ceph_crypto: Implement MD5 wrapper for NSS.

Signed-off-by: Tommi Virtanen <tommi.virtanen@dreamhost.com>

diff --git a/src/Makefile.am b/src/Makefile.am
index 27fcfb393d1ae04a9b94b11e3165bd4df03f3fab..af3c06faae77ccb82772c8e7bd342d7385cbac90 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -295,13 +295,15 @@ libradosgw_a_SOURCES = \
        rgw/rgw_rest.cc \
        rgw/rgw_common.cc
 libradosgw_a_CFLAGS = ${AM_CFLAGS}
-libradosgw_a_CXXFLAGS = ${AM_CXXFLAGS}
+libradosgw_a_CXXFLAGS = ${CRYPTO_CXXFLAGS} ${AM_CXXFLAGS}
+libradosgw_a_LDFLAGS = ${CRYPTO_LDFLAGS} ${AM_LDFLAGS}
 # lib_LTLIBRARIES += libradosgw.a
 
 radosgw_SOURCES = rgw/rgw_main.cc
 radosgw_LDADD = libradosgw.a librados.a libcrush.a -lfcgi -lexpat -lpthread -lm $(CRYPTO_LIBS) $(EXTRALIBS)
-radosgw_CXXFLAGS = ${AM_CXXFLAGS}
+radosgw_CXXFLAGS = ${CRYPTO_CXXFLAGS} ${AM_CXXFLAGS}
 radosgw_admin_SOURCES = rgw/rgw_admin.cc
+radosgw_admin_CXXFLAGS = ${CRYPTO_CXXFLAGS} ${AM_CXXFLAGS}
 radosgw_admin_LDADD = libradosgw.a librados.a libcrush.a -lfcgi -lexpat -lpthread -lm $(CRYPTO_LIBS) $(EXTRALIBS)
 bin_PROGRAMS += radosgw radosgw_admin
 endif
@@ -405,7 +407,7 @@ check_PROGRAMS += unittest_crypto
 
 unittest_ceph_crypto_SOURCES = test/ceph_crypto.cc
 unittest_ceph_crypto_LDFLAGS = ${CRYPTO_LDFLAGS} ${AM_LDFLAGS}
-unittest_ceph_crypto_LDADD = ${CRYPTO_LIBS} \
+unittest_ceph_crypto_LDADD = libcommon.a ${CRYPTO_LIBS} \
                        ${UNITTEST_LDADD}
 unittest_ceph_crypto_CXXFLAGS = ${CRYPTO_CXXFLAGS} ${AM_CXXFLAGS} ${UNITTEST_CXXFLAGS}
 check_PROGRAMS += unittest_ceph_crypto
@@ -581,7 +583,8 @@ libcommon_files = \
        common/debug.cc \
        common/version.cc \
        common/hex.cc \
-       common/entity_name.cc
+       common/entity_name.cc \
+       common/ceph_crypto.cc
 
 if WITH_PROFILER
 libcommon_files += perfglue/cpu_profiler.cc

diff --git a/src/common/ceph_crypto.cc b/src/common/ceph_crypto.cc
new file mode 100644 (file)
index 0000000..a625732
--- /dev/null
+++ b/src/common/ceph_crypto.cc
@@ -0,0 +1,13 @@
+#include "ceph_crypto.h"
+
+#ifdef USE_CRYPTOPP
+// nothing
+#elif USE_NSS
+
+void ceph::crypto::init() {
+  NSS_NoDB_Init(NULL);
+}
+
+#else
+# error "No supported crypto implementation found."
+#endif

diff --git a/src/common/ceph_crypto.h b/src/common/ceph_crypto.h
index bd2d20ad4c6a450a9d658c2db4cb4b891390b3cf..bad620933145f546bbd07460f98dbcce94c20444 100644 (file)
--- a/src/common/ceph_crypto.h
+++ b/src/common/ceph_crypto.h
@@ -15,7 +15,58 @@ namespace ceph {
   }
 }
 #elif USE_NSS
-# error "TODO NSS support for md5"
+// you *must* use CRYPTO_CXXFLAGS in Makefile.am for including this include
+# include <nss.h>
+# include <pk11pub.h>
+
+// NSS thinks a lot of fairly fundamental operations might potentially
+// fail, because it has been written to support e.g. smartcards doing all
+// the crypto operations. We don't want to contaminate too much code
+// with error checking, and just say these really should never fail.
+// This assert MUST NOT be compiled out, even on non-debug builds.
+# include "assert.h"
+
+// ugly bit of CryptoPP that we have to emulate here :(
+typedef unsigned char byte;
+
+namespace ceph {
+  namespace crypto {
+    void init();
+
+    class MD5 {
+    private:
+      PK11Context *ctx;
+    public:
+      static const int DIGESTSIZE = 16;
+      MD5 () {
+       ctx = PK11_CreateDigestContext(SEC_OID_MD5);
+       assert(ctx);
+       Restart();
+      }
+      ~MD5 () {
+       PK11_DestroyContext(ctx, PR_TRUE);
+      }
+      void Restart() {
+       SECStatus s;
+       s = PK11_DigestBegin(ctx);
+       assert(s == SECSuccess);
+      }
+      void Update (const byte *input, size_t length) {
+       SECStatus s;
+       s = PK11_DigestOp(ctx, input, length);
+       assert(s == SECSuccess);
+      }
+      void Final (byte *digest) {
+       SECStatus s;
+       unsigned int dummy;
+       s = PK11_DigestFinal(ctx, digest, &dummy, DIGESTSIZE);
+       assert(s == SECSuccess);
+       assert(dummy == (unsigned int)DIGESTSIZE);
+       Restart();
+      }
+    };
+  }
+}
 #else
 # error "No supported crypto implementation found."
 #endif