From: Pritha Srivastava <prsrivas@redhat.com>
Date: Tue, 17 Jul 2018 05:29:00 +0000 (+0530)
Subject: rgw: Code for making STS Key configurable.
X-Git-Tag: v14.0.1~113^2~16
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=e0d893c6701d60a701ef478d6b1983ad51a48c49;p=ceph.git

rgw: Code for making STS Key configurable.

Signed-off-by: Pritha Srivastava <prsrivas@redhat.com>
---

diff --git a/src/common/legacy_config_opts.h b/src/common/legacy_config_opts.h
index 76ec765113b1..7fca815d8f2b 100644
--- a/src/common/legacy_config_opts.h
+++ b/src/common/legacy_config_opts.h
@@ -1546,3 +1546,4 @@ OPTION(rgw_cors_rules_max_num, OPT_INT) // According to AWS S3(http://docs.aws.a
 OPTION(rgw_delete_multi_obj_max_num, OPT_INT) // According to AWS S3(https://docs.aws.amazon.com/AmazonS3/latest/dev/DeletingObjects.html), Amazon S3 also provides the Multi-Object Delete API that you can use to delete up to 1000 objects in a single HTTP request.
 OPTION(rgw_website_routing_rules_max_num, OPT_INT) // According to AWS S3, An website routing config can have up to 50 rules.
 OPTION(rgw_sts_entry, OPT_STR)
+OPTION(rgw_sts_key, OPT_STR)
diff --git a/src/common/options.cc b/src/common/options.cc
index f8a7390a1064..10006540e0c8 100644
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -6351,7 +6351,13 @@ std::vector<Option> get_rgw_options() {
     Option("rgw_sts_entry", Option::TYPE_STR, Option::LEVEL_ADVANCED)
     .set_default("sts")
     .set_description("STS URL prefix")
-    .set_long_description("URL path prefix for internal STS requests.")
+    .set_long_description("URL path prefix for internal STS requests."),
+
+    Option("rgw_sts_key", Option::TYPE_STR, Option::LEVEL_ADVANCED)
+    .set_default("sts")
+    .set_description("STS Key")
+    .set_long_description("Key used for encrypting/ decrypting session token.")
+
   });
 }
 
diff --git a/src/rgw/rgw_sts.cc b/src/rgw/rgw_sts.cc
index 78bd5da76532..813804507c05 100644
--- a/src/rgw/rgw_sts.cc
+++ b/src/rgw/rgw_sts.cc
@@ -64,11 +64,8 @@ int Credentials::generateCredentials(CephContext* cct,
   if (! cryptohandler) {
     return -EINVAL;
   }
-  char secret_s[] = {
-    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-    0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-  };
-  buffer::ptr secret(secret_s, sizeof(secret_s));
+  string secret_s = cct->_conf->rgw_sts_key;
+  buffer::ptr secret(secret_s.c_str(), secret_s.length());
   int ret = 0;
   if (ret = cryptohandler->validate_secret(secret); ret < 0) {
     ldout(cct, 0) << "ERROR: Invalid secret key" << dendl;