ctdb-daemon: Don't allow attach from recovery if recovery is not active

Neither the recovery daemon nor the recovery helper should attach
databases outside of the recovery process.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14294

Signed-off-by: Martin Schwenke <martin@meltin.net>
Reviewed-by: Amitay Isaacs <amitay@gmail.com>

diff --git a/ctdb/server/ctdb_ltdb_server.c b/ctdb/server/ctdb_ltdb_server.c
index e050b7304fe5f5a04320035a474683b43ebe0fb7..ce3569fe7b19f8dd6663fed9c8d53c2d548bca0a 100644 (file)
--- a/ctdb/server/ctdb_ltdb_server.c
+++ b/ctdb/server/ctdb_ltdb_server.c
@@ -1135,6 +1135,13 @@ int32_t ctdb_control_db_attach(struct ctdb_context *ctdb,
                        return -1;
                }
 
+               if ((c->flags & CTDB_CTRL_FLAG_ATTACH_RECOVERY) &&
+                   ctdb->recovery_mode != CTDB_RECOVERY_ACTIVE) {
+                       DBG_ERR("Attach from recovery refused because "
+                               "recovery is not active\n");
+                       return -1;
+               }
+
                if (!(c->flags & CTDB_CTRL_FLAG_ATTACH_RECOVERY) &&
                    (ctdb->recovery_mode == CTDB_RECOVERY_ACTIVE ||
                     ctdb->runstate < CTDB_RUNSTATE_STARTUP)) {