summaryrefslogtreecommitdiffstats
path: root/xlators/mgmt/glusterd/src/glusterd.c
diff options
context:
space:
mode:
authorJeff Darcy <jdarcy@redhat.com>2014-07-03 14:01:20 +0000
committerVijay Bellur <vbellur@redhat.com>2014-07-10 07:37:12 -0700
commitb42688786f25420de671ea06030edf4371058433 (patch)
tree33b4740179b4291222c0b2553b1527b8d8982be1 /xlators/mgmt/glusterd/src/glusterd.c
parent0f5719a3598ff4f72cef8b4fe1fcc2587ec39931 (diff)
socket/glusterd/client: enable SSL for management
The feature is controlled by presence of the following file: /var/lib/glusterd/secure-access See the comment near the definition of SECURE_ACCESS_FILE in glusterfs.h for the rationale. With this enabled, the following rules apply to connections: UNIX-domain sockets never have SSL. Management-port sockets (both connecting and accepting, in daemons and CLI) have SSL based on presence of the file. Other IP sockets have SSL based on the existing client.ssl and server.ssl volume options. Transport multi-threading is explicitly turned off in glusterd (it would otherwise be turned on when SSL is) due to multi-threading issues. Tests have been elided to avoid risk of leaving a file which will cause all subsequent tests to run with management SSL still enabled. IMPLEMENTATION NOTE The implementation is a bit messy, and consists of two stages. First we decide whether to set the relevant fields in our context structure, based on presence of the sentinel file OR a command-line override. Later we decide whether a particular connection should actually use SSL, based on the context flags plus what kind of connection we're making[1] and what kind of daemon we're in[2]. [1] inbound, outbound to glusterd port, other outbound [2] glusterd, glusterfsd, other TESTING NOTE Instead of just running one special test for this feature, the ideal would be to run all tests with management SSL enabled. However, it would be inappropriate or premature to set up an optional feature in the patch itself. Therefore, the method of choice is to submit a separate patch on top, which modifies "cleanup" in include.rc to recreate the secure-access file and associated SSL certificate/key files before each test. Change-Id: I0e04d6d08163893e24ec8c031748c5c447d7f780 BUG: 1114604 Signed-off-by: Jeff Darcy <jdarcy@redhat.com> Reviewed-on: http://review.gluster.org/8094 Tested-by: Gluster Build System <jenkins@build.gluster.com> Reviewed-by: Vijay Bellur <vbellur@redhat.com>
Diffstat (limited to 'xlators/mgmt/glusterd/src/glusterd.c')
-rw-r--r--xlators/mgmt/glusterd/src/glusterd.c37
1 files changed, 32 insertions, 5 deletions
diff --git a/xlators/mgmt/glusterd/src/glusterd.c b/xlators/mgmt/glusterd/src/glusterd.c
index 3e8a3e2e17a..adf58cc7dde 100644
--- a/xlators/mgmt/glusterd/src/glusterd.c
+++ b/xlators/mgmt/glusterd/src/glusterd.c
@@ -68,7 +68,7 @@ rpcsvc_cbk_program_t glusterd_cbk_prog = {
struct rpcsvc_program *gd_inet_programs[] = {
&gd_svc_peer_prog,
- &gd_svc_cli_trusted_progs,
+ &gd_svc_cli_trusted_progs, /* Must be index 1 for secure_mgmt! */
&gd_svc_mgmt_prog,
&gd_svc_mgmt_v3_prog,
&gluster_pmap_prog,
@@ -1327,8 +1327,34 @@ init (xlator_t *this)
goto out;
}
+ if (this->ctx->secure_mgmt) {
+ /*
+ * The socket code will turn on SSL based on the same check,
+ * but that will by default turn on own-thread as well and
+ * we're not multi-threaded enough to handle that. Thus, we
+ * override the value here.
+ */
+ ret = dict_set_str (this->options,
+ "transport.socket.own-thread", "off");
+ if (ret != 0) {
+ gf_log (this->name, GF_LOG_ERROR,
+ "failed to clear own-thread");
+ goto out;
+ }
+ /*
+ * With strong authentication, we can afford to allow
+ * privileged operations over TCP.
+ */
+ gd_inet_programs[1] = &gd_svc_cli_prog;
+ /*
+ * This is the only place where we want secure_srvr to reflect
+ * the management-plane setting.
+ */
+ this->ctx->secure_srvr = MGMT_SSL_ALWAYS;
+ }
+
/*
- * only one (atmost a pair - rdma and socket) listener for
+ * only one (at most a pair - rdma and socket) listener for
* glusterd1_mop_prog, gluster_pmap_prog and gluster_handshake_prog.
*/
ret = rpcsvc_create_listeners (rpc, this->options, this->name);
@@ -1352,9 +1378,10 @@ init (xlator_t *this)
}
}
- /* Start a unix domain socket listener just for cli commands
- * This should prevent ports from being wasted by being in TIMED_WAIT
- * when cli commands are done continuously
+ /*
+ * Start a unix domain socket listener just for cli commands This
+ * should prevent ports from being wasted by being in TIMED_WAIT when
+ * cli commands are done continuously
*/
uds_rpc = glusterd_init_uds_listener (this);
if (uds_rpc == NULL) {