fix: Use registration token to prevent double meta node/target id use

This takes the previously ignored node_alias field on received
heartbeats from meta nodes (only!) and stores it together with the meta
target as a registration token. When the field is already filled, a
mismatch will fail the heartbeat.

Author: rustybee42

mgmtd/src/bee_msg/node.rs

@@ -7,6 +7,7 @@ use shared::bee_msg::node::*;
 use shared::types::{MGMTD_ID, MGMTD_UID, NodeId, TargetId};
 use std::net::SocketAddr;
 use std::sync::Arc;
+use tonic::IntoRequest;
 
 impl HandleWithResponse for GetNodes {
     type Response = GetNodesResp;
@@ -195,10 +196,45 @@ async fn update_node(msg: RegisterNode, ctx: &Context) -> Result<NodeId> {
                 }
             }
 
+            let new_alias_or_reg_token = String::from_utf8(msg.node_alias)?;
+
             let (node, is_new) = if let Some(node) = node {
                 // Existing node, update data
                 db::node::update(tx, node.uid, msg.port, machine_uuid)?;
 
+                // If the updated node is a meta node, check if its corresponding target has a
+                // registration token
+                if msg.node_type == NodeType::Meta {
+                    let stored_reg_token: Option<String> = tx.query_row(
+                        sql!("SELECT reg_token FROM meta_targets WHERE node_id = ?1"),
+                        [node.num_id()],
+                        |row| row.get(0),
+                    )?;
+
+                    if let Some(ref t) = stored_reg_token
+                        && t != &new_alias_or_reg_token
+                    {
+                        bail!(
+                            "Registration token sent by meta node {node} ({}) \
+does not match stored token ({})",
+                            new_alias_or_reg_token,
+                            t
+                        );
+                    } else if stored_reg_token.is_none() {
+                        tx.execute(
+                            sql!(
+                                "UPDATE targets SET reg_token = ?1
+                                WHERE node_id = ?2 AND node_type = ?3"
+                            ),
+                            rusqlite::params![
+                                new_alias_or_reg_token,
+                                node.num_id(),
+                                NodeType::Meta.sql_variant()
+                            ],
+                        )?;
+                    }
+                }
+
                 (node, false)
             } else {
                 // New node, do additional checks and insert data
@@ -216,9 +252,7 @@ async fn update_node(msg: RegisterNode, ctx: &Context) -> Result<NodeId> {
                     // updated to no longer start with a number, thus it is unlikely this
                     // would happen unless BeeGFS 8 was mounted by a BeeGFS 7 client.
 
-                    let new_alias = String::from_utf8(msg.node_alias)
-                        .ok()
-                        .and_then(|s| Alias::try_from(s).ok());
+                    let new_alias = Alias::try_from(new_alias_or_reg_token.clone()).ok();
 
                     if new_alias.is_none() {
                         log::warn!(
@@ -246,7 +280,7 @@ client version < 8.0)"
                         );
                     };
 
-                    db::target::insert_meta(tx, target_id)?;
+                    db::target::insert_meta(tx, target_id, Some(&new_alias_or_reg_token))?;
                 }
 
                 (node, true)

mgmtd/src/db/import_v7.rs

@@ -144,7 +144,7 @@ fn meta_nodes(tx: &Transaction, f: &Path) -> Result<(NodeId, bool)> {
             );
         };
 
-        target::insert_meta(tx, target_id)?;
+        target::insert_meta(tx, target_id, None)?;
     }
 
     if root_id == 0 {

mgmtd/src/db/target.rs

@@ -37,7 +37,11 @@ pub(crate) fn validate_ids(
 ///
 /// BeeGFS doesn't really support meta targets at the moment, so there always must be exactly one
 /// meta target per meta node with their IDs being the same.
-pub(crate) fn insert_meta(tx: &Transaction, target_id: TargetId) -> Result<()> {
+pub(crate) fn insert_meta(
+    tx: &Transaction,
+    target_id: TargetId,
+    reg_token: Option<&str>,
+) -> Result<()> {
     let target_id = if target_id == 0 {
         misc::find_new_id(tx, "targets", "target_id", NodeType::Meta, 1..=0xFFFF)?
     } else {
@@ -47,7 +51,7 @@ pub(crate) fn insert_meta(tx: &Transaction, target_id: TargetId) -> Result<()> {
     insert(
         tx,
         target_id,
-        None,
+        reg_token,
         NodeTypeServer::Meta,
         Some(target_id.into()),
     )?;
@@ -271,10 +275,10 @@ mod test {
     #[test]
     fn set_get_meta() {
         with_test_data(|tx| {
-            super::insert_meta(tx, 1).unwrap_err();
-            super::insert_meta(tx, 99).unwrap();
+            super::insert_meta(tx, 1, None).unwrap_err();
+            super::insert_meta(tx, 99, None).unwrap();
             // existing id
-            super::insert_meta(tx, 99).unwrap_err();
+            super::insert_meta(tx, 99, None).unwrap_err();
 
             let targets: i64 = tx
                 .query_row(sql!("SELECT COUNT(*) FROM meta_targets"), [], |row| {