diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2016-01-14 16:35:35 +0100 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2016-01-21 19:36:08 +0100 |
| commit | 6abe097db59e1a5af7f082709f38bd95c54ccca1 (patch) | |
| tree | 36ab1b6315e4b421f6cd5f25919330b8222da2d6 | |
| parent | f6330cc1f04b7dcb84b572d402cdacf7e275a022 (diff) | |
libceph: fix authorizer invalidation, take 2
Back in 2013, commit 4b8e8b5d78b8 ("libceph: fix authorizer
invalidation") tried to fix authorizer invalidation issues by clearing
validity field. However, nothing ever consults this field, so it
doesn't force us to request any new secrets in any way and therefore we
never get out of the exponential backoff mode:
[ 129.973812] libceph: osd2 192.168.122.1:6810 connect authorization failure
[ 130.706785] libceph: osd2 192.168.122.1:6810 connect authorization failure
[ 131.710088] libceph: osd2 192.168.122.1:6810 connect authorization failure
[ 133.708321] libceph: osd2 192.168.122.1:6810 connect authorization failure
[ 137.706598] libceph: osd2 192.168.122.1:6810 connect authorization failure
...
AFAICT this was the case at the time 4b8e8b5d78b8 was merged, too.
Using timespec solely as a bool isn't nice, so introduce a new have_key
flag, specifically for this purpose.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Sage Weil <sage@redhat.com>
| -rw-r--r-- | net/ceph/auth_x.c | 27 | ||||
| -rw-r--r-- | net/ceph/auth_x.h | 1 |
2 files changed, 23 insertions, 5 deletions
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c index 10d87753ed87..ab080bb18254 100644 --- a/net/ceph/auth_x.c +++ b/net/ceph/auth_x.c @@ -237,6 +237,7 @@ static int process_one_ticket(struct ceph_auth_client *ac, th->secret_id = new_secret_id; th->expires = new_expires; th->renew_after = new_renew_after; + th->have_key = true; dout(" got ticket service %d (%s) secret_id %lld len %d\n", type, ceph_entity_type_name(type), th->secret_id, (int)th->ticket_blob->vec.iov_len); @@ -384,6 +385,24 @@ bad: return -ERANGE; } +static bool need_key(struct ceph_x_ticket_handler *th) +{ + if (!th->have_key) + return true; + + return get_seconds() >= th->renew_after; +} + +static bool have_key(struct ceph_x_ticket_handler *th) +{ + if (th->have_key) { + if (get_seconds() >= th->expires) + th->have_key = false; + } + + return th->have_key; +} + static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed) { int want = ac->want_keys; @@ -402,20 +421,18 @@ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed) continue; th = get_ticket_handler(ac, service); - if (IS_ERR(th)) { *pneed |= service; continue; } - if (get_seconds() >= th->renew_after) + if (need_key(th)) *pneed |= service; - if (get_seconds() >= th->expires) + if (!have_key(th)) xi->have_keys &= ~service; } } - static int ceph_x_build_request(struct ceph_auth_client *ac, void *buf, void *end) { @@ -674,7 +691,7 @@ static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac, th = get_ticket_handler(ac, peer_type); if (!IS_ERR(th)) - memset(&th->validity, 0, sizeof(th->validity)); + th->have_key = false; } static int calcu_signature(struct ceph_x_authorizer *au, diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h index e8b7c6917d47..5334b9b159c5 100644 --- a/net/ceph/auth_x.h +++ b/net/ceph/auth_x.h @@ -17,6 +17,7 @@ struct ceph_x_ticket_handler { struct ceph_crypto_key session_key; struct ceph_timespec validity; + bool have_key; u64 secret_id; struct ceph_buffer *ticket_blob; |