Skip to content

Commit e15fd0a

Browse files
idryomovidryomov
committed
libceph: switch ceph_x_decrypt() to ceph_crypt()
Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Sage Weil <sage@redhat.com>
1 parent d03857c commit e15fd0a

File tree

1 file changed

+32
-46
lines changed

1 file changed

+32
-46
lines changed

‎net/ceph/auth_x.c

Lines changed: 32 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -69,32 +69,28 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret, void *buf,
6969
return sizeof(u32) + ciphertext_len;
7070
}
7171

72-
static int ceph_x_decrypt(struct ceph_crypto_key *secret,
73-
void **p, void *end, void **obuf, size_t olen)
72+
static int ceph_x_decrypt(struct ceph_crypto_key *secret, void **p, void *end)
7473
{
75-
struct ceph_x_encrypt_header head;
76-
size_t head_len = sizeof(head);
77-
int len, ret;
78-
79-
len = ceph_decode_32(p);
80-
if (*p + len > end)
81-
return -EINVAL;
74+
struct ceph_x_encrypt_header *hdr = *p + sizeof(u32);
75+
int ciphertext_len, plaintext_len;
76+
int ret;
8277

83-
dout("ceph_x_decrypt len %d\n", len);
84-
if (*obuf == NULL) {
85-
*obuf = kmalloc(len, GFP_NOFS);
86-
if (!*obuf)
87-
return -ENOMEM;
88-
olen = len;
89-
}
78+
ceph_decode_32_safe(p, end, ciphertext_len, e_inval);
79+
ceph_decode_need(p, end, ciphertext_len, e_inval);
9080

91-
ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
81+
ret = ceph_crypt(secret, false, *p, end - *p, ciphertext_len,
82+
&plaintext_len);
9283
if (ret)
9384
return ret;
94-
if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
85+
86+
if (hdr->struct_v != 1 || le64_to_cpu(hdr->magic) != CEPHX_ENC_MAGIC)
9587
return -EPERM;
96-
*p += len;
97-
return olen;
88+
89+
*p += ciphertext_len;
90+
return plaintext_len - sizeof(struct ceph_x_encrypt_header);
91+
92+
e_inval:
93+
return -EINVAL;
9894
}
9995

10096
/*
@@ -149,12 +145,10 @@ static int process_one_ticket(struct ceph_auth_client *ac,
149145
int type;
150146
u8 tkt_struct_v, blob_struct_v;
151147
struct ceph_x_ticket_handler *th;
152-
void *dbuf = NULL;
153148
void *dp, *dend;
154149
int dlen;
155150
char is_enc;
156151
struct timespec validity;
157-
void *ticket_buf = NULL;
158152
void *tp, *tpend;
159153
void **ptp;
160154
struct ceph_crypto_key new_session_key;
@@ -179,14 +173,12 @@ static int process_one_ticket(struct ceph_auth_client *ac,
179173
}
180174

181175
/* blob for me */
182-
dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
183-
if (dlen <= 0) {
184-
ret = dlen;
176+
dp = *p + ceph_x_encrypt_offset();
177+
ret = ceph_x_decrypt(secret, p, end);
178+
if (ret < 0)
185179
goto out;
186-
}
187-
dout(" decrypted %d bytes\n", dlen);
188-
dp = dbuf;
189-
dend = dp + dlen;
180+
dout(" decrypted %d bytes\n", ret);
181+
dend = dp + ret;
190182

191183
tkt_struct_v = ceph_decode_8(&dp);
192184
if (tkt_struct_v != 1)
@@ -207,15 +199,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
207199
ceph_decode_8_safe(p, end, is_enc, bad);
208200
if (is_enc) {
209201
/* encrypted */
210-
dout(" encrypted ticket\n");
211-
dlen = ceph_x_decrypt(&th->session_key, p, end, &ticket_buf, 0);
212-
if (dlen < 0) {
213-
ret = dlen;
202+
tp = *p + ceph_x_encrypt_offset();
203+
ret = ceph_x_decrypt(&th->session_key, p, end);
204+
if (ret < 0)
214205
goto out;
215-
}
216-
tp = ticket_buf;
206+
dout(" encrypted ticket, decrypted %d bytes\n", ret);
217207
ptp = &tp;
218-
tpend = *ptp + dlen;
208+
tpend = tp + ret;
219209
} else {
220210
/* unencrypted */
221211
ptp = p;
@@ -246,8 +236,6 @@ static int process_one_ticket(struct ceph_auth_client *ac,
246236
xi->have_keys |= th->service;
247237

248238
out:
249-
kfree(ticket_buf);
250-
kfree(dbuf);
251239
return ret;
252240

253241
bad:
@@ -638,24 +626,22 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
638626
struct ceph_authorizer *a, size_t len)
639627
{
640628
struct ceph_x_authorizer *au = (void *)a;
641-
int ret = 0;
642-
struct ceph_x_authorize_reply reply;
643-
void *preply = &reply;
644629
void *p = au->enc_buf;
630+
struct ceph_x_authorize_reply *reply = p + ceph_x_encrypt_offset();
631+
int ret;
645632

646-
ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN,
647-
&preply, sizeof(reply));
633+
ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN);
648634
if (ret < 0)
649635
return ret;
650-
if (ret != sizeof(reply))
636+
if (ret != sizeof(*reply))
651637
return -EPERM;
652638

653-
if (au->nonce + 1 != le64_to_cpu(reply.nonce_plus_one))
639+
if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one))
654640
ret = -EPERM;
655641
else
656642
ret = 0;
657643
dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
658-
au->nonce, le64_to_cpu(reply.nonce_plus_one), ret);
644+
au->nonce, le64_to_cpu(reply->nonce_plus_one), ret);
659645
return ret;
660646
}
661647

0 commit comments

Comments
 (0)