import ceph pacific 16.2.5

[ceph.git] / ceph / src / rgw / rgw_auth_s3.cc

diff --git a/ceph/src/rgw/rgw_auth_s3.cc b/ceph/src/rgw/rgw_auth_s3.cc
index 670313b603c1e10bfc00744a876c4ef7190162ae..6fa6e651e50cad95847e26e94cfeddf95ddfb5c6 100644 (file)
--- a/ceph/src/rgw/rgw_auth_s3.cc
+++ b/ceph/src/rgw/rgw_auth_s3.cc
@@ -77,7 +77,7 @@ get_canon_amz_hdr(const meta_map_t& meta_map)
  * ?get the canonical representation of the object's location
  */
 static std::string
-get_canon_resource(const char* const request_uri,
+get_canon_resource(const DoutPrefixProvider *dpp, const char* const request_uri,
                    const std::map<std::string, std::string>& sub_resources)
 {
   std::string dest;
@@ -107,7 +107,7 @@ get_canon_resource(const char* const request_uri,
     }
   }
 
-  dout(10) << "get_canon_resource(): dest=" << dest << dendl;
+  ldpp_dout(dpp, 10) << "get_canon_resource(): dest=" << dest << dendl;
   return dest;
 }
 
@@ -116,6 +116,7 @@ get_canon_resource(const char* const request_uri,
  * compute a request's signature
  */
 void rgw_create_s3_canonical_header(
+  const DoutPrefixProvider *dpp,
   const char* const method,
   const char* const content_md5,
   const char* const content_type,
@@ -150,7 +151,7 @@ void rgw_create_s3_canonical_header(
 
   dest.append(get_canon_amz_hdr(meta_map));
   dest.append(get_canon_amz_hdr(qs_map));
-  dest.append(get_canon_resource(request_uri, sub_resources));
+  dest.append(get_canon_resource(dpp, request_uri, sub_resources));
 
   dest_str = dest;
 }
@@ -177,7 +178,8 @@ static inline void get_v2_qs_map(const req_info& info,
  * get the header authentication  information required to
  * compute a request's signature
  */
-bool rgw_create_s3_canonical_header(const req_info& info,
+bool rgw_create_s3_canonical_header(const DoutPrefixProvider *dpp,
+                                    const req_info& info,
                                     utime_t* const header_time,
                                     std::string& dest,
                                     const bool qsr)
@@ -186,7 +188,7 @@ bool rgw_create_s3_canonical_header(const req_info& info,
   if (content_md5) {
     for (const char *p = content_md5; *p; p++) {
       if (!is_base64_for_content_md5(*p)) {
-        dout(0) << "NOTICE: bad content-md5 provided (not base64),"
+        ldpp_dout(dpp, 0) << "NOTICE: bad content-md5 provided (not base64),"
                 << " aborting request p=" << *p << " " << (int)*p << dendl;
         return false;
       }
@@ -207,7 +209,7 @@ bool rgw_create_s3_canonical_header(const req_info& info,
     if (str == NULL) {
       req_date = info.env->get("HTTP_DATE");
       if (!req_date) {
-        dout(0) << "NOTICE: missing date for auth header" << dendl;
+        ldpp_dout(dpp, 0) << "NOTICE: missing date for auth header" << dendl;
         return false;
       }
       date = req_date;
@@ -216,11 +218,11 @@ bool rgw_create_s3_canonical_header(const req_info& info,
     if (header_time) {
       struct tm t;
       if (!parse_rfc2616(req_date, &t)) {
-        dout(0) << "NOTICE: failed to parse date for auth header" << dendl;
+        ldpp_dout(dpp, 0) << "NOTICE: failed to parse date for auth header" << dendl;
         return false;
       }
       if (t.tm_year < 70) {
-        dout(0) << "NOTICE: bad date (predates epoch): " << req_date << dendl;
+        ldpp_dout(dpp, 0) << "NOTICE: bad date (predates epoch): " << req_date << dendl;
         return false;
       }
       *header_time = utime_t(internal_timegm(&t), 0);
@@ -238,7 +240,7 @@ bool rgw_create_s3_canonical_header(const req_info& info,
     request_uri = info.effective_uri;
   }
 
-  rgw_create_s3_canonical_header(info.method, content_md5, content_type,
+  rgw_create_s3_canonical_header(dpp, info.method, content_md5, content_type,
                                  date.c_str(), meta_map, qs_map,
                                 request_uri.c_str(), sub_resources, dest);
   return true;
@@ -377,7 +379,8 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
                                        std::string_view& signedheaders,  /* out */
                                        std::string_view& signature,      /* out */
                                        std::string_view& date,           /* out */
-                                       std::string_view& sessiontoken)   /* out */
+                                       std::string_view& sessiontoken,   /* out */
+                                       const DoutPrefixProvider *dpp)
 {
   std::string_view input(info.env->get("HTTP_AUTHORIZATION", ""));
   try {
@@ -385,7 +388,7 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
   } catch (std::out_of_range&) {
     /* We should never ever run into this situation as the presence of
      * AWS4_HMAC_SHA256_STR had been verified earlier. */
-    dout(10) << "credentials string is too short" << dendl;
+    ldpp_dout(dpp, 10) << "credentials string is too short" << dendl;
     return -EINVAL;
   }
 
@@ -395,7 +398,7 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
     if (parsed_pair) {
       kv[parsed_pair->first] = parsed_pair->second;
     } else {
-      dout(10) << "NOTICE: failed to parse auth header (s=" << s << ")"
+      ldpp_dout(dpp, 10) << "NOTICE: failed to parse auth header (s=" << s << ")"
                << dendl;
       return -EINVAL;
     }
@@ -410,7 +413,7 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
   /* Ensure that the presigned required keys are really there. */
   for (const auto& k : required_keys) {
     if (kv.find(k) == std::end(kv)) {
-      dout(10) << "NOTICE: auth header missing key: " << k << dendl;
+      ldpp_dout(dpp, 10) << "NOTICE: auth header missing key: " << k << dendl;
       return -EINVAL;
     }
   }
@@ -420,7 +423,7 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
   signature = kv["Signature"];
 
   /* sig hex str */
-  dout(10) << "v4 signature format = " << signature << dendl;
+  ldpp_dout(dpp, 10) << "v4 signature format = " << signature << dendl;
 
   /* ------------------------- handle x-amz-date header */
 
@@ -429,7 +432,7 @@ static inline int parse_v4_auth_header(const req_info& info,               /* in
   const char *d = info.env->get("HTTP_X_AMZ_DATE");
   struct tm t;
   if (!parse_iso8601(d, &t, NULL, false)) {
-    dout(10) << "error reading date via http_x_amz_date" << dendl;
+    ldpp_dout(dpp, 10) << "error reading date via http_x_amz_date" << dendl;
     return -EACCES;
   }
   date = d;
@@ -452,7 +455,8 @@ int parse_v4_credentials(const req_info& info,                     /* in */
                         std::string_view& signature,            /* out */
                         std::string_view& date,                 /* out */
                         std::string_view& session_token,        /* out */
-                        const bool using_qs)                      /* in */
+                        const bool using_qs,                    /* in */
+                         const DoutPrefixProvider *dpp)
 {
   std::string_view credential;
   int ret;
@@ -461,7 +465,7 @@ int parse_v4_credentials(const req_info& info,                     /* in */
                                 signature, date, session_token);
   } else {
     ret = parse_v4_auth_header(info, credential, signedheaders,
-                               signature, date, session_token);
+                               signature, date, session_token, dpp);
   }
 
   if (ret < 0) {
@@ -469,7 +473,7 @@ int parse_v4_credentials(const req_info& info,                     /* in */
   }
 
   /* access_key/YYYYMMDD/region/service/aws4_request */
-  dout(10) << "v4 credential format = " << credential << dendl;
+  ldpp_dout(dpp, 10) << "v4 credential format = " << credential << dendl;
 
   if (std::count(credential.begin(), credential.end(), '/') != 4) {
     return -EINVAL;
@@ -483,11 +487,11 @@ int parse_v4_credentials(const req_info& info,                     /* in */
   /* grab access key id */
   const size_t pos = credential.find("/");
   access_key_id = credential.substr(0, pos);
-  dout(10) << "access key id = " << access_key_id << dendl;
+  ldpp_dout(dpp, 10) << "access key id = " << access_key_id << dendl;
 
   /* grab credential scope */
   credential_scope = credential.substr(pos + 1);
-  dout(10) << "credential scope = " << credential_scope << dendl;
+  ldpp_dout(dpp, 10) << "credential scope = " << credential_scope << dendl;
 
   return 0;
 }
@@ -633,9 +637,10 @@ get_v4_canon_req_hash(CephContext* cct,
                       const std::string& canonical_qs,
                       const std::string& canonical_hdrs,
                       const std::string_view& signed_hdrs,
-                      const std::string_view& request_payload_hash)
+                      const std::string_view& request_payload_hash,
+                      const DoutPrefixProvider *dpp)
 {
-  ldout(cct, 10) << "payload request hash = " << request_payload_hash << dendl;
+  ldpp_dout(dpp, 10) << "payload request hash = " << request_payload_hash << dendl;
 
