Commit d03857c6 authored by Ilya Dryomov's avatar Ilya Dryomov

libceph: switch ceph_x_encrypt() to ceph_crypt()

Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
Reviewed-by: default avatarSage Weil <sage@redhat.com>
parent 4eb4517c
...@@ -49,22 +49,24 @@ static int ceph_x_encrypt_buflen(int ilen) ...@@ -49,22 +49,24 @@ static int ceph_x_encrypt_buflen(int ilen)
return ceph_x_encrypt_offset() + ilen + 16; return ceph_x_encrypt_offset() + ilen + 16;
} }
static int ceph_x_encrypt(struct ceph_crypto_key *secret, static int ceph_x_encrypt(struct ceph_crypto_key *secret, void *buf,
void *ibuf, int ilen, void *obuf, size_t olen) int buf_len, int plaintext_len)
{ {
struct ceph_x_encrypt_header head = { struct ceph_x_encrypt_header *hdr = buf + sizeof(u32);
.struct_v = 1, int ciphertext_len;
.magic = cpu_to_le64(CEPHX_ENC_MAGIC)
};
size_t len = olen - sizeof(u32);
int ret; int ret;
ret = ceph_encrypt2(secret, obuf + sizeof(u32), &len, hdr->struct_v = 1;
&head, sizeof(head), ibuf, ilen); hdr->magic = cpu_to_le64(CEPHX_ENC_MAGIC);
ret = ceph_crypt(secret, true, buf + sizeof(u32), buf_len - sizeof(u32),
plaintext_len + sizeof(struct ceph_x_encrypt_header),
&ciphertext_len);
if (ret) if (ret)
return ret; return ret;
ceph_encode_32(&obuf, len);
return len + sizeof(u32); ceph_encode_32(&buf, ciphertext_len);
return sizeof(u32) + ciphertext_len;
} }
static int ceph_x_decrypt(struct ceph_crypto_key *secret, static int ceph_x_decrypt(struct ceph_crypto_key *secret,
...@@ -296,7 +298,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac, ...@@ -296,7 +298,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
{ {
int maxlen; int maxlen;
struct ceph_x_authorize_a *msg_a; struct ceph_x_authorize_a *msg_a;
struct ceph_x_authorize_b msg_b; struct ceph_x_authorize_b *msg_b;
void *p, *end; void *p, *end;
int ret; int ret;
int ticket_blob_len = int ticket_blob_len =
...@@ -311,7 +313,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac, ...@@ -311,7 +313,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
goto out_au; goto out_au;
maxlen = sizeof(*msg_a) + ticket_blob_len + maxlen = sizeof(*msg_a) + ticket_blob_len +
ceph_x_encrypt_buflen(sizeof(msg_b)); ceph_x_encrypt_buflen(sizeof(*msg_b));
dout(" need len %d\n", maxlen); dout(" need len %d\n", maxlen);
if (au->buf && au->buf->alloc_len < maxlen) { if (au->buf && au->buf->alloc_len < maxlen) {
ceph_buffer_put(au->buf); ceph_buffer_put(au->buf);
...@@ -345,11 +347,11 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac, ...@@ -345,11 +347,11 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
p += ticket_blob_len; p += ticket_blob_len;
end = au->buf->vec.iov_base + au->buf->vec.iov_len; end = au->buf->vec.iov_base + au->buf->vec.iov_len;
msg_b = p + ceph_x_encrypt_offset();
msg_b->struct_v = 1;
get_random_bytes(&au->nonce, sizeof(au->nonce)); get_random_bytes(&au->nonce, sizeof(au->nonce));
msg_b.struct_v = 1; msg_b->nonce = cpu_to_le64(au->nonce);
msg_b.nonce = cpu_to_le64(au->nonce); ret = ceph_x_encrypt(&au->session_key, p, end - p, sizeof(*msg_b));
ret = ceph_x_encrypt(&au->session_key, &msg_b, sizeof(msg_b),
p, end - p);
if (ret < 0) if (ret < 0)
goto out_au; goto out_au;
...@@ -455,8 +457,9 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, ...@@ -455,8 +457,9 @@ static int ceph_x_build_request(struct ceph_auth_client *ac,
if (need & CEPH_ENTITY_TYPE_AUTH) { if (need & CEPH_ENTITY_TYPE_AUTH) {
struct ceph_x_authenticate *auth = (void *)(head + 1); struct ceph_x_authenticate *auth = (void *)(head + 1);
void *p = auth + 1; void *p = auth + 1;
struct ceph_x_challenge_blob tmp; void *enc_buf = xi->auth_authorizer.enc_buf;
char tmp_enc[40]; struct ceph_x_challenge_blob *blob = enc_buf +
ceph_x_encrypt_offset();
u64 *u; u64 *u;
if (p > end) if (p > end)
...@@ -467,16 +470,16 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, ...@@ -467,16 +470,16 @@ static int ceph_x_build_request(struct ceph_auth_client *ac,
/* encrypt and hash */ /* encrypt and hash */
get_random_bytes(&auth->client_challenge, sizeof(u64)); get_random_bytes(&auth->client_challenge, sizeof(u64));
tmp.client_challenge = auth->client_challenge; blob->client_challenge = auth->client_challenge;
tmp.server_challenge = cpu_to_le64(xi->server_challenge); blob->server_challenge = cpu_to_le64(xi->server_challenge);
ret = ceph_x_encrypt(&xi->secret, &tmp, sizeof(tmp), ret = ceph_x_encrypt(&xi->secret, enc_buf, CEPHX_AU_ENC_BUF_LEN,
tmp_enc, sizeof(tmp_enc)); sizeof(*blob));
if (ret < 0) if (ret < 0)
return ret; return ret;
auth->struct_v = 1; auth->struct_v = 1;
auth->key = 0; auth->key = 0;
for (u = (u64 *)tmp_enc; u + 1 <= (u64 *)(tmp_enc + ret); u++) for (u = (u64 *)enc_buf; u + 1 <= (u64 *)(enc_buf + ret); u++)
auth->key ^= *(__le64 *)u; auth->key ^= *(__le64 *)u;
dout(" server_challenge %llx client_challenge %llx key %llx\n", dout(" server_challenge %llx client_challenge %llx key %llx\n",
xi->server_challenge, le64_to_cpu(auth->client_challenge), xi->server_challenge, le64_to_cpu(auth->client_challenge),
...@@ -710,27 +713,27 @@ static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac, ...@@ -710,27 +713,27 @@ static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac,
static int calc_signature(struct ceph_x_authorizer *au, struct ceph_msg *msg, static int calc_signature(struct ceph_x_authorizer *au, struct ceph_msg *msg,
__le64 *psig) __le64 *psig)
{ {
char tmp_enc[40]; void *enc_buf = au->enc_buf;
struct { struct {
__le32 len; __le32 len;
__le32 header_crc; __le32 header_crc;
__le32 front_crc; __le32 front_crc;
__le32 middle_crc; __le32 middle_crc;
__le32 data_crc; __le32 data_crc;
} __packed sigblock; } __packed *sigblock = enc_buf + ceph_x_encrypt_offset();
int ret; int ret;
sigblock.len = cpu_to_le32(4*sizeof(u32)); sigblock->len = cpu_to_le32(4*sizeof(u32));
sigblock.header_crc = msg->hdr.crc; sigblock->header_crc = msg->hdr.crc;
sigblock.front_crc = msg->footer.front_crc; sigblock->front_crc = msg->footer.front_crc;
sigblock.middle_crc = msg->footer.middle_crc; sigblock->middle_crc = msg->footer.middle_crc;
sigblock.data_crc = msg->footer.data_crc; sigblock->data_crc = msg->footer.data_crc;
ret = ceph_x_encrypt(&au->session_key, &sigblock, sizeof(sigblock), ret = ceph_x_encrypt(&au->session_key, enc_buf, CEPHX_AU_ENC_BUF_LEN,
tmp_enc, sizeof(tmp_enc)); sizeof(*sigblock));
if (ret < 0) if (ret < 0)
return ret; return ret;
*psig = *(__le64 *)(tmp_enc + sizeof(u32)); *psig = *(__le64 *)(enc_buf + sizeof(u32));
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment