Unified · Split
| @@ -200,7 +200,7 @@ static int process_one_ticket(struct ceph_auth_client *ac, · 199 unmodified lines | |||
| 200 | dout(" decrypted %d bytes\n", ret); | 200 | dout(" decrypted %d bytes\n", ret); |
| 201 | dend = dp + ret; | 201 | dend = dp + ret; |
| 202 | 202 | ||
| 203 | tkt_struct_v = ceph_decode_8(&dp); | 203 | ceph_decode_8_safe(&dp, dend, tkt_struct_v, bad); |
| 204 | if (tkt_struct_v != 1) | 204 | if (tkt_struct_v != 1) |
| 205 | goto bad; | 205 | goto bad; |
| 206 | 206 | ||
| @@ -208,6 +208,7 @@ static int process_one_ticket(struct ceph_auth_client *ac, · 1 unmodified line | |||
| 208 | if (ret) | 208 | if (ret) |
| 209 | goto out; | 209 | goto out; |
| 210 | 210 | ||
| 211 | ceph_decode_need(&dp, dend, sizeof(struct ceph_timespec), bad); | ||
| 211 | ceph_decode_timespec64(&validity, dp); | 212 | ceph_decode_timespec64(&validity, dp); |
| 212 | dp += sizeof(struct ceph_timespec); | 213 | dp += sizeof(struct ceph_timespec); |
| 213 | new_expires = ktime_get_real_seconds() + validity.tv_sec; | 214 | new_expires = ktime_get_real_seconds() + validity.tv_sec; |
| @@ -491,6 +492,7 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 277 unmodified lines | |||
| 491 | struct ceph_x_info *xi = ac->private; | 492 | struct ceph_x_info *xi = ac->private; |
| 492 | int need; | 493 | int need; |
| 493 | struct ceph_x_request_header *head = buf; | 494 | struct ceph_x_request_header *head = buf; |
| 495 | void *p; | ||
| 494 | int ret; | 496 | int ret; |
| 495 | struct ceph_x_ticket_handler *th = | 497 | struct ceph_x_ticket_handler *th = |
| 496 | get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); | 498 | get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); |
| @@ -504,12 +506,12 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 7 unmodified lines | |||
| 504 | 506 | ||
| 505 | if (need & CEPH_ENTITY_TYPE_AUTH) { | 507 | if (need & CEPH_ENTITY_TYPE_AUTH) { |
| 506 | struct ceph_x_authenticate *auth = (void *)(head + 1); | 508 | struct ceph_x_authenticate *auth = (void *)(head + 1); |
| 507 | void *p = auth + 1; | ||
| 508 | void *enc_buf = xi->auth_authorizer.enc_buf; | 509 | void *enc_buf = xi->auth_authorizer.enc_buf; |
| 509 | struct ceph_x_challenge_blob *blob = enc_buf + | 510 | struct ceph_x_challenge_blob *blob = enc_buf + |
| 510 | ceph_x_encrypt_offset(); | 511 | ceph_x_encrypt_offset(); |
| 511 | u64 *u; | 512 | u64 *u; |
| 512 | 513 | ||
| 514 | p = auth + 1; | ||
| 513 | if (p > end) | 515 | if (p > end) |
| 514 | return -ERANGE; | 516 | return -ERANGE; |
| 515 | 517 | ||
| @@ -542,35 +544,35 @@ static int ceph_x_build_request(struct ceph_auth_client *ac, · 26 unmodified lines | |||
| 542 | } | 544 | } |
| 543 | 545 | ||
| 544 | if (need) { | 546 | if (need) { |
| 545 | void *p = head + 1; | 547 | dout(" get_principal_session_key\n"); |
| 546 | struct ceph_x_service_ticket_request *req; | ||
| 547 | |||
| 548 | if (p > end) | ||
| 549 | return -ERANGE; | ||
| 550 | head->op = cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY); | ||
| 551 | |||
| 552 | ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer); | 548 | ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer); |
| 553 | if (ret) | 549 | if (ret) |
| 554 | return ret; | 550 | return ret; |
| 555 | ceph_encode_copy(&p, xi->auth_authorizer.buf->vec.iov_base, | ||
| 556 | xi->auth_authorizer.buf->vec.iov_len); | ||
| 557 | 551 | ||
| 558 | req = p; | 552 | p = buf; |
| 559 | req->keys = cpu_to_le32(need); | 553 | ceph_encode_16_safe(&p, end, CEPHX_GET_PRINCIPAL_SESSION_KEY, |
| 560 | p += sizeof(*req); | 554 | e_range); |
| 555 | ceph_encode_copy_safe(&p, end, | ||
| 556 | xi->auth_authorizer.buf->vec.iov_base, | ||
| 557 | xi->auth_authorizer.buf->vec.iov_len, e_range); | ||
| 558 | ceph_encode_8_safe(&p, end, 1, e_range); | ||
| 559 | ceph_encode_32_safe(&p, end, need, e_range); | ||
| 561 | return p - buf; | 560 | return p - buf; |
| 562 | } | 561 | } |
| 563 | 562 | ||
| 564 | return 0; | 563 | return 0; |
| 564 | |||
| 565 | e_range: | ||
| 566 | return -ERANGE; | ||
| 565 | } | 567 | } |
| 566 | 568 | ||
| 567 | static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, | 569 | static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, |
| 568 | void *buf, void *end) | 570 | void *buf, void *end) |
| 569 | { | 571 | { |
| 570 | struct ceph_x_info *xi = ac->private; | 572 | struct ceph_x_info *xi = ac->private; |
| 571 | struct ceph_x_reply_header *head = buf; | ||
| 572 | struct ceph_x_ticket_handler *th; | 573 | struct ceph_x_ticket_handler *th; |
| 573 | int len = end - buf; | 574 | int len = end - buf; |
| 575 | void *p; | ||
| 574 | int op; | 576 | int op; |
| 575 | int ret; | 577 | int ret; |
| 576 | 578 | ||
| @@ -591,22 +593,22 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, · 14 unmodified lines | |||
| 591 | return -EAGAIN; | 593 | return -EAGAIN; |
| 592 | } | 594 | } |
| 593 | 595 | ||
| 594 | op = le16_to_cpu(head->op); | 596 | p = buf; |
| 595 | result = le32_to_cpu(head->result); | 597 | ceph_decode_16_safe(&p, end, op, e_inval); |
| 598 | ceph_decode_32_safe(&p, end, result, e_inval); | ||
| 596 | dout("handle_reply op %d result %d\n", op, result); | 599 | dout("handle_reply op %d result %d\n", op, result); |
| 597 | switch (op) { | 600 | switch (op) { |
| 598 | case CEPHX_GET_AUTH_SESSION_KEY: | 601 | case CEPHX_GET_AUTH_SESSION_KEY: |
| 599 | /* verify auth key */ | 602 | /* verify auth key */ |
| 600 | ret = ceph_x_proc_ticket_reply(ac, &xi->secret, | 603 | ret = ceph_x_proc_ticket_reply(ac, &xi->secret, p, end); |
| 601 | buf + sizeof(*head), end); | ||
| 602 | break; | 604 | break; |
| 603 | 605 | ||
| 604 | case CEPHX_GET_PRINCIPAL_SESSION_KEY: | 606 | case CEPHX_GET_PRINCIPAL_SESSION_KEY: |
| 605 | th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); | 607 | th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH); |
| 606 | if (IS_ERR(th)) | 608 | if (IS_ERR(th)) |
| 607 | return PTR_ERR(th); | 609 | return PTR_ERR(th); |
| 608 | ret = ceph_x_proc_ticket_reply(ac, &th->session_key, | 610 | |
| 609 | buf + sizeof(*head), end); | 611 | ret = ceph_x_proc_ticket_reply(ac, &th->session_key, p, end); |
| 610 | break; | 612 | break; |
| 611 | 613 | ||
| 612 | default: | 614 | default: |
| @@ -617,6 +619,9 @@ static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result, · 4 unmodified lines | |||
| 617 | if (ac->want_keys == xi->have_keys) | 619 | if (ac->want_keys == xi->have_keys) |
| 618 | return 0; | 620 | return 0; |
| 619 | return -EAGAIN; | 621 | return -EAGAIN; |
| 622 | |||
| 623 | e_inval: | ||
| 624 | return -EINVAL; | ||
| 620 | } | 625 | } |
| 621 | 626 | ||
| 622 | static void ceph_x_destroy_authorizer(struct ceph_authorizer *a) | 627 | static void ceph_x_destroy_authorizer(struct ceph_authorizer *a) |