From 30ee6eb6d3bcb341d32e374d7490b75a15f4cdb6 Mon Sep 17 00:00:00 2001
From: Josh Durgin <jdurgin@redhat.com>
Date: Thu, 3 Sep 2020 04:24:02 +0000
Subject: [PATCH] mon/AuthMonitor: add option to skip non-mon cap parsing

The monitor is not always the same version as the daemons, so it may
not always treat the caps the same. This parsing is also quite cpu
intensive, and is just a usability feature here - it's checked again
on the relevant daemon when the entity connects. Thus, provide an
option to disable this parsing. Leave it on by default for better
usability.

Signed-off-by: Josh Durgin <jdurgin@redhat.com>
---
 src/common/options.cc  | 8 ++++++++
 src/mon/AuthMonitor.cc | 9 ++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/common/options.cc b/src/common/options.cc
index 919241515b9f..8fc58752b519 100644
--- a/src/common/options.cc
+++ b/src/common/options.cc
@@ -2150,6 +2150,14 @@ std::vector<Option> get_global_options() {
     .add_service("mon")
     .set_description("Timeout (in seconds) for smarctl to run, default is set to 5"),
 
+    Option("mon_auth_validate_all_caps", Option::TYPE_BOOL, Option::LEVEL_ADVANCED)
+    .set_default(true)
+    .add_service("mon")
+    .set_description("Whether to parse non-monitor capabilities set by the "
+		     "'ceph auth ...' commands. Disabling this saves CPU on the "
+		     "monitor, but allows invalid capabilities to be set, and "
+		     "only be rejected later, when they are used.")
+    .set_flag(Option::FLAG_RUNTIME),
 
     // PAXOS
 
diff --git a/src/mon/AuthMonitor.cc b/src/mon/AuthMonitor.cc
index 508aebc46e80..d6b5fe65233b 100644
--- a/src/mon/AuthMonitor.cc
+++ b/src/mon/AuthMonitor.cc
@@ -1276,7 +1276,14 @@ bool AuthMonitor::valid_caps(
     if (!moncap.parse(caps, out)) {
       return false;
     }
-  } else if (type == "mgr") {
+    return true;
+  }
+
+  if (!g_conf().get_val<bool>("mon_auth_validate_all_caps")) {
+    return true;
+  }
+
+  if (type == "mgr") {
     MgrCap mgrcap;
     if (!mgrcap.parse(caps, out)) {
       return false;
-- 
2.47.3