v10.2.11 Jewel

This point releases brings a number of important bugfixes and has a fewimportant security fixes. This is expected to be the last Jewel release. Werecommend all Jewel 10.2.x users to upgrade.

Notable Changes

  • CVE 2018-1128: auth: cephx authorizer subject to replay attack (issue#24836, Sage Weil)

  • CVE 2018-1129: auth: cephx signature check is weak (issue#24837, Sage Weil)

  • CVE 2018-10861: mon: auth checks not correct for pool ops (issue#24838, Jason Dillaman)

  • The RBD C API’s rbd_discard method and the C++ API’s Image::discard methodnow enforce a maximum length of 2GB. This restriction prevents overflow ofthe result code.

  • New OSDs will now use rocksdb for omap data by default, rather thanleveldb. omap is used by RGW bucket indexes and CephFS directories,and when a single leveldb grows to 10s of GB with a high write ordelete workload, it can lead to high latency when leveldb’ssingle-threaded compaction cannot keep up. rocksdb supports multiplethreads for compaction, which avoids this problem.

  • The CephFS client now catches failures to clear dentries during startupand refuses to start as consistency and untrimmable cache issues maydevelop. The new option client_die_on_failed_dentry_invalidate (default:true) may be turned off to allow the client to proceed (dangerous!).

  • In 10.2.10 and earlier releases, keyring caps were not checked for validity,so the caps string could be anything. As of 10.2.11, caps strings arevalidated and providing a keyring with an invalid caps string to, e.g.,“ceph auth add” will result in an error.

Changelog