From 4131535fa7f7fac1b5d9c31ce7c6c088f4a68855 Mon Sep 17 00:00:00 2001 From: Pritha Srivastava Date: Wed, 20 Nov 2019 13:45:13 +0530 Subject: [PATCH] rgw: adding mfa code validation when bucket versioning status is changed. When the user changes bucket versioning status from Enabled->Suspended and vice versa, MFA code needs to be validated, if MFA has been enabled for the bucket. Fixes tracker issue #42911 Signed-off-by: Pritha Srivastava (cherry picked from commit db89c4af159301710e1cc32dbd6298c1ec24b006) --- src/rgw/rgw_op.cc | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/rgw/rgw_op.cc b/src/rgw/rgw_op.cc index 9c3c581a419cc..0005c9ee30dbf 100644 --- a/src/rgw/rgw_op.cc +++ b/src/rgw/rgw_op.cc @@ -2451,6 +2451,20 @@ void RGWSetBucketVersioning::execute() op_ret = -ERR_MFA_REQUIRED; return; } + //if mfa is enabled for bucket, make sure mfa code is validated in case versioned status gets changed + if (cur_mfa_status) { + bool req_versioning_status = false; + //if requested versioning status is not the same as the one set for the bucket, return error + if (versioning_status == VersioningEnabled) { + req_versioning_status = (s->bucket_info.flags & BUCKET_VERSIONS_SUSPENDED) != 0; + } else if (versioning_status == VersioningSuspended) { + req_versioning_status = (s->bucket_info.flags & BUCKET_VERSIONS_SUSPENDED) == 0; + } + if (req_versioning_status && !s->mfa_verified) { + op_ret = -ERR_MFA_REQUIRED; + return; + } + } if (!store->svc.zone->is_meta_master()) { op_ret = forward_request_to_master(s, NULL, store, in_data, nullptr); -- 2.39.5