mon: route all auth traffic through authmon

diff --git a/src/messages/MAuthMon.h b/src/messages/MAuthMon.h
index 8d54b593d95c0058bf0b61ba35f0cb529fe3499d..2ec6d2637f21211f591b93ac153e4cbe143c2bf8 100644 (file)
--- a/src/messages/MAuthMon.h
+++ b/src/messages/MAuthMon.h
@@ -12,8 +12,8 @@
  * 
  */
 
-#ifndef __MAUTH_H
-#define __MAUTH_H
+#ifndef __MAUTHMON_H
+#define __MAUTHMON_H
 
 #include "include/AuthLibrary.h"
 #include "messages/PaxosServiceMessage.h"

diff --git a/src/mon/AuthMonitor.cc b/src/mon/AuthMonitor.cc
index b504c3cf960d3cad6c29f34273766c5980fedef0..480c34f12647b8db5395982d11e64cbfb13e49de 100644 (file)
--- a/src/mon/AuthMonitor.cc
+++ b/src/mon/AuthMonitor.cc
@@ -18,6 +18,8 @@
 #include "MonitorStore.h"
 
 #include "messages/MMonCommand.h"
+#include "messages/MAuth.h"
+#include "messages/MAuthReply.h"
 #include "messages/MAuthMon.h"
 #include "messages/MAuthMonAck.h"
 #include "messages/MAuthRotating.h"
@@ -201,8 +203,14 @@ bool AuthMonitor::preprocess_query(PaxosServiceMessage *m)
   case MSG_MON_COMMAND:
     return preprocess_command((MMonCommand*)m);
 
+  case CEPH_MSG_AUTH:
+    return preprocess_auth((MAuth *)m);
+
+  case MSG_AUTH_ROTATING:
+    return preprocess_auth_rotating((MAuthRotating *)m);
+
   case MSG_AUTHMON:
-    return preprocess_auth((MAuthMon*)m);
+    return preprocess_auth_mon((MAuthMon*)m);
 
   default:
     assert(0);
@@ -218,7 +226,7 @@ bool AuthMonitor::prepare_update(PaxosServiceMessage *m)
   case MSG_MON_COMMAND:
     return prepare_command((MMonCommand*)m);
   case MSG_AUTHMON:
-    return prepare_auth((MAuthMon*)m);
+    return prepare_auth_mon((MAuthMon*)m);
   default:
     assert(0);
     delete m;
@@ -231,9 +239,65 @@ void AuthMonitor::committed()
 
 }
 
-bool AuthMonitor::preprocess_auth(MAuthMon *m)
+
+bool AuthMonitor::preprocess_auth(MAuth *m)
+{
+  stringstream ss;
+  // already mounted?
+  dout(0) << "preprocess_auth() blob_size=" << m->get_auth_payload().length() << dendl;
+  entity_addr_t addr = m->get_orig_source_addr();
+
+  dout(0) << "preprocess_auth() addr=" << addr << dendl;
+
+  AuthServiceHandler *handler = auth_mgr.get_auth_handler(addr);
+  assert(handler);
+
+  bufferlist response_bl;
+  
+  int ret;
+  try {
+    ret = handler->handle_request(m->get_auth_payload(), response_bl);
+  } catch (buffer::error *err) {
+    ret = -EINVAL;
+    dout(0) << "caught error when trying to handle auth request, probably malformed request" << dendl;
+  }
+  MAuthReply *reply = new MAuthReply(&response_bl, ret);
+
+  if (reply) {
+    mon->messenger->send_message(reply,
+                                  m->get_orig_source_inst());
+  } else {
+    /* out of memory.. what are we supposed to do now? */
+  }
+  return true;
+}
+
+
+bool AuthMonitor::preprocess_auth_rotating(MAuthRotating *m)
 {
-  dout(10) << "preprocess_auth " << *m << " from " << m->get_orig_source() << dendl;
+  dout(10) << "handle_request " << *m << " from " << m->get_orig_source() << dendl;
+  MAuthRotating *reply = new MAuthRotating();
+
+  if (!reply)
+    return true;
+
+  if (keys_server.get_rotating_encrypted(m->entity_name, reply->response_bl)) {
+    reply->status = 0;
+  } else {
+    reply->status = -EPERM;
+  }
+  
+  mon->messenger->send_message(reply, m->get_orig_source_inst());
+  delete m;
+  return true;
+}
+
+
+// auth mon
+
+bool AuthMonitor::preprocess_auth_mon(MAuthMon *m)
+{
+  dout(10) << "preprocess_auth_mon " << *m << " from " << m->get_orig_source() << dendl;
   
   int num_new = 0;
   for (deque<AuthLibEntry>::iterator p = m->info.begin();
@@ -249,7 +313,7 @@ bool AuthMonitor::preprocess_auth(MAuthMon *m)
   return false;
 }
 
-bool AuthMonitor::prepare_auth(MAuthMon *m) 
+bool AuthMonitor::prepare_auth_mon(MAuthMon *m) 
 {
   dout(10) << "prepare_auth " << *m << " from " << m->get_orig_source() << dendl;
 
@@ -387,22 +451,3 @@ done:
   return false;
 }
 
-
-void AuthMonitor::handle_request(MAuthRotating *m)
-{
-  dout(10) << "handle_request " << *m << " from " << m->get_orig_source() << dendl;
-  MAuthRotating *reply = new MAuthRotating();
-
-  if (!reply)
-    return;
-
-  if (keys_server.get_rotating_encrypted(m->entity_name, reply->response_bl)) {
-    reply->status = 0;
-  } else {
-    reply->status = -EPERM;
-  }
-  
-  mon->messenger->send_message(reply, m->get_orig_source_inst());
-  delete m;
-}
-

diff --git a/src/mon/AuthMonitor.h b/src/mon/AuthMonitor.h
index 85795077a4fee184d662bda4f3808f51578bc36b..4d15e5073b4f405c2e391d0c1c6f399bc889ba86 100644 (file)
--- a/src/mon/AuthMonitor.h
+++ b/src/mon/AuthMonitor.h
@@ -25,9 +25,13 @@ using namespace std;
 #include "mon/Monitor.h"
 
 #include "include/AuthLibrary.h"
+
 #include "auth/KeysServer.h"
+#include "auth/AuthServiceManager.h"
+
 
 class MMonCommand;
+class MAuth;
 class MAuthMon;
 class MAuthRotating;
 
@@ -37,6 +41,8 @@ class AuthMonitor : public PaxosService {
   KeysServer keys_server;
   version_t last_rotating_ver;
 
+  AuthServiceManager auth_mgr;
+
   void on_active();
 
   void create_initial(bufferlist& bl);
@@ -49,8 +55,12 @@ class AuthMonitor : public PaxosService {
   bool preprocess_query(PaxosServiceMessage *m);  // true if processed.
   bool prepare_update(PaxosServiceMessage *m);
 
-  bool preprocess_auth(MAuthMon *m);
-  bool prepare_auth(MAuthMon *m);
+  bool preprocess_auth(MAuth *m);
+
+  bool preprocess_auth_rotating(MAuthRotating *m);
+
+  bool preprocess_auth_mon(MAuthMon *m);
+  bool prepare_auth_mon(MAuthMon *m);
   void _updated_auth(MAuthMon *m, entity_inst_t who);
 
   struct C_Auth : public Context {
@@ -69,9 +79,10 @@ class AuthMonitor : public PaxosService {
 
   void check_rotate();
  public:
-  AuthMonitor(Monitor *mn, Paxos *p) : PaxosService(mn, p), last_rotating_ver(0) { }
-  void handle_request(MAuthMon *m);
-  void handle_request(MAuthRotating *m);
+  AuthMonitor(Monitor *mn, Paxos *p) : PaxosService(mn, p), last_rotating_ver(0) {
+    auth_mgr.init(mn); 
+  }
+  void pre_auth(MAuth *m);
   
   void tick();  // check state, take actions
 };

diff --git a/src/mon/ClientMonitor.cc b/src/mon/ClientMonitor.cc
index 4820e85258243b7563afbf14c1fcbb7f0a92b2e5..4568d324da25ba65158c96d6759448c6a619be56 100644 (file)
--- a/src/mon/ClientMonitor.cc
+++ b/src/mon/ClientMonitor.cc
@@ -20,8 +20,6 @@
 #include "MonitorStore.h"
 
 #include "messages/MMonMap.h"
-#include "messages/MAuth.h"
-#include "messages/MAuthReply.h"
 #include "messages/MClientMount.h"
 #include "messages/MClientMountAck.h"
 #include "messages/MMonCommand.h"
@@ -109,47 +107,11 @@ void ClientMonitor::encode_pending(bufferlist &bl)
 
 // -------
 
-bool ClientMonitor::check_auth(MAuth *m)
-{
-  stringstream ss;
-  // already mounted?
-  dout(0) << "ClientMonitor::check_auth() blob_size=" << m->get_auth_payload().length() << dendl;
-  entity_addr_t addr = m->get_orig_source_addr();
-
-  dout(0) << "ClientMonitor::check_auth() addr=" << addr << dendl;
-
-  AuthServiceHandler* handler = auth_mgr.get_auth_handler(addr);
-  assert(handler);
-
-  bufferlist response_bl;
-  
-  int ret;
-  try {
-    ret = handler->handle_request(m->get_auth_payload(), response_bl);
-  } catch (buffer::error *err) {
-    ret = -EINVAL;
-    dout(0) << "caught error when trying to handle auth request, probably malformed request" << dendl;
-  }
-  MAuthReply *reply = new MAuthReply(&response_bl, ret);
-
-  if (reply) {
-    mon->messenger->send_message(reply,
-                                  m->get_orig_source_inst());
-  } else {
-    /* out of memory.. what are we supposed to do now? */
-  }
-  return true;
-}
-
 bool ClientMonitor::preprocess_query(PaxosServiceMessage *m)
 {
   dout(10) << "preprocess_query " << *m << " from " << m->get_orig_source_inst() << dendl;
 
   switch (m->get_type()) {
-  case CEPH_MSG_AUTH:
-        dout(0) << "YY preprocess_query" << dendl;
-        return check_auth((MAuth *)m);
-
   case CEPH_MSG_CLIENT_MOUNT:
     return preprocess_mount((MClientMount *)m);
     

diff --git a/src/mon/ClientMonitor.h b/src/mon/ClientMonitor.h
index c1af686f17acddb72e09935632d975ac4a66bca3..adbcbd59b6b8be9cc58939bbf0614ac9e524059f 100644 (file)
--- a/src/mon/ClientMonitor.h
+++ b/src/mon/ClientMonitor.h
@@ -31,8 +31,6 @@ using namespace std;
 #include "PaxosService.h"
 #include "ClientMap.h"
 
-#include "auth/AuthServiceManager.h"
-
 class Monitor;
 class Paxos;
 class MAuth;
@@ -61,7 +59,6 @@ public:
   };
 
   ClientMap client_map, pending_map;
-  AuthServiceManager auth_mgr;
   client_t next_client;
 
 private:
@@ -74,8 +71,6 @@ private:
 
   void committed();
 
-  bool check_auth(MAuth *m);
-
   bool preprocess_mount(MClientMount *m);
   bool prepare_mount(MClientMount *m);
   void _mounted(client_t c, MClientMount *m);
@@ -91,7 +86,7 @@ private:
   void on_election_start();
 
  public:
-  ClientMonitor(Monitor *mn, Paxos *p) : PaxosService(mn, p), next_client(-1) { auth_mgr.init(mn); }
+  ClientMonitor(Monitor *mn, Paxos *p) : PaxosService(mn, p), next_client(-1) { }
   
   void tick();  // check state, take actions
 

diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 709c01181acf1123a350deee16f51c75e2a410d6..0f7c0ec064060038188bccaf073639e2e8336018 100644 (file)
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -404,9 +404,14 @@ bool Monitor::ms_dispatch(Message *m)
       paxos_service[PAXOS_MDSMAP]->dispatch((PaxosServiceMessage*)m);
       break;
 
-      // clients
+      // auth
     case CEPH_MSG_AUTH:
-      dout(0) << "Monitor::dispatch_impl() got CEPH_MSG_CLIENT_AUTH" << dendl;
+    case MSG_AUTH_ROTATING:
+    case MSG_AUTHMON:
+      paxos_service[PAXOS_AUTH]->dispatch((PaxosServiceMessage*)m);
+      break;
+
+      // clients
     case CEPH_MSG_CLIENT_MOUNT:
       paxos_service[PAXOS_CLIENTMAP]->dispatch((PaxosServiceMessage*)m);
       break;
@@ -464,9 +469,6 @@ bool Monitor::ms_dispatch(Message *m)
       handle_class((MClass *)m);
       break;
       
-    case MSG_AUTH_ROTATING:
-      handle_rotating((MAuthRotating *)m);
-      break;
     default:
         return false;
     }
@@ -726,16 +728,6 @@ void Monitor::handle_class(MClass *m)
   }
 }
 
-/*
-  get auth rotating secret request
- */
-
-void Monitor::handle_rotating(MAuthRotating *m)
-{
-  authmon()->handle_request(m);
-}
-
-
 void Monitor::handle_route(MRoute *m)
 {
   dout(10) << "handle_route " << *m->msg << " to " << m->dest << dendl;

diff --git a/src/mon/Monitor.h b/src/mon/Monitor.h
index f607c01d5c9ba3729b0663cbf95d364120343a70..94062f13dccf70230413b936d837586d6835e315 100644 (file)
--- a/src/mon/Monitor.h
+++ b/src/mon/Monitor.h
@@ -146,7 +146,6 @@ public:
   void handle_command(class MMonCommand *m);
   void handle_observe(MMonObserve *m);
   void handle_class(MClass *m);
-  void handle_rotating(MAuthRotating *m);
   void handle_route(MRoute *m);
 
   void reply_command(MMonCommand *m, int rc, const string &rs, version_t version);

diff --git a/src/mon/Session.h b/src/mon/Session.h
index 60e2834a442ff9d0160ff96fe4ba74c067f3e9cb..932483bfe1e55555a8e2e94394d9692a8ab11533 100644 (file)
--- a/src/mon/Session.h
+++ b/src/mon/Session.h
@@ -17,6 +17,7 @@
 
 #include "include/xlist.h"
 #include "msg/msg_types.h"
+#include "auth/Crypto.h"
 
 struct Session;
 
@@ -39,6 +40,8 @@ struct Session : public RefCountedObject {
 
   map<nstring, Subscription*> sub_map;
 
+  CryptoKey session_key;
+
   Session(entity_inst_t i) : inst(i), closed(false), item(this) {}
   ~Session() {
     generic_dout(0) << "~Session " << this << dendl;