   const auto canonical_req = string_join_reserve("\n",
     http_verb,
@@ -648,8 +653,8 @@ get_v4_canon_req_hash(CephContext* cct,
   const auto canonical_req_hash = calc_hash_sha256(canonical_req);
 
   using sanitize = rgw::crypt_sanitize::log_content;
-  ldout(cct, 10) << "canonical request = " << sanitize{canonical_req} << dendl;
-  ldout(cct, 10) << "canonical request hash = "
+  ldpp_dout(dpp, 10) << "canonical request = " << sanitize{canonical_req} << dendl;
+  ldpp_dout(dpp, 10) << "canonical request hash = "
                  << canonical_req_hash << dendl;
 
   return canonical_req_hash;
@@ -665,7 +670,8 @@ get_v4_string_to_sign(CephContext* const cct,
                       const std::string_view& algorithm,
                       const std::string_view& request_date,
                       const std::string_view& credential_scope,
-                      const sha256_digest_t& canonreq_hash)
+                      const sha256_digest_t& canonreq_hash,
+                      const DoutPrefixProvider *dpp)
 {
   const auto hexed_cr_hash = canonreq_hash.to_str();
   const std::string_view hexed_cr_hash_str(hexed_cr_hash);
@@ -676,7 +682,7 @@ get_v4_string_to_sign(CephContext* const cct,
     credential_scope,
     hexed_cr_hash_str);
 
-  ldout(cct, 10) << "string to sign = "
+  ldpp_dout(dpp, 10) << "string to sign = "
                  << rgw::crypt_sanitize::log_content{string_to_sign}
                  << dendl;
 
@@ -734,7 +740,8 @@ transform_secret_key(const std::string_view& secret_access_key)
 static sha256_digest_t
 get_v4_signing_key(CephContext* const cct,
                    const std::string_view& credential_scope,
-                   const std::string_view& secret_access_key)
+                   const std::string_view& secret_access_key,
+                   const DoutPrefixProvider *dpp)
 {
   std::string_view date, region, service;
   std::tie(date, region, service) = parse_cred_scope(credential_scope);
@@ -748,10 +755,10 @@ get_v4_signing_key(CephContext* const cct,
   const auto signing_key = calc_hmac_sha256(service_k,
                                             std::string_view("aws4_request"));
 
-  ldout(cct, 10) << "date_k    = " << date_k << dendl;
-  ldout(cct, 10) << "region_k  = " << region_k << dendl;
-  ldout(cct, 10) << "service_k = " << service_k << dendl;
-  ldout(cct, 10) << "signing_k = " << signing_key << dendl;
+  ldpp_dout(dpp, 10) << "date_k    = " << date_k << dendl;
+  ldpp_dout(dpp, 10) << "region_k  = " << region_k << dendl;
+  ldpp_dout(dpp, 10) << "service_k = " << service_k << dendl;
+  ldpp_dout(dpp, 10) << "signing_k = " << signing_key << dendl;
 
   return signing_key;
 }
@@ -769,9 +776,10 @@ AWSEngine::VersionAbstractor::server_signature_t
 get_v4_signature(const std::string_view& credential_scope,
                  CephContext* const cct,
                  const std::string_view& secret_key,
-                 const AWSEngine::VersionAbstractor::string_to_sign_t& string_to_sign)
+                 const AWSEngine::VersionAbstractor::string_to_sign_t& string_to_sign,
+                 const DoutPrefixProvider *dpp)
 {
-  auto signing_key = get_v4_signing_key(cct, credential_scope, secret_key);
+  auto signing_key = get_v4_signing_key(cct, credential_scope, secret_key, dpp);
 
   /* The server-side generated digest for comparison. */
   const auto digest = calc_hmac_sha256(signing_key, string_to_sign);
@@ -783,7 +791,7 @@ get_v4_signature(const std::string_view& credential_scope,
                             digest.SIZE * 2);
   buf_to_hex(digest.v, digest.SIZE, signature.begin());
 
-  ldout(cct, 10) << "generated signature = " << signature << dendl;
+  ldpp_dout(dpp, 10) << "generated signature = " << signature << dendl;
 
   return signature;
 }
@@ -1076,7 +1084,7 @@ AWSv4ComplMulti::create(const req_state* const s,
   }
 
   const auto signing_key = \
-    rgw::auth::s3::get_v4_signing_key(s->cct, credential_scope, *secret_key);
+    rgw::auth::s3::get_v4_signing_key(s->cct, credential_scope, *secret_key, s);
 
   return std::make_shared<AWSv4ComplMulti>(s,
                                            std::move(date),