Skip to content

Commit

Permalink
libceph: handle an empty authorize reply
Browse files Browse the repository at this point in the history
The authorize reply can be empty, for example when the ticket used to
build the authorizer is too old and TAG_BADAUTHORIZER is returned from
the service.  Calling ->verify_authorizer_reply() results in an attempt
to decrypt and validate (somewhat) random data in au->buf (most likely
the signature block from calc_signature()), which fails and ends up in
con_fault_finish() with !con->auth_retry.  The ticket isn't invalidated
and the connection is retried again and again until a new ticket is
obtained from the monitor:

  libceph: osd2 192.168.122.1:6809 bad authorize reply
  libceph: osd2 192.168.122.1:6809 bad authorize reply
  libceph: osd2 192.168.122.1:6809 bad authorize reply
  libceph: osd2 192.168.122.1:6809 bad authorize reply

Let TAG_BADAUTHORIZER handler kick in and increment con->auth_retry.

Cc: [email protected]
Fixes: 5c056fd ("libceph: verify authorize reply on connect")
Link: https://tracker.ceph.com/issues/20164
Signed-off-by: Ilya Dryomov <[email protected]>
Reviewed-by: Sage Weil <[email protected]>
  • Loading branch information
idryomov committed Feb 18, 2019
1 parent a3b22b9 commit 0fd3fd0
Showing 1 changed file with 9 additions and 6 deletions.
15 changes: 9 additions & 6 deletions net/ceph/messenger.c
Original file line number Diff line number Diff line change
Expand Up @@ -2058,6 +2058,8 @@ static int process_connect(struct ceph_connection *con)
dout("process_connect on %p tag %d\n", con, (int)con->in_tag);

if (con->auth) {
int len = le32_to_cpu(con->in_reply.authorizer_len);

/*
* Any connection that defines ->get_authorizer()
* should also define ->add_authorizer_challenge() and
Expand All @@ -2067,8 +2069,7 @@ static int process_connect(struct ceph_connection *con)
*/
if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) {
ret = con->ops->add_authorizer_challenge(
con, con->auth->authorizer_reply_buf,
le32_to_cpu(con->in_reply.authorizer_len));
con, con->auth->authorizer_reply_buf, len);
if (ret < 0)
return ret;

Expand All @@ -2078,10 +2079,12 @@ static int process_connect(struct ceph_connection *con)
return 0;
}

ret = con->ops->verify_authorizer_reply(con);
if (ret < 0) {
con->error_msg = "bad authorize reply";
return ret;
if (len) {
ret = con->ops->verify_authorizer_reply(con);
if (ret < 0) {
con->error_msg = "bad authorize reply";
return ret;
}
}
}

Expand Down

0 comments on commit 0fd3fd0

Please sign in to comment.