Skip to content

squid: Fix multifs auth caps check#65359

Open
kotreshhr wants to merge 9 commits intoceph:squidfrom
kotreshhr:wip-72812-squid
Open

squid: Fix multifs auth caps check#65359
kotreshhr wants to merge 9 commits intoceph:squidfrom
kotreshhr:wip-72812-squid

Conversation

@kotreshhr
Copy link
Contributor

@kotreshhr kotreshhr commented Sep 3, 2025

backport tracker: https://tracker.ceph.com/issues/72812
backport tracker: https://tracker.ceph.com/issues/67293


backport of #58878
parent tracker: https://tracker.ceph.com/issues/67212

backport of #64550
parent tracker: https://tracker.ceph.com/issues/72167

NOTE: Both the backports were dependant. Hence doing it via single PR

this backport was staged using ceph-backport.sh version 16.0.0.6848
find the latest version at https://github.com/ceph/ceph/blob/main/src/script/ceph-backport.sh

@kotreshhr kotreshhr added this to the squid milestone Sep 3, 2025
@kotreshhr kotreshhr added the core label Sep 3, 2025
@github-actions github-actions bot added cephfs Ceph File System tests labels Sep 3, 2025
Fixes: https://tracker.ceph.com/issues/67212
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 983f893)
The "Client::mds_check_access" expects the target_path without
leading '/' as it eventually calls the "MDSCapMatch::match_path"
which expects the target_path passed to be with out leading '/'
as well.

The single leading '/' was being removed. But absolute path
constructed did have leading '//', so removing all the leading
'/' was necessary.

This causes the clients not to be able to access a particular
path even though it has a rw permission on the specific path.

The patche fixes the leading '//' issue.

Fixes: https://tracker.ceph.com/issues/67212
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 2e2adb2)
This is required to test the features involving
fixes both in client and mds. This is to make
sure the older clients are not broken with the
fix. The version 19.2.2 is used for client.

The test suite sets up the cluster with squid
19.2.2 and upgrades only the ceph cluster node
leaving the client node.

Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit a4f97c0)
Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 3516db3)

Conflicts:
  qa/tasks/cephfs/test_admin.py - The commit 1fda8ed isn't
backported
The multifs auth caps bug has a fix both in client and mds.
If it's old client and not patched, we expect that the fs
with 'rw' would end up having 'r' caps with the multifs
auth caps used as in the test
'test_multifs_single_client_cross_access_r_caps_end'.
This patch adds the conditional to validate the same.

This commit makes use of the PR ceph#64005

Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit f10e34d)
The fsname is not take into consideration while validating
the access check for the operations. This patch fixes
the same.

Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 1a5e083)
The fsname needs to be passed to validate the mds
auth caps check. This patch fixes the same.

Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit b1d6bb9)
Fix the TestMDSAuthCaps after fixing
multifs authcaps comparison.

Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 92ab603)
The kclient fix isn't yet landed in the kernel and hence
the test 'test_multifs_single_client_cross_access_r_caps_end'
would fail for kernel mount. So disable the failing validation
in the test for kclient.

Fixes: https://tracker.ceph.com/issues/72167
Signed-off-by: Kotresh HR <khiremat@redhat.com>
(cherry picked from commit 485f37a)
@joscollin
Copy link
Member

This PR is under test in https://tracker.ceph.com/issues/73330.

@joscollin
Copy link
Member

This PR is under test in https://tracker.ceph.com/issues/74996.

@batrick batrick modified the milestones: squid, v19.2.4 Mar 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants