Message	SHA1
libceph: add authorizer challenge ... commit 6daca13d2e72bedaaacfc08f873114c9307d5aea upstream. When a client authenticates with a service, an authorizer is sent with a nonce to the service (ceph_x_authorize_[ab]) and the service responds with a mutation of that nonce (ceph_x_authorize_reply). This lets the client verify the service is who it says it is but it doesn't protect against a replay: someone can trivially capture the exchange and reuse the same authorizer to authenticate themselves. Allow the service to reject an initial authorizer with a random challenge (ceph_x_authorize_challenge). The client then has to respond with an updated authorizer proving they are able to decrypt the service's challenge and that the new authorizer was produced for this specific connection instance. The accepting side requires this challenge and response unconditionally if the client side advertises they have CEPHX_V2 feature bit. This addresses CVE-2018-1128. Link: http://tracker.ceph.com/issues/24836 Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Sage Weil <sage@redhat.com> Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Ilya Dryomov   authored and   Greg Kroah-Hartman   commited 2018-12-08 13:05:10 +01:00	06e925920d
libceph: use keepalive2 to verify the mon session is alive ... Signed-off-by: Yan, Zheng <zyan@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Yan, Zheng   authored and   Ilya Dryomov   commited 2015-09-08 23:14:30 +03:00	8b9558aab8
libceph: update ceph_msg_header structure ... 2 bytes of what was reserved space is now used by userspace for the compat_version field. Signed-off-by: John Spray <john.spray@redhat.com> Reviewed-by: Sage Weil <sage@redhat.com> John Spray   authored and   Ilya Dryomov   commited 2014-12-17 20:09:50 +03:00	d4e1a4e0db
libceph: message signature support ... Signed-off-by: Yan, Zheng <zyan@redhat.com> Yan, Zheng   authored and   Ilya Dryomov   commited 2014-12-17 20:09:50 +03:00	33d0733796
libceph: implement RECONNECT_SEQ feature ... This is an old protocol extension that allows the client and server to avoid resending old messages after a reconnect (following a socket error). Instead, the exchange their sequence numbers during the handshake. This avoids sending a bunch of useless data over the socket. It has been supported in the server code since v0.22 (Sep 2010). Signed-off-by: Sage Weil <sage@inktank.com> Reviewed-by: Alex Elder <elder@inktank.com> Sage Weil   commited 2013-05-01 21:17:09 -07:00	3a23083bda
ceph: factor out libceph from Ceph file system ... This factors out protocol and low-level storage parts of ceph into a separate libceph module living in net/ceph and include/linux/ceph. This is mostly a matter of moving files around. However, a few key pieces of the interface change as well: - ceph_client becomes ceph_fs_client and ceph_client, where the latter captures the mon and osd clients, and the fs_client gets the mds client and file system specific pieces. - Mount option parsing and debugfs setup is correspondingly broken into two pieces. - The mon client gets a generic handler callback for otherwise unknown messages (mds map, in this case). - The basic supported/required feature bits can be expanded (and are by ceph_fs_client). No functional change, aside from some subtle error handling cases that got cleaned up in the refactoring process. Signed-off-by: Sage Weil <sage@newdream.net> Yehuda Sadeh   authored and   Sage Weil   commited 2010-10-20 15:37:28 -07:00	3d14c5d2b6

Renamed from fs/ceph/msgr.h (Browse further)