linux-stable.git/net/ceph, branch v4.9.147

libceph: check authorizer reply/challenge length before reading

2018-12-08T12:05:10+00:00

commit 130f52f2b203aa0aec179341916ffb2e905f3afd upstream.

Avoid scribbling over memory if the received reply/challenge is larger
than the buffer supplied with the authorizer.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()

2018-12-08T12:05:10+00:00

commit f1d10e04637924f2b00a0fecdd2ca4565f5cfc3f upstream.

Allow for extending ceph_x_authorize_reply in the future.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: implement CEPHX_V2 calculation mode

2018-12-08T12:05:10+00:00

commit cc255c76c70f7a87d97939621eae04b600d9f4a1 upstream.

Derive the signature from the entire buffer (both AES cipher blocks)
instead of using just the first half of the first block, leaving out
data_crc entirely.

This addresses CVE-2018-1129.

Link: http://tracker.ceph.com/issues/24837
Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
[bwh: Backported to 4.9:
 - Define and test the feature bit in the old way
 - Don't change any other feature bits in ceph_features.h]
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: add authorizer challenge

2018-12-08T12:05:10+00:00

commit 6daca13d2e72bedaaacfc08f873114c9307d5aea upstream.

When a client authenticates with a service, an authorizer is sent with
a nonce to the service (ceph_x_authorize_[ab]) and the service responds
with a mutation of that nonce (ceph_x_authorize_reply).  This lets the
client verify the service is who it says it is but it doesn't protect
against a replay: someone can trivially capture the exchange and reuse
the same authorizer to authenticate themselves.

Allow the service to reject an initial authorizer with a random
challenge (ceph_x_authorize_challenge).  The client then has to respond
with an updated authorizer proving they are able to decrypt the
service's challenge and that the new authorizer was produced for this
specific connection instance.

The accepting side requires this challenge and response unconditionally
if the client side advertises they have CEPHX_V2 feature bit.

This addresses CVE-2018-1128.

Link: http://tracker.ceph.com/issues/24836
Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: factor out encrypt_authorizer()

2018-12-08T12:05:10+00:00

commit 149cac4a50b0b4081b38b2f38de6ef71c27eaa85 upstream.

Will be used for encrypting both the initial and updated authorizers.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: factor out __ceph_x_decrypt()

2018-12-08T12:05:10+00:00

commit c571fe24d243bfe7017f0e67fe800b3cc2a1d1f7 upstream.

Will be used for decrypting the server challenge which is only preceded
by ceph_x_encrypt_header.

Drop struct_v check to allow for extending ceph_x_encrypt_header in the
future.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: factor out __prepare_write_connect()

2018-12-08T12:05:09+00:00

commit c0f56b483aa09c99bfe97409a43ad786f33b8a5a upstream.

Will be used for sending ceph_msg_connect with an updated authorizer,
after the server challenges the initial authorizer.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: store ceph_auth_handshake pointer in ceph_connection

2018-12-08T12:05:09+00:00

commit 262614c4294d33b1f19e0d18c0091d9c329b544a upstream.

We already copy authorizer_reply_buf and authorizer_reply_buf_len into
ceph_connection.  Factoring out __prepare_write_connect() requires two
more: authorizer_buf and authorizer_buf_len.  Store the pointer to the
handshake in con->auth rather than piling on.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: no need to drop con->mutex for ->get_authorizer()

2018-12-08T12:05:09+00:00

commit b3bbd3f2ab19c8ca319003b4b51ce4c4ca74da06 upstream.

->get_authorizer(), ->verify_authorizer_reply(), ->sign_message() and
->check_message_signature() shouldn't be doing anything with or on the
connection (like closing it or sending messages).

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

libceph: drop len argument of *verify_authorizer_reply()

2018-12-08T12:05:09+00:00

commit 0dde584882ade13dc9708d611fbf69b0ae8a9e48 upstream.

The length of the reply is protocol-dependent - for cephx it's
ceph_x_authorize_reply.  Nothing sensible can be passed from the
messenger layer anyway.

Signed-off-by: Ilya Dryomov 
Reviewed-by: Sage Weil 
Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman