mon: require authentication but no caps for monmap and config

Signed-off-by: Sage Weil <sage@redhat.com>

diff --git a/qa/workunits/mon/caps.sh b/qa/workunits/mon/caps.sh
index 134d514c4edaab623985cba03eb1080850a8d056..488fcec96ede0ac6ba10e057b3caeef467be0416 100755 (executable)
--- a/qa/workunits/mon/caps.sh
+++ b/qa/workunits/mon/caps.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -x
+
 tmp=/tmp/cephtest-mon-caps-madness
 
 exit_on_error=1

diff --git a/src/mon/ConfigMonitor.cc b/src/mon/ConfigMonitor.cc
index 55025d35ae1b00a4d722f2821a98364e276f1329..5a260ab571dfed72d668a1ebc7d2af6acfde9b2e 100644 (file)
--- a/src/mon/ConfigMonitor.cc
+++ b/src/mon/ConfigMonitor.cc
@@ -648,9 +648,8 @@ void ConfigMonitor::send_config(MonSession *s)
 
 void ConfigMonitor::check_sub(MonSession *s)
 {
-  if (!s->is_capable(s->entity_name.get_type_str(), MON_CAP_R)) {
-    dout(20) << __func__ << " not capable for " << s->entity_name << " with "
-            << s->caps << dendl;
+  if (!s->authenticated) {
+    dout(20) << __func__ << " not authenticated " << s->entity_name << dendl;
     return;
   }
   auto p = s->sub_map.find("config");

diff --git a/src/mon/Monitor.cc b/src/mon/Monitor.cc
index 0237d3f7626c52f3c2f99259842c2a1177f03cca..48cfed21ffbdfeaa5f5c335d5145dfffdffecc32 100644 (file)
--- a/src/mon/Monitor.cc
+++ b/src/mon/Monitor.cc
@@ -4065,6 +4065,11 @@ void Monitor::dispatch_op(MonOpRequestRef op)
 
     case CEPH_MSG_MON_METADATA:
       return handle_mon_metadata(op);
+
+    case CEPH_MSG_MON_SUBSCRIBE:
+      /* FIXME: check what's being subscribed, filter accordingly */
+      handle_subscribe(op);
+      return;
   }
 
   /* well, maybe the op belongs to a service... */
@@ -4135,11 +4140,6 @@ void Monitor::dispatch_op(MonOpRequestRef op)
     case CEPH_MSG_MON_GET_VERSION:
       handle_get_version(op);
       return;
-
-    case CEPH_MSG_MON_SUBSCRIBE:
-      /* FIXME: check what's being subscribed, filter accordingly */
-      handle_subscribe(op);
-      return;
   }
 
   if (!op->is_src_mon()) {
@@ -4720,6 +4720,15 @@ void Monitor::handle_subscribe(MonOpRequestRef op)
   for (map<string,ceph_mon_subscribe_item>::iterator p = m->what.begin();
        p != m->what.end();
        ++p) {
+    if (p->first == "monmap" || p->first == "config") {
+      // these require no caps
+    } else if (!s->is_capable("mon", MON_CAP_R)) {
+      dout(5) << __func__ << " " << op->get_req()->get_source_inst()
+             << " not enough caps for " << *(op->get_req()) << " -- dropping"
+             << dendl;
+      continue;
+    }
+
     // if there are any non-onetime subscriptions, we need to reply to start the resubscribe timer
     if ((p->second.flags & CEPH_SUBSCRIBE_ONETIME) == 0)
       reply = true;