From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id DAAE49963 for ; Fri, 1 Apr 2022 17:25:07 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D150D28D6A for ; Fri, 1 Apr 2022 17:24:37 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 1829B28D5F for ; Fri, 1 Apr 2022 17:24:36 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id E5D93459C9 for ; Fri, 1 Apr 2022 17:24:35 +0200 (CEST) From: Aaron Lauterer To: pve-devel@lists.proxmox.com Date: Fri, 1 Apr 2022 17:24:23 +0200 Message-Id: <20220401152424.3811621-1-a.lauterer@proxmox.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.029 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [RFC container] alloc disk: fix #3970 avoid ambiguous rbd image path X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Apr 2022 15:25:07 -0000 If two RBD storages use the same pool, but connect to different clusters, we cannot say to which cluster the mapped RBD image belongs to. To avoid potential data loss, we need to verify that no other storage is configured that could have a volume mapped under the same path before we format anything. The ambiguous mapping is in /dev/rbd/// where the namespace is optional. Once we can tell the clusters apart in the mapping, we can remove these checks again. See bug #3969 for more information on the root cause. Signed-off-by: Aaron Lauterer --- RFC because I would like someone else to take a look at the logic and I wasn't sure how to format the grouping of the conditions in a way that is easy to read src/PVE/LXC.pm | 45 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm index fe63087..b048ce0 100644 --- a/src/PVE/LXC.pm +++ b/src/PVE/LXC.pm @@ -1970,6 +1970,51 @@ sub alloc_disk { my $scfg = PVE::Storage::storage_config($storecfg, $storage); # fixme: use better naming ct-$vmid-disk-X.raw? + # check if another rbd storage with the same pool name but different + # cluster exists. If so, allocating a new volume can potentially be + # dangerous because the RBD mapping, exposes it in an ambiguous way under + # /dev/rbd///. Without any information to which cluster it + # belongs, we cannot clearly determine which image we access and + # potentially format an already used image. See + # https://bugzilla.proxmox.com/show_bug.cgi?id=3969 and + # https://bugzilla.proxmox.com/show_bug.cgi?id=3970 + # TODO: remove these checks once #3969 is fixed and we can clearly tell to + # which cluster an image belongs to + if ($scfg->{type} eq 'rbd') { + my $pool = $storecfg->{ids}->{$storage}->{pool}; + foreach my $stor (keys %{$storecfg->{ids}}) { + next if $stor eq $storage; + + my $ccfg = PVE::Storage::storage_config($storecfg, $stor); + next if $ccfg->{type} ne 'rbd'; + + if ($scfg->{pool} eq $ccfg->{pool}) { + if ( + ( + defined($scfg->{monhost}) + && defined($ccfg->{monhost}) + && $scfg->{monhost} eq $ccfg->{monhost} + ) + || ( + !defined($scfg->{monhost}) + && !defined($ccfg->{monhost}) + ) + ) { + # both external ones same or both hyperconverged + next; + } + # different cluster here + # we are ok if namespaces are not the same or only one storage has one + if (defined($scfg->{namespace}) && defined($ccfg->{namespace})) { + next if $scfg->{namespace} ne $ccfg->{namespace}; + } elsif (defined($scfg->{namespace}) || defined($ccfg->{namespace})) { + next; + } + die "Cannot determine which Ceph cluster the volume mapping belongs to. Abort!\n"; + } + } + } + eval { my $do_format = 0; if ($scfg->{content}->{rootdir} && $scfg->{path}) { -- 2.30.2