glusterfs.git/xlators/protocol/auth, branch v3.3.0qa31

mgmt/glusterd : volume set validation fixes

2012-03-18T07:52:40+00:00

This is the new version of the patch by Kaushik at review.gluster.com/699

The following new option types have been introduced:
 * GF_OPTION_TYPE_INTERNET_ADDRESS_LIST
 * GF_OPTION_TYPE_PRIORITY_LIST
 * GF_OPTION_TYPE_SIZE_LIST
and option types of several options in translators have been updated to use the
new types.

valid_internet_address(), valid_ipv4_address() & valid_ipv6_address() functions
has been updated for * wildcard matching. Previously used standalone wildcard
address checking functions have been removed.

Changes have been done to stripe translator to correctly set, update and use
stripe-blocksize. Also minimum value for block-size has been set to 16KB.

Change-Id: I2aa484ff695f6a915a8fc9a9f965cf0344f41d59
BUG: 765248
Signed-off-by: Kaushal M 
Reviewed-on: http://review.gluster.com/2899
Tested-by: Gluster Build System 
Reviewed-by: Shishir Gowda 
Reviewed-by: Anand Avati

glusterd: auth allow enhancements

2012-02-20T08:30:54+00:00

* PROBLEM:

  When address-based authentication is enabled on a volume,
  the gNfs server, self-heal daemon (shd), and other operations
  such as quota, rebalance, replace-brick and geo-replication
  either stop working or the services are not started if all
  the peers' ipv{4,6} addresses or hostnames are not added in
  the "set auth.allow" operation, breaking the functionality
  of several operations.

  E.g:
    volume vol in a cluster of two peers:
    /mnt/brick1 in 192.168.1.4
    /mnt/brick2 in 192.168.1.5

    option auth.allow 192.168.1.6
    (allow connection requests only from 192.168.1.6)

    This will disrupt the nfs servers on 192.168.1.{4,5}.
    brick server processes reject connection requests from both
    nfs servers (on 4,5), because the peer addresses are not in
    the auth.allow list.

    Same holds true for local mounts (on peer machines),
    self-heal daemon, and other operations which perform
    a glusterfs mount on one of the peers.

* SOLUTION:

  Login-based authentication (username/password pairs,
  henceforth referred to as "keys") for gluster services and
  operations.

  These *per-volume* keys can be used to by-pass the addr-based
  authentication, provided none of the peers' addresses are put
  in the auth.reject list, to enable gluster services like gNfs,
  self-heal daemon and internal operations on volumes when
  auth.allow option is exercised.

* IMPLEMENTATION:

  1. Glusterd generates keys for each volume and stores it in
     memory as well as in respective volfiles.
     A new TRUSTED-FUSE volfile is generated which is
     fuse volfile + keys in protocol/client,
     and is named trusted--fuse.vol.
     This is used by all local mounts. ANY local mount (on any peer)
     is granted the trusted-fuse volfile instead of fuse volfile
     via getspec. non-local mounts are NOT granted the trusted fuse
     volfile.

  2. The keys generated for the volume is written to each server
     volfile telling servers to allow users with these keys.

  3. NFS, self-heal daemon and replace-brick volfiles are updated
     with the volume's authentication keys.

  4. The keys are NOT written to fuse volfiles for obvious reasons.

  5. The ownership of volfiles and logfiles is restricted to root users.

  6. Merging two identical definitions of peer_info_t in auth/addr
     and rpc-lib, throwing away the one in auth/addr.

  7. Code cleanup in numerous places as appropriate.

* IMPORTANT NOTES:

  1. One SHOULD NOT put any of the peer addresses in the auth.reject
     list if one wants any of the glusterd services and features
     such as gNfs, self-heal, rebalance, geo-rep and quota.

  2. If one wants to use username/password based authentication
     to volumes, one shall append to the server, nfs and shd volfiles,
     the keys one wants to use for authentication, *while_retaining
     those_generated_by_glusterd*.
     See doc/authentication.txt file for details.

Change-Id: Ie0331d625ad000d63090e2d622fe1728fbfcc453
BUG: 789942
Signed-off-by: Rajesh Amaravathi 
Reviewed-on: http://review.gluster.com/2733
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

Change Copyright current year

2011-08-10T17:57:19+00:00

Change-Id: I2d10f2be44f518f496427f257988f1858e888084
BUG: 3348
Reviewed-on: http://review.gluster.com/200
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

LICENSE: s/GNU Affero General Public/GNU General Public/

2011-08-06T13:33:52+00:00

Change-Id: I3914467611e573cccee0d22df93920cf1b2eb79f
BUG: 3348
Reviewed-on: http://review.gluster.com/182
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

gf_auth also needs to handle server.allow-insecure

2011-05-04T12:00:15+00:00

When server.allow-insecure option is set, the connection from client
can be from any port. gf_auth also needs to check for this option

Signed-off-by: shishir gowda 
Signed-off-by: Anand Avati 

BUG: 2868 (Add xlator-option to support insecure-bind for clients)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2868

protocol/auth directory updated with whitespace cleanup and proper logs

2011-03-17T18:59:04+00:00

Signed-off-by: Amar Tumballi 
Signed-off-by: Vijay Bellur 

BUG: 2346 (Log message enhancements in GlusterFS - phase 1)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=2346

Copyright changes

2010-10-11T14:31:12+00:00

Signed-off-by: Vijay Bellur 
Signed-off-by: Vijay Bellur 

BUG: 971 (dynamic volume management)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=971

Change GNU GPL to GNU AGPL

2010-10-04T14:50:05+00:00

Signed-off-by: Pranith Kumar K 
Signed-off-by: Vijay Bellur 

BUG: 1388 ()
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=1388

protocol/lib: rename files to standardized names and places

2010-07-14T22:02:50+00:00

-  move xlators/protocol/lib/* to rpc/xdr/
-  rename CLI and glusterd XDR filenames
-  remove xlators/protocol/lib (libgfproto1.so)

Signed-off-by: Anand V. Avati 
Signed-off-by: Anand V. Avati 

BUG: 875 (Implement a new protocol to provide proper backward/forward compatibility)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=875

rpc protocol

2010-06-22T03:21:10+00:00

Signed-off-by: Amar Tumballi 
Signed-off-by: Raghavendra G 
Signed-off-by: Anand V. Avati 

BUG: 875 (Implement a new protocol to provide proper backward/forward compatibility)
URL: http://bugs.gluster.com/cgi-bin/bugzilla3/show_bug.cgi?id=875