mon: AuthMonitor: validate caps when creating or changing mon caps

The monitor doesn't really know how to validate caps not meant for it.
The MDS or the OSD may very well allow blank caps for instance, while
the monitor categorically does not.  We can't simply state a capability
is invalid because we wouldn't take it as such.

On the other hand, we must check monitor caps and make sure they are
correct, otherwise malformed caps can go unnoticed for a while,
sometimes even being hard to understand what may have gone wrong.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: match command module caps against what's on MonCommands.h

We were checking the command's permissions against what we perceived as
the 'module' from parsing the command's "prefix" (specified by the
client).  This caused troubles with cap checks for commands without a
submodule clearly defined, such as 'status' or 'health' (vs 'mon dump'
or 'osd pool set', which are of submodule 'mon' and 'osd' respectively).

As such, we now grab the command's submodule (right now solely for caps
checks) from the monitor's internal representation of the commands
(defined in mon/MonCommands.h and built at compile time and stashed in
'mon_commands').  Given that commands such as 'health', 'fsid' or
'status' have properly defined modules in MonCommands.h, we simply rely
on that representation for all commands.  Which is what we should have
been doing from the start anyway, because we shouldn't be relying on the
client to point us to what we want to authenticate against.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: MonCap: add new profiles

Adds three new profiles:

  read-only:  able to issue all read-only (MON_CAP_R) commands.  Any
  command that may take additional caps (MON_CAP_W or MON_CAP_X) won't
  be allowed.

  read-write: able to issue all read-write (MON_CAP_R | MON_CAP_W)
  commands.  Commands that require MON_CAP_X will not be allowed.

  role-definer: solely able to issue commands on the 'auth' subsystem,
  to which all caps are given (MON_CAP_R | MON_CAP_W | MON_CAP_X).

Fixes: #8899

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
qa/workunits: cephtool: test auth profiles

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
test: mon: test-mon-msg: Check which msgs the mons handle and reply to

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: create logical divisions on dispatch() based on msg nature

Instead of a single switch(), have multiple switch() and order them by
increasing necessity of privileges.

This patch thus divides the big switch into:

- messages not requiring auth/caps checks at all
- messages which caps shall be checked somewhere else
- messages the Monitor class needs to deal with but only require a
  client to have enough caps for the monitor to consider handling them
- messages that only a monitor is allowed to send.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: check caps and source before dispatching messages

Only dispatch messages that a client may send if said client has at
least MON_CAP_R, and only dispatch internal monitor messages if peer is
a monitor.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: remove redudant call to osdmon's dispatch

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
test/vstart_wrapper.sh: use cephx

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
qa/workunits: mon: auth_caps: cleanup on successful exit

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
qa/workunits: mon: auth_caps: variables must be local

We have variables with the same name that are being shared!  We don't
hit any issues with it currently because the code just kind of works
even though that happens.  Add a bit of new logic that relies on an
immutable return code (for instance) and we're in the woods.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: MonCommands: adjust indentation for 'auth add'

Eye-candy.  We changed indentation of a few other entries and this one
was just too darn obvious, itching all over, night terrors, the whole
nine yards.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
qa/workunits: mon: auth_caps: account for mon blank caps

test creating and entity with blank caps with and without '--force'
being specified.  without '--force' they must fail with EINVAL as the
monitor will not be able to parse them.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: Monitor: let 'handle_command()' deal with caps validation

If a given client doesn't have the required caps when running a command,
it must receive an EACCES or EPERM reply.  This is already handled by
Monitor::handle_command(), which does an exceptionally good job at it.

Therefore, and unlike other messages that do not expect return values,
we can't simply drop the message if the client doesn't have the
appropriate capabilities, or things can get very weird very fast from
the user's perspective.  Dropping the message for a command without a
reply has roughly the same effect as loss of quorum (timeout, pipes
failing) and confusion may ensue from it.

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
Merge pull request #2560 from ceph/wip-9418

mon: add new profiles & audit cap checks

Reviewed-by: Sage Weil <sage@redhat.com>