From: Christopher Hoffman <choffman@redhat.com>
Date: Wed, 20 Aug 2025 19:36:14 +0000 (+0000)
Subject: mgr/volumes: Enforce enctag max size
X-Git-Url: http://git.apps.os.sepia.ceph.com/?a=commitdiff_plain;h=70944fda0008441018c2d7ac9a5d8b113abc4bbb;p=ceph.git

mgr/volumes: Enforce enctag max size

Introduce enctag max length. Include error messages when
outside of range.

Signed-off-by: Christopher Hoffman <choffman@redhat.com>
---

diff --git a/src/pybind/mgr/volumes/fs/operations/versions/subvolume_base.py b/src/pybind/mgr/volumes/fs/operations/versions/subvolume_base.py
index eee849e7ed1d1..5ceb9bcc2bc3c 100644
--- a/src/pybind/mgr/volumes/fs/operations/versions/subvolume_base.py
+++ b/src/pybind/mgr/volumes/fs/operations/versions/subvolume_base.py
@@ -346,7 +346,12 @@ class SubvolumeBase(object):
         enctag = attrs.get("enctag", None)
         if enctag is not None:
             fs_enctag = CephFSVolumeEncryptionTag(self.fs, path)
-            fs_enctag.set_tag(enctag)
+            try:
+                fs_enctag.set_tag(enctag)
+            except EncryptionTagException:
+                raise VolumeException(-errno.EINVAL,
+                                      "invalid enctag specified: length '{0} > {1}'".format(len(enctag), fs_enctag.ENCTAG_MAX))
+
 
         fscrypt_auth = attrs.get("fscrypt_auth")
         if fscrypt_auth is not None:
diff --git a/src/python-common/ceph/fs/enctag.py b/src/python-common/ceph/fs/enctag.py
index 14bdbac656013..a3633dbed43ac 100644
--- a/src/python-common/ceph/fs/enctag.py
+++ b/src/python-common/ceph/fs/enctag.py
@@ -36,19 +36,21 @@ class EncryptionTagException(Exception):
 
 
 class CephFSVolumeEncryptionTag:
+    ENCTAG_MAX = 255
+
     def __init__(self, fs, path: str) -> None:
         self.fs = fs
         self.path = path
 
     def _handle_cephfs_error(self, e: Exception, action: str) -> None:
         if isinstance(e, ValueError):
-            raise EncryptionTagException(errno.EINVAL, f"Invalid encryption tag specified: {e}") from e
+            raise EncryptionTagException(-errno.EINVAL, f"Invalid encryption tag specified: {e}") from e
         elif isinstance(e, OSError):
             log.error(f"Error {action} encryption tag: {e}")
             raise EncryptionTagException(-e.errno, e.strerror) from e
         else:
             log.error(f"Unexpected error {action} encryption tag: {e}")
-            raise EncryptionTagException(errno.EIO, "Unexpected error") from e
+            raise EncryptionTagException(-errno.EIO, "Unexpected error") from e
 
     def get_tag(self) -> Optional[str]:
         try:
@@ -63,6 +65,9 @@ class CephFSVolumeEncryptionTag:
 
     def set_tag(self, enc_tag: str):
         try:
+            if len(enc_tag) > self.ENCTAG_MAX:
+                raise ValueError(f"length '{len(enc_tag)} > {self.ENCTAG_MAX}'")
+
             self.fs.setxattr(self.path, XATTR_SUBVOLUME_ENCTAG_NAME, enc_tag.encode('utf-8'), 0)
             log.info(f"Encryption Tag '{enc_tag}' set on {self.path}.")
         except Exception as e: