From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 5D6C39E37E for ; Mon, 27 Nov 2023 12:40:21 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 465A066C9 for ; Mon, 27 Nov 2023 12:40:21 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Mon, 27 Nov 2023 12:40:20 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 5280444BF9 for ; Mon, 27 Nov 2023 12:40:20 +0100 (CET) From: Philipp Hufnagl To: pve-devel@lists.proxmox.com Date: Mon, 27 Nov 2023 12:40:01 +0100 Message-Id: <20231127114001.189590-5-p.hufnagl@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231127114001.189590-1-p.hufnagl@proxmox.com> References: <20231127114001.189590-1-p.hufnagl@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.049 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH storage v4 4/4] pbs: fix #5008: Check if datastore and namespace is valid on add- and update hooks X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Nov 2023 11:40:21 -0000 This adds a check if the datastore and the namespace is valid when a user attempts to add a new PBS datastore. Since the namespace only can be checked after the datastore is validated, the datastore will be checked as well, regardless that it will be done later in the superclass anyway. The functionallity to check namespaces is added with this commit. For checking the datastore, existing code that has previously been refactored will be reused. Because the server address is needed to check the namespaces in the update hook, it has to be included in the Storage/Config.pm. Signed-off-by: Philipp Hufnagl --- src/PVE/API2/Storage/Config.pm | 4 ++-- src/PVE/Storage/PBSPlugin.pm | 41 ++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 2 deletions(-) diff --git a/src/PVE/API2/Storage/Config.pm b/src/PVE/API2/Storage/Config.pm index e04b6ab..651d4bc 100755 --- a/src/PVE/API2/Storage/Config.pm +++ b/src/PVE/API2/Storage/Config.pm @@ -362,12 +362,12 @@ __PACKAGE__->register_method ({ } } - $returned_config = $plugin->on_update_hook($storeid, $opts, %$sensitive); - for my $k (keys %$opts) { $scfg->{$k} = $opts->{$k}; } + $returned_config = $plugin->on_update_hook($storeid, $scfg, %$sensitive); + if (defined($scfg->{mkdir})) { # TODO: remove complete option in Proxmox VE 9 warn "NOTE: The 'mkdir' option set for '${storeid}' is deprecated and will be removed" ." in Proxmox VE 9. Use 'create-base-path' or 'create-subdirs' instead.\n" diff --git a/src/PVE/Storage/PBSPlugin.pm b/src/PVE/Storage/PBSPlugin.pm index 3e0e155..0797cec 100644 --- a/src/PVE/Storage/PBSPlugin.pm +++ b/src/PVE/Storage/PBSPlugin.pm @@ -566,6 +566,11 @@ sub on_add_hook { pbs_delete_master_pubkey($scfg, $storeid); } + my $password = pbs_get_password($scfg, $storeid); + my $conn = pbs_api_connect($scfg, $password); + check_datastore_exists($class, $storeid, $scfg, $password, $conn); + check_namespace_exists($class, $storeid, $scfg, $password, $conn); + return $res; } @@ -614,6 +619,11 @@ sub on_update_hook { } } + my $password = pbs_get_password($scfg, $storeid); + my $conn = pbs_api_connect($scfg, $password); + check_datastore_exists($class, $storeid, $scfg, $password, $conn); + check_namespace_exists($class, $storeid, $scfg, $password, $conn); + return $res; } @@ -817,6 +827,18 @@ sub scan_datastores { return $response; } + +sub scan_namespaces { + my ($scfg, $datastore, $password, $conn) = @_; + + $conn = pbs_api_connect($scfg, $password) if !defined($conn); + + my $namespaces = eval { $conn->get("/api2/json/admin/datastore/$datastore/namespace", {}); }; + die "error fetching namespaces - $@" if $@; + + return $namespaces; +} + sub check_datastore_exists { my ($class, $storeid, $scfg, $password, $conn) = @_; @@ -833,6 +855,25 @@ sub check_datastore_exists { die "$storeid: Cannot find datastore '$datastore', check permissions and existence!\n"; } +sub check_namespace_exists { + my ($class, $storeid, $scfg, $password, $conn) = @_; + + my $namespace = $scfg->{namespace}; + return 1 if !defined($namespace); + my $datastore = $scfg->{datastore}; + + my $namespaces = eval { scan_namespaces($scfg, $datastore, $password, $conn) }; + die "$storeid: $@" if $@; + + for my $ns (@$namespaces) { + if ($ns->{ns} eq $namespace) { + return 1; + } + } + + die "$storeid: Cannot find namespace '$namespace', check permissions and existence!\n"; +} + sub activate_storage { my ($class, $storeid, $scfg, $cache) = @_; -- 2.39.2