leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libceph: switch ceph_x_decrypt() to ceph_crypt()

Browse Source 
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
This commit is contained in:
Ilya Dryomov 2016-12-02 16:35:08 +01:00
parent d03857c63b
commit e15fd0a11d
1 changed files with 32 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
net/ceph/auth_x.c
View File

@ -69,32 +69,28 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret, void *buf,
return sizeof(u32) + ciphertext_len; return sizeof(u32) + ciphertext_len;
} }
static int ceph_x_decrypt(struct ceph_crypto_key *secret, static int ceph_x_decrypt(struct ceph_crypto_key *secret, void **p, void *end)
void **p, void *end, void **obuf, size_t olen)
{ {
struct ceph_x_encrypt_header head; struct ceph_x_encrypt_header *hdr = *p + sizeof(u32);
size_t head_len = sizeof(head); int ciphertext_len, plaintext_len;
int len, ret; int ret;
len = ceph_decode_32(p); ceph_decode_32_safe(p, end, ciphertext_len, e_inval);
if (*p + len > end) ceph_decode_need(p, end, ciphertext_len, e_inval);
return -EINVAL;
dout("ceph_x_decrypt len %d\n", len); ret = ceph_crypt(secret, false, *p, end - *p, ciphertext_len,
if (*obuf == NULL) { &plaintext_len);
*obuf = kmalloc(len, GFP_NOFS);
if (!*obuf)
return -ENOMEM;
olen = len;
}
ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
if (ret) if (ret)
return ret; return ret;
if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
if (hdr->struct_v != 1 || le64_to_cpu(hdr->magic) != CEPHX_ENC_MAGIC)
return -EPERM; return -EPERM;
*p += len;
return olen; *p += ciphertext_len;
return plaintext_len - sizeof(struct ceph_x_encrypt_header);
e_inval:
return -EINVAL;
} }
/* /*
@ -149,12 +145,10 @@ static int process_one_ticket(struct ceph_auth_client *ac,
int type; int type;
u8 tkt_struct_v, blob_struct_v; u8 tkt_struct_v, blob_struct_v;
struct ceph_x_ticket_handler *th; struct ceph_x_ticket_handler *th;
void *dbuf = NULL;
void *dp, *dend; void *dp, *dend;
int dlen; int dlen;
char is_enc; char is_enc;
struct timespec validity; struct timespec validity;
void *ticket_buf = NULL;
void *tp, *tpend; void *tp, *tpend;
void **ptp; void **ptp;
struct ceph_crypto_key new_session_key; struct ceph_crypto_key new_session_key;
@ -179,14 +173,12 @@ static int process_one_ticket(struct ceph_auth_client *ac,
} }
/* blob for me */ /* blob for me */
dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0); dp = *p + ceph_x_encrypt_offset();
if (dlen <= 0) { ret = ceph_x_decrypt(secret, p, end);
ret = dlen; if (ret < 0)
goto out; goto out;
} dout(" decrypted %d bytes\n", ret);
dout(" decrypted %d bytes\n", dlen); dend = dp + ret;
dp = dbuf;
dend = dp + dlen;
tkt_struct_v = ceph_decode_8(&dp); tkt_struct_v = ceph_decode_8(&dp);
if (tkt_struct_v != 1) if (tkt_struct_v != 1)
@ -207,15 +199,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
ceph_decode_8_safe(p, end, is_enc, bad); ceph_decode_8_safe(p, end, is_enc, bad);
if (is_enc) { if (is_enc) {
/* encrypted */ /* encrypted */
dout(" encrypted ticket\n"); tp = *p + ceph_x_encrypt_offset();
dlen = ceph_x_decrypt(&th->session_key, p, end, &ticket_buf, 0); ret = ceph_x_decrypt(&th->session_key, p, end);
if (dlen < 0) { if (ret < 0)
ret = dlen;
goto out; goto out;
} dout(" encrypted ticket, decrypted %d bytes\n", ret);
tp = ticket_buf;
ptp = &tp; ptp = &tp;
tpend = *ptp + dlen; tpend = tp + ret;
} else { } else {
/* unencrypted */ /* unencrypted */
ptp = p; ptp = p;
@ -246,8 +236,6 @@ static int process_one_ticket(struct ceph_auth_client *ac,
xi->have_keys |= th->service; xi->have_keys |= th->service;
out: out:
kfree(ticket_buf);
kfree(dbuf);
return ret; return ret;
bad: bad:
@ -638,24 +626,22 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
struct ceph_authorizer *a, size_t len) struct ceph_authorizer *a, size_t len)
{ {
struct ceph_x_authorizer *au = (void *)a; struct ceph_x_authorizer *au = (void *)a;
int ret = 0;
struct ceph_x_authorize_reply reply;
void *preply = &reply;
void *p = au->enc_buf; void *p = au->enc_buf;
struct ceph_x_authorize_reply *reply = p + ceph_x_encrypt_offset();
int ret;
ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN, ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN);
&preply, sizeof(reply));
if (ret < 0) if (ret < 0)
return ret; return ret;
if (ret != sizeof(reply)) if (ret != sizeof(*reply))
return -EPERM; return -EPERM;
if (au->nonce + 1 != le64_to_cpu(reply.nonce_plus_one)) if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one))
ret = -EPERM; ret = -EPERM;
else else
ret = 0; ret = 0;
dout("verify_authorizer_reply nonce %llx got %llx ret %d\n", dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
au->nonce, le64_to_cpu(reply.nonce_plus_one), ret); au->nonce, le64_to_cpu(reply->nonce_plus_one), ret);
return ret; return ret;
} }