mds: Add session to sessionmap when its state becomes opening

following sequence events may happen.
- client sends reconnect message to a recovering MDS.
- MDS::ms_verify_authorizer() create a session for the client, the
  session is in closed state.
- MDS::handle_client_reconnect() sends session close message to
  the client.
- client closes the old connection and opens a new connection
- MDS::ms_verify_authorizer() is called for a new connection
- MDS::ms_handle_reset() is called for the old connection
- MDS::ms_handle_accept() is called for the new connection

MDS::ms_handle_reset() removes client's session from the session map, this
can cause null pointer dereference when handling client request. The fix
is add session to sessionmap when its state becomes 'opening' and remove
session from sessionmap when its state becomes 'closed'

Signed-off-by: Yan, Zheng <zyan@redhat.com>
PG: release backfill reservations if a backfill peer rejects

Also, the full peer will wait until the rejection from the primary
to do a state transition.

Fixes: #9626
Backport: giant, firefly, dumpling
Signed-off-by: Samuel Just <sam.just@inktank.com>
mon: move paxos write wait into a helper

Avoid duplicated code.

Signed-off-by: Sage Weil <sage@redhat.com>
mon: flush paxos write before setting shutdown state

Paxos::commit_finish() makes assertions about our state (writing |
writing-previous).

Fixes: #9635
Signed-off-by: Sage Weil <sage@redhat.com>
mon: wait for paxos writes before touching state

Fix two other paths where may change the mon state so that we wait for the
pending write first.  start_election() in particular can be triggered at
almost any time if we see an election message from another mon.

Signed-off-by: Sage Weil <sage@redhat.com>
mon: put 'ceph status' health items on separate lines

This makes it *way* easier to read.

Signed-off-by: Sage Weil <sage@redhat.com>
mon: put 'ceph status' quorum status on new line

Signed-off-by: Sage Weil <sage@redhat.com>
mon: break recovery status onto separate lines

This affects both the 'health' and 'pgmap' sections of 'ceph status'
output.

Signed-off-by: Sage Weil <sage@redhat.com>
ReplicatedPG: clean out completed trimmed objects as we go

Also, explicitely maintain a max number of concurrently trimming
objects.

Fixes: 9113
Backport: dumpling, firefly, giant
Signed-off-by: Samuel Just <sam.just@inktank.com>
ReplicatedPG: do not queue the snap trimmer constantly

Previously, we continuously requeued the snap trimmer while in
TrimmingObjects.  This is not a good idea now that we try to
limit the number of snap trimming repops in flight and requeue
the snap trimmer directly as those repops complete.

Fixes: #9113
Backport: giant, dumpling, firefly
Signed-off-by: Samuel Just <sam.just@inktank.com>
ReplicatedPG: dump snap_trimq on pg query

Signed-off-by: Samuel Just <sam.just@inktank.com>
osdc/Objecter: use SafeTimer; make callbacks race-tolerant

The RWTimer event cancellation is racy.  Instead, just make all of our
callbacks tolerate cancellation races.  This is already true of most of
them (in fact, they are probably broken because they try to take a write
lock while holding a read lock).  Fix C_CancelOp so that it calls the
other op_cancel (that takes a tid).

Then switch the RWTimer back to a SafeTimer.  Put it in unsafe callbacks
mode because we don't want to introduce lock cycles with timer_lock.

Fixes: #9582
See also: #9650
Signed-off-by: Sage Weil <sage@redhat.com>
PG::actingset should be used when checking the number of acting OSDs for a given PG.
Signed-off-by: Guang Yang <yguang@yahoo-inc.com>
mon: AuthMonitor: validate caps when creating or changing mon caps

The monitor doesn't really know how to validate caps not meant for it.
The MDS or the OSD may very well allow blank caps for instance, while
the monitor categorically does not.  We can't simply state a capability
is invalid because we wouldn't take it as such.

On the other hand, we must check monitor caps and make sure they are
correct, otherwise malformed caps can go unnoticed for a while,
sometimes even being hard to understand what may have gone wrong.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: match command module caps against what's on MonCommands.h

We were checking the command's permissions against what we perceived as
the 'module' from parsing the command's "prefix" (specified by the
client).  This caused troubles with cap checks for commands without a
submodule clearly defined, such as 'status' or 'health' (vs 'mon dump'
or 'osd pool set', which are of submodule 'mon' and 'osd' respectively).

As such, we now grab the command's submodule (right now solely for caps
checks) from the monitor's internal representation of the commands
(defined in mon/MonCommands.h and built at compile time and stashed in
'mon_commands').  Given that commands such as 'health', 'fsid' or
'status' have properly defined modules in MonCommands.h, we simply rely
on that representation for all commands.  Which is what we should have
been doing from the start anyway, because we shouldn't be relying on the
client to point us to what we want to authenticate against.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao@redhat.com>
mon: MonCap: add new profiles

Adds three new profiles:

  read-only:  able to issue all read-only (MON_CAP_R) commands.  Any
  command that may take additional caps (MON_CAP_W or MON_CAP_X) won't
  be allowed.

  read-write: able to issue all read-write (MON_CAP_R | MON_CAP_W)
  commands.  Commands that require MON_CAP_X will not be allowed.

  role-definer: solely able to issue commands on the 'auth' subsystem,
  to which all caps are given (MON_CAP_R | MON_CAP_W | MON_CAP_X).

Fixes: #8899

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
qa/workunits: cephtool: test auth profiles

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
test: mon: test-mon-msg: Check which msgs the mons handle and reply to

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: create logical divisions on dispatch() based on msg nature

Instead of a single switch(), have multiple switch() and order them by
increasing necessity of privileges.

This patch thus divides the big switch into:

- messages not requiring auth/caps checks at all
- messages which caps shall be checked somewhere else
- messages the Monitor class needs to deal with but only require a
  client to have enough caps for the monitor to consider handling them
- messages that only a monitor is allowed to send.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>
mon: Monitor: check caps and source before dispatching messages

Only dispatch messages that a client may send if said client has at
least MON_CAP_R, and only dispatch internal monitor messages if peer is
a monitor.

Backport: firefly

Signed-off-by: Joao Eduardo Luis <joao.luis@inktank.com>