]> git.apps.os.sepia.ceph.com Git - ceph.git/commit
auth/cephx: ignore CEPH_ENTITY_TYPE_AUTH in requested keys
authorIlya Dryomov <idryomov@gmail.com>
Tue, 2 Mar 2021 14:09:26 +0000 (15:09 +0100)
committerIlya Dryomov <idryomov@gmail.com>
Mon, 12 Apr 2021 18:56:35 +0000 (20:56 +0200)
commit9f3efe7cd1a780b91e5c8cfee192a0c51d0151dc
treea00644daf52fee02c50672c2dff0673536ca246d
parent1f57617d5edb45a8a696eac7c910e8fc44c934a3
auth/cephx: ignore CEPH_ENTITY_TYPE_AUTH in requested keys

When handling CEPHX_GET_AUTH_SESSION_KEY requests from nautilus+
clients, ignore CEPH_ENTITY_TYPE_AUTH in CephXAuthenticate::other_keys.
Similarly, when handling CEPHX_GET_PRINCIPAL_SESSION_KEY requests,
ignore CEPH_ENTITY_TYPE_AUTH in CephXServiceTicketRequest::keys.
These fields are intended for requesting service tickets, the auth
ticket (which is really a ticket granting ticket) must not be shared
this way.

Otherwise we end up sharing an auth ticket that a) isn't encrypted
with the old session key even if needed (should_enc_ticket == true)
and b) has the wrong validity, namely auth_service_ticket_ttl instead
of auth_mon_ticket_ttl.  In the CEPHX_GET_AUTH_SESSION_KEY case, this
undue ticket immediately supersedes the actual auth ticket already
encoded in the same reply (the reply frame ends up containing two auth
tickets).

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit 05772ab6127bdd9ed2f63fceef840f197ecd9ea8)
src/auth/cephx/CephxServiceHandler.cc