auth: propagate ceph context to encrypt/decrypt

Signed-off-by: Yehuda Sadeh <ysadehwe@ibm.com>

diff --git a/src/auth/Crypto.cc b/src/auth/Crypto.cc
index 357de6b2bfc6c3e4892ec7ffecbb6e8577ad69d9..f26d6bb6605fbe7da578c972c4d33e742ad5b052 100644 (file)
--- a/src/auth/Crypto.cc
+++ b/src/auth/Crypto.cc
@@ -150,6 +150,7 @@ int CryptoRandom::open_urandom()
 // interface.
 
 std::size_t CryptoKeyHandler::encrypt(
+  CephContext *cct,
   const CryptoKeyHandler::in_slice_t& in,
   const CryptoKeyHandler::out_slice_t& out) const
 {
@@ -159,7 +160,7 @@ std::size_t CryptoKeyHandler::encrypt(
 
   ceph::bufferlist ciphertext;
   std::string error;
-  const int ret = encrypt(plaintext, ciphertext, &error);
+  const int ret = encrypt(cct, plaintext, ciphertext, &error);
   if (ret != 0 || !error.empty()) {
     throw std::runtime_error(std::move(error));
   }
@@ -174,6 +175,7 @@ std::size_t CryptoKeyHandler::encrypt(
 }
 
 std::size_t CryptoKeyHandler::decrypt(
+  CephContext *cct,
   const CryptoKeyHandler::in_slice_t& in,
   const CryptoKeyHandler::out_slice_t& out) const
 {
@@ -183,7 +185,7 @@ std::size_t CryptoKeyHandler::decrypt(
 
   ceph::bufferlist plaintext;
   std::string error;
-  const int ret = decrypt(ciphertext, plaintext, &error);
+  const int ret = decrypt(cct, ciphertext, plaintext, &error);
   if (ret != 0 || !error.empty()) {
     throw std::runtime_error(std::move(error));
   }
@@ -222,12 +224,12 @@ public:
   using CryptoKeyHandler::encrypt;
   using CryptoKeyHandler::decrypt;
 
-  int encrypt(const bufferlist& in,
+  int encrypt(CephContext *cct, const bufferlist& in,
               bufferlist& out, std::string *error) const override {
     out = in;
     return 0;
   }
-  int decrypt(const bufferlist& in,
+  int decrypt(CephContext *cct, const bufferlist& in,
              bufferlist& out, std::string *error) const override {
     out = in;
     return 0;
@@ -303,7 +305,7 @@ public:
     return 0;
   }
 
-  int encrypt(const ceph::bufferlist& in,
+  int encrypt(CephContext *cct, const ceph::bufferlist& in,
              ceph::bufferlist& out,
               std::string* /* unused */) const override {
     // we need to take into account the PKCS#7 padding. There *always* will
@@ -345,7 +347,7 @@ public:
     return 0;
   }
 
-  int decrypt(const ceph::bufferlist& in,
+  int decrypt(CephContext *cct, const ceph::bufferlist& in,
              ceph::bufferlist& out,
              std::string* /* unused */) const override {
     // PKCS#7 padding enlarges even empty plain-text to take 16 bytes.
@@ -377,7 +379,7 @@ public:
     return 0;
   }
 
-  std::size_t encrypt(const in_slice_t& in,
+  std::size_t encrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) const override {
     if (out.buf == nullptr) {
       // 16 + p2align(10, 16) -> 16
@@ -418,7 +420,7 @@ public:
     return main_encrypt_size + tail_encrypt_size;
   }
 
-  std::size_t decrypt(const in_slice_t& in,
+  std::size_t decrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) const override {
     if (in.length % AES_BLOCK_LEN != 0 || in.length < AES_BLOCK_LEN) {
       throw std::runtime_error("input not aligned to AES_BLOCK_LEN");

diff --git a/src/auth/Crypto.h b/src/auth/Crypto.h
index f24ad20abde531334be9f8fb4cdac466ce121dee..85bfadeabb8a3139318c5dd7439d3a27cc75d37a 100644 (file)
--- a/src/auth/Crypto.h
+++ b/src/auth/Crypto.h
@@ -71,16 +71,20 @@ public:
 
   virtual ~CryptoKeyHandler() {}
 
-  virtual int encrypt(const ceph::buffer::list& in,
+  virtual int encrypt(CephContext *cct,
+                      const ceph::buffer::list& in,
                      ceph::buffer::list& out, std::string *error) const = 0;
-  virtual int decrypt(const ceph::buffer::list& in,
+  virtual int decrypt(CephContext *cct,
+                      const ceph::buffer::list& in,
                      ceph::buffer::list& out, std::string *error) const = 0;
 
   // TODO: provide nullptr in the out::buf to get/estimate size requirements?
   // Or maybe dedicated methods?
-  virtual std::size_t encrypt(const in_slice_t& in,
+  virtual std::size_t encrypt(CephContext *cct,
+                              const in_slice_t& in,
                              const out_slice_t& out) const;
-  virtual std::size_t decrypt(const in_slice_t& in,
+  virtual std::size_t decrypt(CephContext *cct,
+                              const in_slice_t& in,
                              const out_slice_t& out) const;
 
   sha256_digest_t hmac_sha256(const ceph::bufferlist& in) const;
@@ -161,27 +165,27 @@ public:
              ceph::buffer::list& out,
              std::string *error) const {
     ceph_assert(ckh); // Bad key?
-    return ckh->encrypt(in, out, error);
+    return ckh->encrypt(cct, in, out, error);
   }
   int decrypt(CephContext *cct, const ceph::buffer::list& in,
              ceph::buffer::list& out,
              std::string *error) const {
     ceph_assert(ckh); // Bad key?
-    return ckh->decrypt(in, out, error);
+    return ckh->decrypt(cct, in, out, error);
   }
 
   using in_slice_t = CryptoKeyHandler::in_slice_t;
   using out_slice_t = CryptoKeyHandler::out_slice_t;
 
-  std::size_t encrypt(CephContext*, const in_slice_t& in,
+  std::size_t encrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) {
     ceph_assert(ckh);
-    return ckh->encrypt(in, out);
+    return ckh->encrypt(cct, in, out);
   }
-  std::size_t decrypt(CephContext*, const in_slice_t& in,
+  std::size_t decrypt(CephContext *cct, const in_slice_t& in,
                      const out_slice_t& out) {
     ceph_assert(ckh);
-    return ckh->encrypt(in, out);
+    return ckh->encrypt(cct, in, out);
   }
 
   sha256_digest_t hmac_sha256(CephContext*, const ceph::buffer::list& in) {

diff --git a/src/rgw/rgw_rest_s3.cc b/src/rgw/rgw_rest_s3.cc
index 7aef4284ce9cae937b1f1882c90ca7f7bf88f2c4..39e7f55b9550fa45a62c118eef12d74bef5a5bb3 100644 (file)
--- a/src/rgw/rgw_rest_s3.cc
+++ b/src/rgw/rgw_rest_s3.cc
@@ -7169,7 +7169,7 @@ rgw::auth::s3::STSEngine::get_session_token(const DoutPrefixProvider* dpp, const
   buffer::list en_input, dec_output;
   en_input = buffer::list::static_from_string(decodedSessionToken);
 
-  ret = keyhandler->decrypt(en_input, dec_output, &error);
+  ret = keyhandler->decrypt(cct, en_input, dec_output, &error);
   if (ret < 0) {
     ldpp_dout(dpp, 0) << "ERROR: Decryption failed: " << error << dendl;
     return -EPERM;

diff --git a/src/rgw/rgw_sts.cc b/src/rgw/rgw_sts.cc
index cf306bfce2f3cbbf4402aa7291ff2139d8d2dad3..376c0aa2a08cc9706b3a0039896f3c0271ab6cc4 100644 (file)
--- a/src/rgw/rgw_sts.cc
+++ b/src/rgw/rgw_sts.cc
@@ -146,7 +146,7 @@ int Credentials::generateCredentials(const DoutPrefixProvider *dpp,
   buffer::list input, enc_output;
   encode(token, input);
 
-  if (ret = keyhandler->encrypt(input, enc_output, &error); ret < 0) {
+  if (ret = keyhandler->encrypt(cct, input, enc_output, &error); ret < 0) {
     ldpp_dout(dpp, 0) << "ERROR: Encrypting session token returned an error !" << dendl;
     return ret;
   }