From 24b7def2a338818e4c591a7a2c79457d5a464f86 Mon Sep 17 00:00:00 2001 From: Patrick Donnelly Date: Tue, 30 Apr 2024 21:41:14 -0400 Subject: [PATCH] mds: check relevant caps for fs include root_squash When denying client reconnects because the MDS caps include root_squash and the client features do not include CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK, ensure those caps are only for the file system the MDS is joined to. Fixes: https://tracker.ceph.com/issues/65733 Signed-off-by: Patrick Donnelly (cherry picked from commit f79ae86f2c23388f6ecc3177764735e071998e09) --- src/mds/MDSAuthCaps.h | 10 ++++++---- src/mds/Server.cc | 9 ++++++--- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/src/mds/MDSAuthCaps.h b/src/mds/MDSAuthCaps.h index 9172e266aab..0be4f5ec13c 100644 --- a/src/mds/MDSAuthCaps.h +++ b/src/mds/MDSAuthCaps.h @@ -302,10 +302,12 @@ public: } } - bool root_squash_in_caps() const { - for (const MDSCapGrant &g : grants) { - if (g.match.root_squash) { - return true; + bool root_squash_in_caps(std::string_view fs_name) const { + for (const MDSCapGrant& g : grants) { + if (g.match.match_fs(fs_name)) { + if (g.match.root_squash) { + return true; + } } } return false; diff --git a/src/mds/Server.cc b/src/mds/Server.cc index 0bb30664ac5..245aad8dcb0 100644 --- a/src/mds/Server.cc +++ b/src/mds/Server.cc @@ -717,7 +717,9 @@ void Server::handle_client_session(const cref_t &m) break; } - if (session->auth_caps.root_squash_in_caps() && !client_metadata.features.test(CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK)) { + std::string_view fs_name = mds->mdsmap->get_fs_name(); + bool client_caps_check = client_metadata.features.test(CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK); + if (session->auth_caps.root_squash_in_caps(fs_name) && !client_caps_check) { CachedStackStringStream css; *css << "client lacks CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK needed to enforce 'root_squash' MDS auth caps"; send_reject_message(css->strv()); @@ -1573,8 +1575,9 @@ void Server::handle_client_reconnect(const cref_t &m) *css << "missing required features '" << missing_features << "'"; error_str = css->strv(); } - if (session->auth_caps.root_squash_in_caps() && - !session->info.client_metadata.features.test(CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK)) { + std::string_view fs_name = mds->mdsmap->get_fs_name(); + bool client_caps_check = session->info.client_metadata.features.test(CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK); + if (session->auth_caps.root_squash_in_caps(fs_name) && !client_caps_check) { CachedStackStringStream css; *css << "client lacks CEPHFS_FEATURE_MDS_AUTH_CAPS_CHECK needed to enforce 'root_squash' MDS auth caps"; error_str = css->strv(); -- 2.39.5