auth: add more debugging for service tickets

Signed-off-by: Patrick Donnelly <pdonnell@ibm.com>

diff --git a/src/auth/Auth.h b/src/auth/Auth.h
index f9d52a1f1dc15a2c1b8814e6bf691574a47f1876..e30c890676752433bd9c375a69ddf16cfb0d8b6e 100644 (file)
--- a/src/auth/Auth.h
+++ b/src/auth/Auth.h
@@ -17,6 +17,7 @@
 #define CEPH_AUTHTYPES_H
 
 #include "Crypto.h"
+#include "common/CanHasPrint.h"
 #include "common/ceph_json.h"
 #include "common/entity_name.h"
 #include "common/Formatter.h"
@@ -48,6 +49,13 @@ struct EntityAuth {
   std::map<std::string, ceph::buffer::list> caps;
   CryptoKey pending_key; ///< new but uncommitted key
 
+  void print(std::ostream& out) const {
+    out << "auth(key=" << key;
+    if (!pending_key.empty()) {
+      out << " pending_key=" << pending_key;
+    }
+    out << ")";
+  }
   void encode(ceph::buffer::list& bl) const {
     __u8 struct_v = 3;
     using ceph::encode;
@@ -84,16 +92,6 @@ struct EntityAuth {
 };
 WRITE_CLASS_ENCODER(EntityAuth)
 
-inline std::ostream& operator<<(std::ostream& out, const EntityAuth& a)
-{
-  out << "auth(key=" << a.key;
-  if (!a.pending_key.empty()) {
-    out << " pending_key=" << a.pending_key;
-  }
-  out << ")";
-  return out;
-}
-
 struct AuthCapsInfo {
   bool allow_all;
   ceph::buffer::list caps;
@@ -272,6 +270,9 @@ struct ExpiringCryptoKey {
   CryptoKey key;
   utime_t expiration;
 
+  void print(std::ostream& out) const {
+    out << key << " expires " << expiration;
+  }
   void encode(ceph::buffer::list& bl) const {
     using ceph::encode;
     __u8 struct_v = 1;
@@ -301,11 +302,6 @@ struct ExpiringCryptoKey {
 };
 WRITE_CLASS_ENCODER(ExpiringCryptoKey)
 
-inline std::ostream& operator<<(std::ostream& out, const ExpiringCryptoKey& c)
-{
-  return out << c.key << " expires " << c.expiration;
-}
-
 struct RotatingSecrets {
   std::map<uint64_t, ExpiringCryptoKey> secrets;
   version_t max_ver;

diff --git a/src/auth/Crypto.h b/src/auth/Crypto.h
index 56ff7e9ff472c8c6ce75a3cc3e4cbe40b7584316..132a23216d6c180d34927a379314999fe9167169 100644 (file)
--- a/src/auth/Crypto.h
+++ b/src/auth/Crypto.h
@@ -227,12 +227,6 @@ public:
 };
 WRITE_CLASS_ENCODER(CryptoKey)
 
-inline std::ostream& operator<<(std::ostream& out, const CryptoKey& k)
-{
-  k.print(out);
-  return out;
-}
-
 
 /*
  * Driver for a particular algorithm

diff --git a/src/auth/RotatingKeyRing.cc b/src/auth/RotatingKeyRing.cc
index ccc5dbc2d0214663a5e9adbec7f4137cd93dd534..54ee8302ed0af0dd7161cc9d838d2fea411ef85c 100644 (file)
--- a/src/auth/RotatingKeyRing.cc
+++ b/src/auth/RotatingKeyRing.cc
@@ -51,6 +51,8 @@ bool RotatingKeyRing::get_secret(const EntityName& name, CryptoKey& secret) cons
 bool RotatingKeyRing::get_service_secret(uint32_t service_id_, uint64_t secret_id,
                                         CryptoKey& secret) const
 {
+  ldout(cct, 30) << __func__ << ": service_id=" << service_id_ << " secret_id=" << secret_id << dendl;
+
   std::lock_guard l{lock};
 
   if (service_id_ != this->service_id) {

diff --git a/src/auth/cephx/CephxKeyServer.cc b/src/auth/cephx/CephxKeyServer.cc
index 2430c291bfefbcaa6550f1cdced44ffe4746c221..5b36f25699ff13606883b24bf06b8b14b5fa3fc4 100644 (file)
--- a/src/auth/cephx/CephxKeyServer.cc
+++ b/src/auth/cephx/CephxKeyServer.cc
@@ -35,6 +35,7 @@ bool KeyServerData::get_service_secret(CephContext *cct, uint32_t service_id,
                                       CryptoKey& secret, uint64_t& secret_id,
                                       double& ttl) const
 {
+  ldout(cct,30) << __func__ << ": " << service_id << dendl;
   auto iter = rotating_secrets.find(service_id);
   if (iter == rotating_secrets.end()) { 
     ldout(cct, 10) << "get_service_secret service " << ceph_entity_type_name(service_id) << " not found " << dendl;
@@ -100,21 +101,28 @@ bool KeyServerData::get_service_secret(CephContext *cct, uint32_t service_id,
 
   return true;
 }
-bool KeyServerData::get_auth(const EntityName& name, EntityAuth& auth) const {
+bool KeyServerData::get_auth(CephContext *cct, const EntityName& name, EntityAuth& auth) const {
+  ldout(cct, 20) << __func__ << ": " << name << dendl;
   auto iter = secrets.find(name);
   if (iter != secrets.end()) {
     auth = iter->second;
+    ldout(cct, 30) << __func__ << ": found " << auth << dendl;
     return true;
   }
+  ldout(cct, 30) << __func__ << ": searching extra secrets" << dendl;
   return extra_secrets->get_auth(name, auth);
 }
 
-bool KeyServerData::get_secret(const EntityName& name, CryptoKey& secret) const {
+bool KeyServerData::get_secret(CephContext *cct, const EntityName& name, CryptoKey& secret) const {
+  ldout(cct, 20) << __func__ << ": " << name << dendl;
   auto iter = secrets.find(name);
   if (iter != secrets.end()) {
     secret = iter->second.key;
+    ldout(cct, 30) << __func__ << ": found " << secret << dendl;
     return true;
   }
+
+  ldout(cct, 30) << __func__ << ": searching extra secrets" << dendl;
   return extra_secrets->get_secret(name, secret);
 }
 
@@ -227,13 +235,13 @@ int KeyServer::_rotate_secret(uint32_t service_id, KeyServerData &pending_data)
 bool KeyServer::get_secret(const EntityName& name, CryptoKey& secret) const
 {
   std::scoped_lock l{lock};
-  return data.get_secret(name, secret);
+  return data.get_secret(cct, name, secret);
 }
 
 bool KeyServer::get_auth(const EntityName& name, EntityAuth& auth) const
 {
   std::scoped_lock l{lock};
-  return data.get_auth(name, auth);
+  return data.get_auth(cct, name, auth);
 }
 
 bool KeyServer::get_caps(const EntityName& name, const string& type,

diff --git a/src/auth/cephx/CephxKeyServer.h b/src/auth/cephx/CephxKeyServer.h
index ffb0e58a29baf94d459cc62664e0acb48c311d95..4ee769ce7ec466191814f3d2a301a9e22f2db277 100644 (file)
--- a/src/auth/cephx/CephxKeyServer.h
+++ b/src/auth/cephx/CephxKeyServer.h
@@ -121,8 +121,8 @@ struct KeyServerData {
                          double& ttl) const;
   bool get_service_secret(CephContext *cct, uint32_t service_id,
                          uint64_t secret_id, CryptoKey& secret) const;
-  bool get_auth(const EntityName& name, EntityAuth& auth) const;
-  bool get_secret(const EntityName& name, CryptoKey& secret) const;
+  bool get_auth(CephContext *cct, const EntityName& name, EntityAuth& auth) const;
+  bool get_secret(CephContext *cct, const EntityName& name, CryptoKey& secret) const;
   bool get_caps(CephContext *cct, const EntityName& name,
                const std::string& type, AuthCapsInfo& caps) const;
 

diff --git a/src/auth/cephx/CephxProtocol.cc b/src/auth/cephx/CephxProtocol.cc
index 344916f88984c04aadce8d54e676145b7676482a..4d7f67525d4217dcacc7a14e945f53e189c384da 100644 (file)
--- a/src/auth/cephx/CephxProtocol.cc
+++ b/src/auth/cephx/CephxProtocol.cc
@@ -63,6 +63,17 @@ void cephx_calc_client_server_challenge(CephContext *cct, CryptoKey& secret, uin
   *key = k;
 }
 
+void CephXSessionAuthInfo::print(std::ostream& os) const
+{
+  os << "session_auth_info("
+     << ceph_entity_type_name(service_id)
+     << " id=" << secret_id
+     << " session_key=" << session_key
+     << " service_secret=" << service_secret
+     << " ticket.name=" << ticket.name
+     << " ticket.global_id=" << ticket.global_id
+     << ")";
+}
 
 /*
  * Authentication
@@ -76,12 +87,7 @@ bool cephx_build_service_ticket_blob(CephContext *cct, const CephXSessionAuthInf
   ticket_info.ticket = info.ticket;
   ticket_info.ticket.caps = info.ticket.caps;
 
-  ldout(cct, 10) << "build_service_ticket service "
-                << ceph_entity_type_name(info.service_id)
-                << " secret_id " << info.secret_id
-                << " ticket_info.ticket.name="
-                << ticket_info.ticket.name.to_str()
-                << " ticket.global_id " << info.ticket.global_id << dendl;
+  ldout(cct, 10) << "build_service_ticket service " << info << dendl;
   blob.secret_id = info.secret_id;
   std::string error;
   if (!info.service_secret.get_secret().length())
@@ -466,19 +472,22 @@ bool cephx_verify_authorizer(CephContext *cct, const KeyStore& keys,
     // Unable to decode!
     return false;
   }
-  ldout(cct, 10) << "verify_authorizer decrypted service "
+
+  ldout(cct, 10) << __func__ << ": decoded service "
           << ceph_entity_type_name(service_id)
           << " secret_id=" << ticket.secret_id << dendl;
 
   if (ticket.secret_id == (uint64_t)-1) {
     EntityName name;
     name.set_type(service_id);
+    ldout(cct, 20) << __func__ << ": looking up secret for " << ceph_entity_type_name(service_id) << dendl;
     if (!keys.get_secret(name, service_secret)) {
       ldout(cct, 0) << "verify_authorizer could not get general service secret for service "
              << ceph_entity_type_name(service_id) << " secret_id=" << ticket.secret_id << dendl;
       return false;
     }
   } else {
+    ldout(cct, 20) << __func__ << ": looking up service secret for " << ceph_entity_type_name(service_id) << dendl;
     if (!keys.get_service_secret(service_id, ticket.secret_id, service_secret)) {
       ldout(cct, 0) << "verify_authorizer could not get service secret for service "
              << ceph_entity_type_name(service_id) << " secret_id=" << ticket.secret_id << dendl;
@@ -487,24 +496,26 @@ bool cephx_verify_authorizer(CephContext *cct, const KeyStore& keys,
       return false;
     }
   }
+  ldout(cct, 30) << __func__ << ": got secret " << service_secret << dendl;
+
   std::string error;
   if (!service_secret.get_secret().length())
     error = "invalid key";  // Bad key?
   else
     decode_decrypt_enc_bl(cct, ticket_info, service_secret, ticket.blob, error);
   if (!error.empty()) {
-    ldout(cct, 0) << "verify_authorizer could not decrypt ticket info: error: "
-      << error << dendl;
+    ldout(cct, 0) << __func__ << ": could not decrypt ticket info: " << error << dendl;
     return false;
   }
 
   if (ticket_info.ticket.global_id != global_id) {
-    ldout(cct, 0) << "verify_authorizer global_id mismatch: declared id=" << global_id
+    ldout(cct, 0) << __func__ << ": global_id mismatch: declared id=" << global_id
            << " ticket_id=" << ticket_info.ticket.global_id << dendl;
     return false;
   }
 
-  ldout(cct, 10) << "verify_authorizer global_id=" << global_id << dendl;
+  ldout(cct, 10) << __func__ << ": global_id=" << global_id << dendl;
+  ldout(cct, 30) << __func__ << ": session key=" << ticket_info.session_key << dendl;
 
   // CephXAuthorize
   CephXAuthorize auth_msg;
@@ -520,17 +531,17 @@ bool cephx_verify_authorizer(CephContext *cct, const KeyStore& keys,
       c = new CephXAuthorizeChallenge;
       challenge->reset(c);
       cct->random()->get_bytes((char*)&c->server_challenge, sizeof(c->server_challenge));
-      ldout(cct,10) << __func__ << " adding server_challenge " << c->server_challenge
+      ldout(cct,10) << __func__ << ": adding server_challenge " << c->server_challenge
                    << dendl;
 
       encode_encrypt_enc_bl(cct, *c, ticket_info.session_key, *reply_bl, error);
       if (!error.empty()) {
-       ldout(cct, 10) << "verify_authorizer: encode_encrypt error: " << error << dendl;
+       ldout(cct, 0) << __func__ << ": encode_encrypt error: " << error << dendl;
        return false;
       }
       return false;
     }
-    ldout(cct, 10) << __func__ << " got server_challenge+1 "
+    ldout(cct, 10) << __func__ << ": got server_challenge+1 "
                   << auth_msg.server_challenge_plus_one
                   << " expecting " << c->server_challenge + 1 << dendl;
     if (c->server_challenge + 1 != auth_msg.server_challenge_plus_one) {

diff --git a/src/auth/cephx/CephxProtocol.h b/src/auth/cephx/CephxProtocol.h
index 804f007615083cc965f304e9d3463a8ec9bfbf79..c76c3f91f0923a4a5880ca662d236313986c1fdc 100644 (file)
--- a/src/auth/cephx/CephxProtocol.h
+++ b/src/auth/cephx/CephxProtocol.h
@@ -261,6 +261,8 @@ struct CephXSessionAuthInfo {
   CryptoKey session_key;
   CryptoKey service_secret;
   utime_t validity;
+
+  void print(std::ostream& os) const;
 };