Skip to content

rbd-nbd: generate and send device cookie with netlink connect request#41323

Merged
trociny merged 8 commits intoceph:masterfrom
pkalever:cookie
Oct 27, 2021
Merged

rbd-nbd: generate and send device cookie with netlink connect request#41323
trociny merged 8 commits intoceph:masterfrom
pkalever:cookie

Conversation

@pkalever
Copy link

@pkalever pkalever commented May 13, 2021

Fixes: https://tracker.ceph.com/issues/53046

Based on the discussion at #40809, this PR adds below options for rbd-nbd cookie generation and management

  • generate and send device cookie with netlink connect request
[root@linux-vm1]# rbd-nbd map rbd-pool/image0 --try-netlink
/dev/nbd0

[root@linux-vm1]# cat /sys/block/nbd0/backend
c704cb91-c6cf-466e-a335-0e935c0d5e47
  • provide a flag to show device cookie with map command
[root@linux-vm1]# rbd-nbd map rbd-pool/image0 --try-netlink --show-cookie
/dev/nbd0 c704cb91-c6cf-466e-a335-0e935c0d5e47
  • mandate device cookie for attach command
[root@linux-vm1]# rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie c704cb91-c6cf-466e-a335-0e935c0d5e47
/dev/nbd0
  • show per device cookie with list command
[root@linux-vm1]# rbd-nbd list-mapped
id    pool      namespace  image   snap  device     cookie
8133  rbd-pool             image0  -     /dev/nbd0  c704cb91-c6cf-466e-a335-0e935c0d5e47
  • allow attach without --cookie for old kernel versions
[root@linux-vm1]# rbd-nbd attach rbd-pool/image0 --device /dev/nbd0
/dev/nbd0
  • rbd: add --show-cookie/--cookie option for map/attach commands
$ rbd device map rbd-pool/image --show-cookie --try-netlink --device-type nbd

$ rbd device attach rbd-pool/image --device /dev/nbd0 \
      --cookie 6f85d970-10b2-456b-8baf-676aa4d782e4 --device-type nbd

older Kernel versions can use --force to skip the cookie validation
  • rbd-nbd: allow user to specify cookie at map
$ rbd device attach rbd-pool/image --device /dev/nbd0 --cookie 6f85d970-10b2-456b-8baf-676aa4d782e4 --options try-netlink

Needs: https://lkml.org/lkml/2021/4/29/274 (Applied now and should be part of kernel release 5.14)
Credits: To @idryomov and @trociny for all the discussions around this topic.
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>

Copy link
Contributor

@trociny trociny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it is important to provide some reasonable behavior for the case when the kernel does not support cookie, because I expect we will have a long period when this will be a common situation.

I suppose we can't just forbid attach for this case, because users may have already been using it. Also there may be a third party software that has already been using it and will break after rbd-nbd upgrade.

Making --cookie optional would resolve this or may be it will just delay the issue if we want to make it mandatory eventually. I have no a good idea about the solution. Any thoughts?

And I am not sure I like --all option for the list command. I was thinking we would just make list always print it. Actually I don't have a strong opinion. I see some advantages in printing it only with --all, e.g. we will still have the same list format by default for all device types. But if we want the --all option, we will also need to add it rbd device list.

Also I think you will need to update qa/workunits/rbd/rbd-nbd.sh and make sure it will work for both new and old kernels.

@pkalever
Copy link
Author

I think it is important to provide some reasonable behavior for the case when the kernel does not support cookie, because I expect we will have a long period when this will be a common situation.

With Kernel Changes:

[root@linux-vm1 build]# uname -a
Linux linux-vm1 5.12.0+ #7 SMP Wed Apr 28 12:36:15 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[root@linux-vm1 build]# ./bin/rbd-nbd map rbd-pool/image0 --try-netlink --show-cookie
/dev/nbd0 38f1d4ae-797e-49ce-acc5-e296279bb190

[root@linux-vm1 build]# cat /sys/block/nbd0/backend
38f1d4ae-797e-49ce-acc5-e296279bb190

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie                              
8232  rbd-pool             image0  -     /dev/nbd0  38f1d4ae-797e-49ce-acc5-e296279bb190

[root@linux-vm1 build]# pkill -9 rbd-nbd

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie 38f1d4ae-797e-49ce-acc5-e296279bb190
/dev/nbd0

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie                              
8347  rbd-pool             image0  -     /dev/nbd0  38f1d4ae-797e-49ce-acc5-e296279bb190

[root@linux-vm1 build]# ps -aux | grep rbd
root        8347  0.7  0.8 1565804 98300 pts/1   Sl   06:01   0:00 ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie 38f1d4ae-797e-49ce-acc5-e296279bb190
root        8374  0.0  0.0 221432   772 pts/1    S+   06:01   0:00 grep --color=auto rbd

[root@linux-vm1 build]# cat /sys/block/nbd0/backend
38f1d4ae-797e-49ce-acc5-e296279bb190

Without Kernel Changes:

[root@linux-vm1 build]# uname -a
Linux linux-vm1 5.11.15-200.fc33.x86_64 #1 SMP Fri Apr 16 13:41:20 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[root@linux-vm1 build]# ./bin/rbd-nbd map rbd-pool/image0 --try-netlink --show-cookie   <--  show-cookie is provided, if its not given then it should have behaved like earlier
/dev/nbd0 c3d2db83-8269-4f0e-b3c2-14aa2c4cfac5

[root@linux-vm1 build]# cat /sys/block/nbd0/backend
cat: /sys/block/nbd0/backend: No such file or directory

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all  <-- list will read it again from /sys/block/nbdX/backend and find it absent
id    pool      namespace  image   snap  device     cookie
8028  rbd-pool             image0  -     /dev/nbd0  -     

[root@linux-vm1 build]# pkill -9 rbd-nbd

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0                                         
rbd-nbd: must specify cookie to attach

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie 1e524d06-5e99-48b3-aa4c-00c822aec4d2  <-- Please note the cookie provided here is a fake one as the code doesn't care about this, may be we can give a provision to allow attempting to attach when kernel cookie is absent?
/dev/nbd0

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie
8102  rbd-pool             image0  -     /dev/nbd0  -     

[root@linux-vm1 build]# ps -aux | grep rbd
root        8102  0.2  0.8 1565808 98308 pts/1   Sl   06:08   0:00 ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie 38f1d4ae-797e-49ce-acc5-e296279bb190
root        8133  0.0  0.0 221432   780 pts/1    S+   06:09   0:00 grep --color=auto rbd

[root@linux-vm1 build]# cat /sys/block/nbd0/backend
cat: /sys/block/nbd0/backend: No such file or directory

I suppose we can't just forbid attach for this case, because users may have already been using it. Also there may be a third party software that has already been using it and will break after rbd-nbd upgrade.

Making --cookie optional would resolve this or may be it will just delay the issue if we want to make it mandatory eventually. I have no a good idea about the solution. Any thoughts?

Maybe we can allow attach when the kernel doesn't have cookie support, like check for /sys/block/nbdX/backend if file doesn't exists allow attach without --cookie option?

And I am not sure I like --all option for the list command. I was thinking we would just make list always print it. Actually I don't have a strong opinion. I see some advantages in printing it only with --all, e.g. we will still have the same list format by default for all device types. But if we want the --all option, we will also need to add it rbd device list.

I don't have a strong opinion either, was just implementing it as per our discussion from the previous PR :-)

Also I think you will need to update qa/workunits/rbd/rbd-nbd.sh and make sure it will work for both new and old kernels.

I will check on what needs to be updated in qa/workunits/rbd/rbd-nbd.sh, and yes this patch works for older kernels too as mentioned before.

Thanks for your thoughts @trociny

@pkalever
Copy link
Author

And with the latest V2 patches, the changes respect backward compatibility and works with old and new kernels:

With Kernel Changes:
-------------------

[root@linux-vm1 build]# uname -a
Linux linux-vm1 5.12.0+ #7 SMP Wed Apr 28 12:36:15 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[root@linux-vm1 build]# ./bin/rbd-nbd map rbd-pool/image0 --try-netlink --show-cookie
/dev/nbd0 d76226d0-be26-4b4d-a531-5ad58796a6c8

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie                              
7991  rbd-pool             image0  -     /dev/nbd0  d76226d0-be26-4b4d-a531-5ad58796a6c8

[root@linux-vm1 build]# pkill -9 rbd-nbd

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0
rbd-nbd: must specify cookie to attach

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie d76226d0-be26-4b4d-a531-5ad58796a6c8
/dev/nbd0

[root@linux-vm1 build]# ps -aux | grep rbd
root        8066  0.4  0.7 1565800 97868 pts/1   Sl   08:21   0:00 ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 --cookie d76226d0-be26-4b4d-a531-5ad58796a6c8
root        8092  0.0  0.0 221432   836 pts/1    S+   08:21   0:00 grep --color=auto rbd




Without Kernel Changes:
----------------------

[root@linux-vm1 build]# uname -a
Linux linux-vm1 5.11.15-200.fc33.x86_64 #1 SMP Fri Apr 16 13:41:20 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

[root@linux-vm1 build]# ./bin/rbd-nbd map rbd-pool/image0 --try-netlink
/dev/nbd0

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie
8006  rbd-pool             image0  -     /dev/nbd0  -     

[root@linux-vm1 build]# pkill -9 rbd-nbd

[root@linux-vm1 build]# ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0
/dev/nbd0

[root@linux-vm1 build]# ./bin/rbd-nbd list-mapped --all
id    pool      namespace  image   snap  device     cookie
8080  rbd-pool             image0  -     /dev/nbd0  -     

[root@linux-vm1 build]# ps -aux | grep rbd
root        8080  0.5  0.8 1565696 98656 pts/1   Sl   07:38   0:00 ./bin/rbd-nbd attach rbd-pool/image0 --device /dev/nbd0
root        8107  0.0  0.0 221432   780 pts/1    S+   07:38   0:00 grep --color=auto rbd

@pkalever pkalever requested a review from trociny May 17, 2021 08:55
@lxbsz
Copy link
Member

lxbsz commented May 19, 2021

...

I suppose we can't just forbid attach for this case, because users may have already been using it. Also there may be a third party software that has already been using it and will break after rbd-nbd upgrade.
Making --cookie optional would resolve this or may be it will just delay the issue if we want to make it mandatory eventually. I have no a good idea about the solution. Any thoughts?

Maybe we can allow attach when the kernel doesn't have cookie support, like check for /sys/block/nbdX/backend if file doesn't exists allow attach without --cookie option?

Maybe we should forbid attach as default ? And add one --force option and print some warning at the same time, which means risky, to let user to choose what to do ?

@pkalever
Copy link
Author

Maybe we can allow attach when the kernel doesn't have cookie support, like check for /sys/block/nbdX/backend if file doesn't exists allow attach without --cookie option?

Maybe we should forbid attach as default ? And add one --force option and print some warning at the same time, which means risky, to let user to choose what to do ?

That will break the existing users Xiubo, IMHO which is something that we do not want.

The latest changes here behave as usual when kernel changes are not available, and when kernel changes are available, they demand a cookie at attach.

Thanks!

@lxbsz
Copy link
Member

lxbsz commented May 20, 2021

Hi Prasanna,

As we discussed, maybe we should do:

1, use the <poolX>/<imageX> to generate one uuid or one md5sum number instead of a random uuid.
2, so the rbd-nbd tool could check and compare the new <poolY>/<imageY> with the saved number in /sys/block/nbdX/backend when attaching to verify whether they match. No need to store the random uuid by the userspace apps for each image.

@pkalever
Copy link
Author

Hi Prasanna,

As we discussed, maybe we should do:

1, use the <poolX>/<imageX> to generate one uuid or one md5sum number instead of a random uuid.
2, so the rbd-nbd tool could check and compare the new <poolY>/<imageY> with the saved number in /sys/block/nbdX/backend when attaching to verify whether they match. No need to store the random uuid by the userspace apps for each image.

Hello Xiubo,
I like the idea because it makes users free from maintaining the cookies per image.
But I'm just thinking about how this works in cases like live migration(moving images between pools)?

Example:
$ rbd-nbd map pool1/image1 --try-netlink --reattach-timeout 600
/dev/nbd0
$ pkill -9 rbd-nbd

Move the image to a different pool
$ rbd migration prepare pool1/image1 pool2/image1
$ rbd migration execute pool2/image1
$ rbd migration commit pool2/image1

Now claim the same device, but for the migrated destination (target) image, on the same host node
$ rbd-nbd attach pool2/image1 --device /dev/nbd0

In this case, one needs to supply the source image_spec's(pool1/image1) md5sum cookie manually.

Now, the question is, do we want to give two ways?

  1. rbd-nbd generate the cookie (md5sum) of image_spec internally and try to attach without the user providing --cookie
  2. If the internally generated cookie doesn't match at kernel (/sys/block/nbdX/backend), the attach will bailout and the user should give the --cookie manually.

Thinking about automation scripts, they still have to save the cookie and keep it ready at least to address this special case.

Maybe @idryomov @trociny might add more thoughts here?

Thanks!

@trociny
Copy link
Contributor

trociny commented May 20, 2021

Hi Prasanna,
As we discussed, maybe we should do:
1, use the <poolX>/<imageX> to generate one uuid or one md5sum number instead of a random uuid.
2, so the rbd-nbd tool could check and compare the new <poolY>/<imageY> with the saved number in /sys/block/nbdX/backend when attaching to verify whether they match. No need to store the random uuid by the userspace apps for each image.

Hello Xiubo,
I like the idea because it makes users free from maintaining the cookies per image.
But I'm just thinking about how this works in cases like live migration(moving images between pools)?

Yes it will not work for migration. That is why we need something different than image spec for the identifier.

Example:
$ rbd-nbd map pool1/image1 --try-netlink --reattach-timeout 600
/dev/nbd0
$ pkill -9 rbd-nbd

Don't use -9 for detaching. Give the rbd-nbd a chance to flush pending io before termination. Use the default TERM signal or bette rbd-nbd detach.

Move the image to a different pool
$ rbd migration prepare pool1/image1 pool2/image1

Actually you may/should attach after this step. This is the main reason why we have migration in several steps -- to make the downtime small.

$ rbd migration execute pool2/image1
$ rbd migration commit pool2/image1

Now claim the same device, but for the migrated destination (target) image, on the same host node
$ rbd-nbd attach pool2/image1 --device /dev/nbd0

In this case, one needs to supply the source image_spec's(pool1/image1) md5sum cookie manually.

Now, the question is, do we want to give two ways?

  1. rbd-nbd generate the cookie (md5sum) of image_spec internally and try to attach without the user providing --cookie
  2. If the internally generated cookie doesn't match at kernel (/sys/block/nbdX/backend), the attach will bailout and the user should give the --cookie manually.

I don't think it is necessary, as it does not improve it radically, but I would not object.

@pkalever
Copy link
Author

Move the image to a different pool
$ rbd migration prepare pool1/image1 pool2/image1

Actually you may/should attach after this step. This is the main reason why we have migration in several steps -- to make the downtime small.

Cool, make sense, I didn't know this part. Thanks!

@lxbsz
Copy link
Member

lxbsz commented May 20, 2021

Hi Prasanna,
As we discussed, maybe we should do:
1, use the <poolX>/<imageX> to generate one uuid or one md5sum number instead of a random uuid.
2, so the rbd-nbd tool could check and compare the new <poolY>/<imageY> with the saved number in /sys/block/nbdX/backend when attaching to verify whether they match. No need to store the random uuid by the userspace apps for each image.

Hello Xiubo,
I like the idea because it makes users free from maintaining the cookies per image.
But I'm just thinking about how this works in cases like live migration(moving images between pools)?

Yes it will not work for migration. That is why we need something different than image spec for the identifier.

Okay, I didn't notice the migration case.

Copy link
Contributor

@trociny trociny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a note for discussion. We could allow to specify --cookie on map command, so a user could set it to any value she likes. Not sure we need this functionality, it might be useful for some cases, but seems to introduce yet another chance to shoot in the foot.

@pkalever
Copy link
Author

Just a note for discussion. We could allow to specify --cookie on map command, so a user could set it to any value she likes. Not sure we need this functionality, it might be useful for some cases, but seems to introduce yet another chance to shoot in the foot.

I agree it is useful for some cases, I'm happy to provide the changes. But I will wait to hear @idryomov thoughts on this before making the changes.

Thanks @trociny for the review.

@pkalever
Copy link
Author

Hello @idryomov @trociny

The kernel patch adding a way to identify device backends is applied and should be part of kernel version 5.14
I have respin this series by addressing previous review comments from @trociny also rebased this on the current master branch. Please take a look.

I'm yet to work on enabling users to specify --cookie on map command, this is something I'm waiting on @idryomov to decide.

Many Thanks!

@pkalever
Copy link
Author

@idryomov @trociny Just in case if this got lost, here is an attempt to remind you about the review, please help.

Thanks!

Copy link
Contributor

@trociny trociny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Otherwise LGTM

Copy link
Author

@pkalever pkalever left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @trociny, Had addressed the review comments, PTAL.

@pkalever pkalever requested a review from trociny July 1, 2021 06:40
Copy link
Contributor

@trociny trociny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

BTW, what it is the status of the kernel patch? Just wondering if there a way to try it already without building a custom kernel...

@trociny trociny requested a review from idryomov July 6, 2021 13:31
Copy link
Contributor

@idryomov idryomov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! (pending rbd-nbd.sh fixup)

@pkalever
Copy link
Author

@idryomov please help move this to the finish-line. Thanks!

@trociny
Copy link
Contributor

trociny commented Oct 26, 2021

@pkalever Do you want this to be backported to the pacific?

If you do, then I suggest to open a tracker ticket, link this PR there, and set the backport field to "pacific", so it will create the backport ticket automatically after after this is merged.

@trociny
Copy link
Contributor

trociny commented Oct 26, 2021

And by some reason the "Pull Request Needs Rebase?" check failed. May be it indeed nees rebase?

Prasanna Kumar Kalever added 8 commits October 26, 2021 19:24
[root@linux-vm1]# rbd-nbd map rbd-pool/image0 --try-netlink
/dev/nbd0

[root@linux-vm1]# cat /sys/block/nbd0/backend
c704cb91-c6cf-466e-a335-0e935c0d5e47

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
[root@linux-vm1]# rbd-nbd map rbd-pool/image0 --try-netlink --show-cookie
/dev/nbd0 c704cb91-c6cf-466e-a335-0e935c0d5e47

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
[root@linux-vm1]# rbd-nbd attach rbd-pool/image0 --device /dev/nbd0 \
                          --cookie c704cb91-c6cf-466e-a335-0e935c0d5e47
/dev/nbd0

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
[root@linux-vm1]# rbd-nbd list-mapped
id    pool      namespace  image   snap  device     cookie
8133  rbd-pool             image0  -     /dev/nbd0  c704cb91-c6cf-466e-a335-0e935c0d5e47

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
For backward compatibility allow attach without --cookie option:

[root@linux-vm1]# rbd-nbd attach rbd-pool/image0 --device /dev/nbd0
/dev/nbd0

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Example:
$ rbd device map rbd-pool/image --show-cookie --try-netlink --device-type nbd

$ rbd device attach rbd-pool/image --device /dev/nbd0 \
      --cookie 6f85d970-10b2-456b-8baf-676aa4d782e4 --device-type nbd

older Kernel versions can use --force to skip the cookie validation

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Allow user to specify cookie of choice at the time of map

$ rbd device attach rbd-pool/image --device /dev/nbd0 \
	--cookie 6f85d970-10b2-456b-8baf-676aa4d782e4 --options try-netlink

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
@pkalever
Copy link
Author

@pkalever Do you want this to be backported to the pacific?

If you do, then I suggest to open a tracker ticket, link this PR there, and set the backport field to "pacific", so it will create the backport ticket automatically after after this is merged.

While I was navigating to another tab, the issue request got submitted without PR link. Please help adjust the fields as needed, here is the tracker link: https://tracker.ceph.com/issues/53046#note-1

And by some reason the "Pull Request Needs Rebase?" check failed. May be it indeed nees rebase?

I have rebased this to latest master now.

Thanks @trociny

@trociny
Copy link
Contributor

trociny commented Oct 27, 2021

jenkins test make check

@trociny
Copy link
Contributor

trociny commented Oct 27, 2021

jenkins test api

@trociny trociny merged commit 1372383 into ceph:master Oct 27, 2021
pkalever pushed a commit to pkalever/ceph-csi that referenced this pull request Oct 28, 2021
Problem:
On remap/attach of device (i.e. nodeplugin restart), there is no way
for rbd-nbd to defend if the backend storage is matching with the initial
backend storage.

Say, if an initial map request for backend "pool1/image1" got mapped to
/dev/nbd0 and the userspace process is terminated (on nodeplugin restart).
A next remap/attach (nodeplugin start) request within reattach-timeout is
allowed to use /dev/nbd0 for a different backend "pool1/image2"

For example, an operation like below could be dangerous:

$ sudo rbd-nbd map --try-netlink rbd-pool/ext4-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="bfc444b4-64b1-418f-8b36-6e0d170cfc04" TYPE="ext4"
$ sudo pkill -15 rbd-nbd   <-- nodeplugin terminate
$ sudo rbd-nbd attach --try-netlink --device /dev/nbd0 rbd-pool/xfs-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="d29bf343-6570-4069-a9ea-2fa156ced908" TYPE="xfs"

Solution:
rbd-nbd/kernel now provides a way to keep some metadata in sysfs to identify
between the device and the backend, so that when a remap/attach request is
made, rbd-nbd can compare and avoid such dangerous operations.

With the provided solution, as part of the initial map request, backend
cookie (ceph-csi VOLID) can be stored in the sysfs per device config, so
that on a remap/attach request rbd-nbd will check and validate if the
backend per device cookie matches with the initial map backend with the help
of cookie.

At Ceph-csi we use VOLID as device cookie, which will be unique, we pass
the VOLID as cookie at map and use the same at the time of attach, that
way rbd-nbd can identify backends and their matching devices.

Requires:
ceph/ceph#41323
https://lkml.org/lkml/2021/4/29/274

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
pkalever pushed a commit to pkalever/ceph-csi that referenced this pull request Nov 2, 2021
Problem:
On remap/attach of device (i.e. nodeplugin restart), there is no way
for rbd-nbd to defend if the backend storage is matching with the initial
backend storage.

Say, if an initial map request for backend "pool1/image1" got mapped to
/dev/nbd0 and the userspace process is terminated (on nodeplugin restart).
A next remap/attach (nodeplugin start) request within reattach-timeout is
allowed to use /dev/nbd0 for a different backend "pool1/image2"

For example, an operation like below could be dangerous:

$ sudo rbd-nbd map --try-netlink rbd-pool/ext4-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="bfc444b4-64b1-418f-8b36-6e0d170cfc04" TYPE="ext4"
$ sudo pkill -15 rbd-nbd   <-- nodeplugin terminate
$ sudo rbd-nbd attach --try-netlink --device /dev/nbd0 rbd-pool/xfs-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="d29bf343-6570-4069-a9ea-2fa156ced908" TYPE="xfs"

Solution:
rbd-nbd/kernel now provides a way to keep some metadata in sysfs to identify
between the device and the backend, so that when a remap/attach request is
made, rbd-nbd can compare and avoid such dangerous operations.

With the provided solution, as part of the initial map request, backend
cookie (ceph-csi VOLID) can be stored in the sysfs per device config, so
that on a remap/attach request rbd-nbd will check and validate if the
backend per device cookie matches with the initial map backend with the help
of cookie.

At Ceph-csi we use VOLID as device cookie, which will be unique, we pass
the VOLID as cookie at map and use the same at the time of attach, that
way rbd-nbd can identify backends and their matching devices.

Requires:
ceph/ceph#41323
https://lkml.org/lkml/2021/4/29/274

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
pkalever pushed a commit to pkalever/ceph-csi that referenced this pull request Nov 3, 2021
Problem:
On remap/attach of device (i.e. nodeplugin restart), there is no way
for rbd-nbd to defend if the backend storage is matching with the initial
backend storage.

Say, if an initial map request for backend "pool1/image1" got mapped to
/dev/nbd0 and the userspace process is terminated (on nodeplugin restart).
A next remap/attach (nodeplugin start) request within reattach-timeout is
allowed to use /dev/nbd0 for a different backend "pool1/image2"

For example, an operation like below could be dangerous:

$ sudo rbd-nbd map --try-netlink rbd-pool/ext4-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="bfc444b4-64b1-418f-8b36-6e0d170cfc04" TYPE="ext4"
$ sudo pkill -15 rbd-nbd   <-- nodeplugin terminate
$ sudo rbd-nbd attach --try-netlink --device /dev/nbd0 rbd-pool/xfs-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="d29bf343-6570-4069-a9ea-2fa156ced908" TYPE="xfs"

Solution:
rbd-nbd/kernel now provides a way to keep some metadata in sysfs to identify
between the device and the backend, so that when a remap/attach request is
made, rbd-nbd can compare and avoid such dangerous operations.

With the provided solution, as part of the initial map request, backend
cookie (ceph-csi VOLID) can be stored in the sysfs per device config, so
that on a remap/attach request rbd-nbd will check and validate if the
backend per device cookie matches with the initial map backend with the help
of cookie.

At Ceph-csi we use VOLID as device cookie, which will be unique, we pass
the VOLID as cookie at map and use the same at the time of attach, that
way rbd-nbd can identify backends and their matching devices.

Requires:
ceph/ceph#41323
https://lkml.org/lkml/2021/4/29/274

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
mergify bot pushed a commit to ceph/ceph-csi that referenced this pull request Nov 4, 2021
Problem:
On remap/attach of device (i.e. nodeplugin restart), there is no way
for rbd-nbd to defend if the backend storage is matching with the initial
backend storage.

Say, if an initial map request for backend "pool1/image1" got mapped to
/dev/nbd0 and the userspace process is terminated (on nodeplugin restart).
A next remap/attach (nodeplugin start) request within reattach-timeout is
allowed to use /dev/nbd0 for a different backend "pool1/image2"

For example, an operation like below could be dangerous:

$ sudo rbd-nbd map --try-netlink rbd-pool/ext4-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="bfc444b4-64b1-418f-8b36-6e0d170cfc04" TYPE="ext4"
$ sudo pkill -15 rbd-nbd   <-- nodeplugin terminate
$ sudo rbd-nbd attach --try-netlink --device /dev/nbd0 rbd-pool/xfs-image
/dev/nbd0
$ sudo blkid /dev/nbd0
/dev/nbd0: UUID="d29bf343-6570-4069-a9ea-2fa156ced908" TYPE="xfs"

Solution:
rbd-nbd/kernel now provides a way to keep some metadata in sysfs to identify
between the device and the backend, so that when a remap/attach request is
made, rbd-nbd can compare and avoid such dangerous operations.

With the provided solution, as part of the initial map request, backend
cookie (ceph-csi VOLID) can be stored in the sysfs per device config, so
that on a remap/attach request rbd-nbd will check and validate if the
backend per device cookie matches with the initial map backend with the help
of cookie.

At Ceph-csi we use VOLID as device cookie, which will be unique, we pass
the VOLID as cookie at map and use the same at the time of attach, that
way rbd-nbd can identify backends and their matching devices.

Requires:
ceph/ceph#41323
https://lkml.org/lkml/2021/4/29/274

Signed-off-by: Prasanna Kumar Kalever <prasanna.kalever@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants