rgw: svc.config_key_rados: get() warns if potentially insecure connection

Fixes: https://tracker.ceph.com/issues/44460
Modified the interface to specify whether key should be fetched over secure connection.
If so, if connection is potentially insecure it sends cluster-wide message to warn
about it.

Signed-off-by: Yehuda Sadeh <yehuda@redhat.com>

diff --git a/src/rgw/rgw_asio_frontend.cc b/src/rgw/rgw_asio_frontend.cc
index 4fca9aece663757e6c91faf4bd385fc4eee164eb..2b654f5019208d4034cd720d5c7233cc432f9a33 100644 (file)
--- a/src/rgw/rgw_asio_frontend.cc
+++ b/src/rgw/rgw_asio_frontend.cc
@@ -603,7 +603,7 @@ int AsioFrontend::get_config_key_val(string name,
   }
 
   auto svc = env.store->svc()->config_key;
-  int r = svc->get(name, pbl);
+  int r = svc->get(name, true, pbl);
   if (r < 0) {
     lderr(ctx()) << type << " was not found: " << name << dendl;
     return r;

diff --git a/src/rgw/rgw_service.cc b/src/rgw/rgw_service.cc
index 4af8b96c2e77816138739cae6b6fcd1d67f20487..b86290fbb0341334f47033f6b6f9fe8216133a07 100644 (file)
--- a/src/rgw/rgw_service.cc
+++ b/src/rgw/rgw_service.cc
@@ -160,6 +160,12 @@ int RGWServices_Def::init(CephContext *cct,
     return r;
   }
 
+  r = config_key_rados->start();
+  if (r < 0) {
+    ldout(cct, 0) << "ERROR: failed to start config_key service (" << cpp_strerror(-r) << dendl;
+    return r;
+  }
+
   r = zone_utils->start();
   if (r < 0) {
     ldout(cct, 0) << "ERROR: failed to start zone_utils service (" << cpp_strerror(-r) << dendl;

diff --git a/src/rgw/services/svc_config_key.h b/src/rgw/services/svc_config_key.h
index 5331a731c4da5d891f6dc6d425d30192a764182d..e008aea5ff43ce449f5c01873ca7718bdc6cfb52 100644 (file)
--- a/src/rgw/services/svc_config_key.h
+++ b/src/rgw/services/svc_config_key.h
@@ -26,6 +26,6 @@ public:
   RGWSI_ConfigKey(CephContext *cct) : RGWServiceInstance(cct) {}
   virtual ~RGWSI_ConfigKey() {}
 
-  virtual int get(const string& key, bufferlist *result) = 0;
+  virtual int get(const string& key, bool secure, bufferlist *result) = 0;
 };
 

diff --git a/src/rgw/services/svc_config_key_rados.cc b/src/rgw/services/svc_config_key_rados.cc
index 7370fde3c912a6bb986d3b8d43491fb46a40199f..96997123902e3c40bddb9f3954c1743462f74ec5 100644 (file)
--- a/src/rgw/services/svc_config_key_rados.cc
+++ b/src/rgw/services/svc_config_key_rados.cc
@@ -2,7 +2,28 @@
 #include "svc_rados.h"
 #include "svc_config_key_rados.h"
 
-int RGWSI_ConfigKey_RADOS::get(const string& key, bufferlist *result)
+int RGWSI_ConfigKey_RADOS::do_start()
+{
+  maybe_insecure_mon_conn = !svc.rados->check_secure_mon_conn();
+
+  return 0;
+}
+
+void RGWSI_ConfigKey_RADOS::warn_if_insecure()
+{
+  if (!maybe_insecure_mon_conn ||
+      warned_insecure.test_and_set()) {
+    return;
+  }
+
+  string s = "rgw is configured to optionally allow insecure connections to the monitors (auth_supported, ms_mon_client_mode), ssl certificates stored at the monitor configuration could leak";
+
+  svc.rados->clog_warn(s);
+
+  lderr(ctx()) << __func__ << "(): WARNING: " << s << dendl;
+}
+
+int RGWSI_ConfigKey_RADOS::get(const string& key, bool secure, bufferlist *result)
 {
   string cmd =
     "{"
@@ -12,5 +33,14 @@ int RGWSI_ConfigKey_RADOS::get(const string& key, bufferlist *result)
 
   bufferlist inbl;
   auto handle = svc.rados->handle();
-  return handle.mon_command(cmd, inbl, result, nullptr);
+  int ret = handle.mon_command(cmd, inbl, result, nullptr);
+  if (ret < 0) {
+    return ret;
+  }
+
+  if (secure) {
+    warn_if_insecure();
+  }
+
+  return 0;
 }

diff --git a/src/rgw/services/svc_config_key_rados.h b/src/rgw/services/svc_config_key_rados.h
index ccdfb837d8c27f46f277249d70dcb0aea20ce50d..25fe4335f44a6d8b279b1d6b1504203649785aa9 100644 (file)
--- a/src/rgw/services/svc_config_key_rados.h
+++ b/src/rgw/services/svc_config_key_rados.h
@@ -18,6 +18,8 @@
 
 #pragma once
 
+#include <atomic>
+
 #include "rgw/rgw_service.h"
 
 #include "svc_config_key.h"
@@ -26,6 +28,13 @@ class RGWSI_RADOS;
 
 class RGWSI_ConfigKey_RADOS : public RGWSI_ConfigKey
 {
+  bool maybe_insecure_mon_conn{false};
+  std::atomic_flag warned_insecure{ATOMIC_FLAG_INIT};
+
+  int do_start() override;
+
+  void warn_if_insecure();
+
 public:
   struct Svc {
     RGWSI_RADOS *rados{nullptr};
@@ -37,7 +46,7 @@ public:
 
   RGWSI_ConfigKey_RADOS(CephContext *cct) : RGWSI_ConfigKey(cct) {}
 
-  int get(const string& key, bufferlist *result) override;
+  int get(const string& key, bool secure, bufferlist *result) override;
 };
 
 

diff --git a/src/rgw/services/svc_rados.cc b/src/rgw/services/svc_rados.cc
index 35d7c523e5d6fae7b4602439066452d3a25d6633..b0e8e02c9149fc49af7ff0dc03bc7b760291deec 100644 (file)
--- a/src/rgw/services/svc_rados.cc
+++ b/src/rgw/services/svc_rados.cc
@@ -9,6 +9,8 @@
 #include "rgw/rgw_tools.h"
 #include "rgw/rgw_cr_rados.h"
 
+#include "auth/AuthRegistry.h"
+
 #define dout_subsys ceph_subsys_rgw
 
 RGWSI_RADOS::RGWSI_RADOS(CephContext *cct) : RGWServiceInstance(cct)
@@ -383,3 +385,32 @@ int RGWSI_RADOS::clog_warn(const string& msg)
   return h.mon_command(cmd, inbl, nullptr, nullptr);
 }
 
+bool RGWSI_RADOS::check_secure_mon_conn() const
+{
+  AuthRegistry reg(cct);
+
+  reg.refresh_config();
+
+  std::vector<uint32_t> methods;
+  std::vector<uint32_t> modes;
+
+  reg.get_supported_methods(CEPH_ENTITY_TYPE_MON, &methods, &modes);
+  ldout(cct, 20) << __func__ << "(): auth registy supported: methods=" << methods << " modes=" << modes << dendl;
+
+  for (auto method : methods) {
+    if (!reg.is_secure_method(method)) {
+      ldout(cct, 20) << __func__ << "(): method " << method << " is insecure" << dendl;
+      return false;
+    }
+  }
+
+  for (auto mode : modes) {
+    if (!reg.is_secure_mode(mode)) {
+      ldout(cct, 20) << __func__ << "(): mode " << mode << " is insecure" << dendl;
+      return false;
+    }
+  }
+
+  return true;
+}
+

diff --git a/src/rgw/services/svc_rados.h b/src/rgw/services/svc_rados.h
index 124c667abd50b10161f2dccd31ede21750b0b8b0..721a4bbe258180011695138b00c977a02437935b 100644 (file)
--- a/src/rgw/services/svc_rados.h
+++ b/src/rgw/services/svc_rados.h
@@ -68,6 +68,7 @@ public:
   void shutdown() override;
 
   uint64_t instance_id();
+  bool check_secure_mon_conn() const;
 
   RGWAsyncRadosProcessor *get_async_processor() {
     return async_processor.get();