d5fbeec7206530b71b1cb0bf 100644 (file)
--- a/src/auth/cephx/CephxServiceHandler.h
+++ b/src/auth/cephx/CephxServiceHandler.h
@@ -31,12 +31,17 @@ public:
   
   int start_session(const EntityName& name,
                    bufferlist *result_bl,
-                   AuthCapsInfo *caps) override;
+                   AuthCapsInfo *caps,
+                   CryptoKey *session_key,
+                   CryptoKey *connection_secret) override;
   int handle_request(
     bufferlist::const_iterator& indata,
     bufferlist *result_bl,
     uint64_t *global_id,
-    AuthCapsInfo *caps) override;
+    AuthCapsInfo *caps,
+    CryptoKey *session_key,
+    CryptoKey *connection_secret) override;
+
   void build_cephx_response_header(int request_type, int status, bufferlist& bl);
 };
 

diff --git a/src/auth/krb/KrbServiceHandler.cpp b/src/auth/krb/KrbServiceHandler.cpp
index 2935ee06c5129eba0e72270d4fa1fc776f6ac7b2..3efd8c9087239e06d61a5c3d1a5974454c7ad415 100644 (file)
--- a/src/auth/krb/KrbServiceHandler.cpp
+++ b/src/auth/krb/KrbServiceHandler.cpp
@@ -26,10 +26,13 @@
 #define dout_prefix *_dout << "krb5/gssapi service: " << entity_name <<  " : "
 
 
-int KrbServiceHandler::handle_request(bufferlist::const_iterator& indata, 
-                                      bufferlist *buff_list,
-                                      uint64_t *global_id,
-                                      AuthCapsInfo *caps)
+int KrbServiceHandler::handle_request(
+  bufferlist::const_iterator& indata,
+  bufferlist *buff_list,
+  uint64_t *global_id,
+  AuthCapsInfo *caps,
+  CryptoKey *session_key,
+  CryptoKey *connection_secret)
 {
   auto result(0);
   gss_buffer_desc gss_buffer_in = {0, nullptr};
@@ -148,9 +151,12 @@ int KrbServiceHandler::handle_request(bufferlist::const_iterator& indata,
   return result;
 }
 
-int KrbServiceHandler::start_session(const EntityName& name,
-                                     bufferlist *buff_list,
-                                     AuthCapsInfo *caps)
+int KrbServiceHandler::start_session(
+  const EntityName& name,
+  bufferlist *buff_list,
+  AuthCapsInfo *caps,
+  CryptoKey *session_key,
+  CryptoKey *connection_secret)
 {
   gss_buffer_desc gss_buffer_in = {0, nullptr};
   gss_OID gss_object_id = GSS_C_NT_HOSTBASED_SERVICE;

diff --git a/src/auth/krb/KrbServiceHandler.hpp b/src/auth/krb/KrbServiceHandler.hpp
index 8f81158631f0bdbfdde4993ea8ecad3e29110e3b..8fe808a48a8298246ad15d02bd89ddc0890883e1 100644 (file)
--- a/src/auth/krb/KrbServiceHandler.hpp
+++ b/src/auth/krb/KrbServiceHandler.hpp
@@ -40,14 +40,18 @@ class KrbServiceHandler : public AuthServiceHandler {
     int handle_request(bufferlist::const_iterator& indata,
                        bufferlist *buff_list,
                        uint64_t *global_id,
-                       AuthCapsInfo *caps) override;
+                       AuthCapsInfo *caps,
+                      CryptoKey *session_key,
+                      CryptoKey *connection_secret) override;
 
     int start_session(const EntityName& name,
                       bufferlist *buff_list,
-                      AuthCapsInfo *caps) override;
+                      AuthCapsInfo *caps,
+                     CryptoKey *session_key,
+                     CryptoKey *connection_secret) override;
 
-  private: 
-    gss_buffer_desc m_gss_buffer_out; 
+  private:
+    gss_buffer_desc m_gss_buffer_out;
     gss_cred_id_t m_gss_credentials; 
     gss_ctx_id_t m_gss_sec_ctx; 
     gss_name_t m_gss_service_name; 

diff --git a/src/auth/none/AuthNoneServiceHandler.h b/src/auth/none/AuthNoneServiceHandler.h
index 07d68ddda878c7eecbadce7db8d091857c0eb308..d62f2a283a4555dc9f686166dff57757576d9efb 100644 (file)
--- a/src/auth/none/AuthNoneServiceHandler.h
+++ b/src/auth/none/AuthNoneServiceHandler.h
@@ -28,7 +28,9 @@ public:
   
   int start_session(const EntityName& name,
                    bufferlist *result_bl,
-                   AuthCapsInfo *caps) override {
+                   AuthCapsInfo *caps,
+                   CryptoKey *session_key,
+                   CryptoKey *connection_secret) override {
     entity_name = name;
     caps->allow_all = true;
     return 1;
@@ -36,10 +38,14 @@ public:
   int handle_request(bufferlist::const_iterator& indata,
                     bufferlist *result_bl,
                     uint64_t *global_id,
-                    AuthCapsInfo *caps) override {
+                    AuthCapsInfo *caps,
+                    CryptoKey *session_key,
+                    CryptoKey *connection_secret) override {
     return 0;
   }
-  void build_cephx_response_header(int request_type, int status, bufferlist& bl) { }
+  void build_cephx_response_header(int request_type, int status,
+                                  bufferlist& bl) {
+  }
 };
 
 #endif

diff --git a/src/auth/unknown/AuthUnknownServiceHandler.h b/src/auth/unknown/AuthUnknownServiceHandler.h
index b353959dde1cab91b193cb85429bc1c76f49f95e..8a2315c1276b8b3d0d385b04ef0d52a408c5d894 100644 (file)
--- a/src/auth/unknown/AuthUnknownServiceHandler.h
+++ b/src/auth/unknown/AuthUnknownServiceHandler.h
@@ -28,17 +28,24 @@ public:
   
   int start_session(const EntityName& name,
                    bufferlist *result_bl,
-                   AuthCapsInfo *caps) {
+                   AuthCapsInfo *caps,
+                   CryptoKey *session_key,
+                   CryptoKey *connection_secret) {
     return 1;
   }
   int handle_request(bufferlist::iterator& indata,
                     bufferlist *result_bl,
                     uint64_t *global_id,
-                    AuthCapsInfo *caps) {
+                    AuthCapsInfo *caps,
+                    CryptoKey *session_key,
+                    CryptoKey *connection_secret) {
     ceph_abort();  // shouldn't get called
     return 0;
   }
-  void build_cephx_response_header(int request_type, int status, bufferlist& bl) { }
+
+  void build_cephx_response_header(int request_type, int status,
+                                  bufferlist& bl) {
+  }
 };
 
 #endif

diff --git a/src/mon/AuthMonitor.cc b/src/mon/AuthMonitor.cc
index c56b5424b73d1f7844c4d515c5f989b20ff2e782..ba1f2c5e557a8a27729ffa26d64b5ea085dfd0a6 100644 (file)
--- a/src/mon/AuthMonitor.cc
+++ b/src/mon/AuthMonitor.cc
@@ -666,14 +666,16 @@ bool AuthMonitor::prep_auth(MonOpRequestRef op, bool paxos_writable)
     if (start) {
       // new session
       ret = s->auth_handler->start_session(entity_name, &response_bl,
-                                          &s->con->peer_caps_info);
+                                          &s->con->peer_caps_info,
+                                          nullptr, nullptr);
     } else {
       // request
       ret = s->auth_handler->handle_request(
        indata,
        &response_bl,
        &s->con->peer_global_id,
-       &s->con->peer_caps_info);
+       &s->con->peer_caps_info,
+       nullptr, nullptr);
     }
     if (ret == -EIO) {
       wait_for_active(op, new C_RetryMessage(this,op));