diff options
| -rw-r--r-- | rpc/rpc-lib/src/rpc-transport.c | 4 | ||||
| -rw-r--r-- | rpc/rpc-lib/src/rpc-transport.h | 1 | ||||
| -rw-r--r-- | rpc/rpc-transport/socket/src/socket.c | 37 | ||||
| -rwxr-xr-x | tests/bugs/bug-873367.t | 1 | ||||
| -rwxr-xr-x | tests/features/ssl-authz.t | 53 | ||||
| -rw-r--r-- | xlators/mgmt/glusterd/src/glusterd-volgen.c | 10 | ||||
| -rw-r--r-- | xlators/mgmt/glusterd/src/glusterd-volume-set.c | 6 | ||||
| -rw-r--r-- | xlators/protocol/auth/login/src/login.c | 78 | ||||
| -rw-r--r-- | xlators/protocol/server/src/server-handshake.c | 7 |
9 files changed, 161 insertions, 36 deletions
diff --git a/rpc/rpc-lib/src/rpc-transport.c b/rpc/rpc-lib/src/rpc-transport.c index c24d4108403..cf7f903056a 100644 --- a/rpc/rpc-lib/src/rpc-transport.c +++ b/rpc/rpc-lib/src/rpc-transport.c @@ -447,6 +447,10 @@ rpc_transport_destroy (rpc_transport_t *this) if (this->dl_handle) dlclose (this->dl_handle); + if (this->ssl_name) { + GF_FREE(this->ssl_name); + } + GF_FREE (this); fail: return ret; diff --git a/rpc/rpc-lib/src/rpc-transport.h b/rpc/rpc-lib/src/rpc-transport.h index 2db9072ae49..117d5e1e8ce 100644 --- a/rpc/rpc-lib/src/rpc-transport.h +++ b/rpc/rpc-lib/src/rpc-transport.h @@ -214,6 +214,7 @@ struct rpc_transport { struct list_head list; int bind_insecure; void *dl_handle; /* handle of dlopen() */ + char *ssl_name; }; struct rpc_transport_ops { diff --git a/rpc/rpc-transport/socket/src/socket.c b/rpc/rpc-transport/socket/src/socket.c index 6d4a862aa8d..8b8b97370de 100644 --- a/rpc/rpc-transport/socket/src/socket.c +++ b/rpc/rpc-transport/socket/src/socket.c @@ -246,7 +246,7 @@ out: #define ssl_read_one(t,b,l) ssl_do((t),(b),(l),(SSL_trinary_func *)SSL_read) #define ssl_write_one(t,b,l) ssl_do((t),(b),(l),(SSL_trinary_func *)SSL_write) -static int +static char * ssl_setup_connection (rpc_transport_t *this, int server) { X509 *peer = NULL; @@ -297,7 +297,7 @@ ssl_setup_connection (rpc_transport_t *this, int server) NID_commonName, peer_CN, sizeof(peer_CN)-1); peer_CN[sizeof(peer_CN)-1] = '\0'; gf_log(this->name,GF_LOG_INFO,"peer CN = %s", peer_CN); - return 0; + return gf_strdup(peer_CN); /* Error paths. */ ssl_error: @@ -307,7 +307,7 @@ free_ssl: SSL_free(priv->ssl_ssl); priv->ssl_ssl = NULL; done: - return ret; + return NULL; } @@ -2262,15 +2262,23 @@ socket_poller (void *ctx) gf_boolean_t to_write = _gf_false; int ret = 0; uint32_t gen = 0; + char *cname = NULL; priv->ot_state = OT_RUNNING; if (priv->use_ssl) { - if (ssl_setup_connection(this,priv->connected) < 0) { + cname = ssl_setup_connection(this,priv->connected); + if (!cname) { gf_log (this->name,GF_LOG_ERROR, "%s setup failed", priv->connected ? "server" : "client"); goto err; } + if (priv->connected) { + this->ssl_name = cname; + } + else { + GF_FREE(cname); + } } if (!priv->bio) { @@ -2450,6 +2458,7 @@ socket_server_event_handler (int fd, int idx, void *data, socklen_t addrlen = sizeof (new_sockaddr); socket_private_t *new_priv = NULL; glusterfs_ctx_t *ctx = NULL; + char *cname = NULL; this = data; GF_VALIDATE_OR_GOTO ("socket", this, out); @@ -2560,7 +2569,8 @@ socket_server_event_handler (int fd, int idx, void *data, new_priv->ssl_ctx = priv->ssl_ctx; if (priv->use_ssl && !priv->own_thread) { - if (ssl_setup_connection(new_trans,1) < 0) { + cname = ssl_setup_connection(new_trans,1); + if (!cname) { gf_log(this->name,GF_LOG_ERROR, "server setup failed"); close(new_sock); @@ -2568,6 +2578,7 @@ socket_server_event_handler (int fd, int idx, void *data, GF_FREE (new_trans); goto unlock; } + this->ssl_name = cname; } if (!priv->bio && !priv->own_thread) { @@ -2634,6 +2645,9 @@ unlock: pthread_mutex_unlock (&priv->lock); out: + if (cname && (cname != this->ssl_name)) { + GF_FREE(cname); + } return ret; } @@ -2694,6 +2708,7 @@ socket_connect (rpc_transport_t *this, int port) gf_boolean_t refd = _gf_false; socket_connect_error_state_t *arg = NULL; pthread_t th_id = {0, }; + char *cname = NULL; GF_VALIDATE_OR_GOTO ("socket", this, err); GF_VALIDATE_OR_GOTO ("socket", this->private, err); @@ -2857,12 +2872,20 @@ socket_connect (rpc_transport_t *this, int port) } if (priv->use_ssl && !priv->own_thread) { - ret = ssl_setup_connection(this,0); - if (ret < 0) { + cname = ssl_setup_connection(this,0); + if (!cname) { + errno = ENOTCONN; + ret = -1; gf_log(this->name,GF_LOG_ERROR, "client setup failed"); goto handler; } + if (priv->connected) { + this->ssl_name = cname; + } + else { + GF_FREE(cname); + } } if (!priv->bio && !priv->own_thread) { diff --git a/tests/bugs/bug-873367.t b/tests/bugs/bug-873367.t index 56c2d30542f..17be3572b2f 100755 --- a/tests/bugs/bug-873367.t +++ b/tests/bugs/bug-873367.t @@ -24,6 +24,7 @@ ln $SSL_CERT $SSL_CA TEST $CLI volume create $V0 $H0:$B0/1 TEST $CLI volume set $V0 server.ssl on TEST $CLI volume set $V0 client.ssl on +TEST $CLI volume set $V0 auth.ssl-allow Anyone TEST $CLI volume start $V0 TEST glusterfs --volfile-server=$H0 --volfile-id=$V0 $M0 diff --git a/tests/features/ssl-authz.t b/tests/features/ssl-authz.t new file mode 100755 index 00000000000..f6c56bcaa53 --- /dev/null +++ b/tests/features/ssl-authz.t @@ -0,0 +1,53 @@ +#!/bin/bash + +. $(dirname $0)/../include.rc + +ping_file () { + echo hello > $1 2> /dev/null +} + +SSL_BASE=/etc/ssl +SSL_KEY=$SSL_BASE/glusterfs.key +SSL_CERT=$SSL_BASE/glusterfs.pem +SSL_CA=$SSL_BASE/glusterfs.ca + +cleanup; +rm -f $SSL_BASE/glusterfs.* +mkdir -p $B0/1 +mkdir -p $M0 + +TEST glusterd +TEST pidof glusterd +TEST $CLI volume info; + +TEST openssl genrsa -out $SSL_KEY 1024 +TEST openssl req -new -x509 -key $SSL_KEY -subj /CN=Anyone -out $SSL_CERT +ln $SSL_CERT $SSL_CA + +TEST $CLI volume create $V0 $H0:$B0/1 +TEST $CLI volume set $V0 server.ssl on +TEST $CLI volume set $V0 client.ssl on +TEST $CLI volume set $V0 auth.ssl-allow Anyone +TEST $CLI volume start $V0 + +# This mount should WORK. +TEST glusterfs --volfile-server=$H0 --volfile-id=$V0 $M0 +TEST ping_file $M0/before +TEST umount $M0 + +# Change the authorized user name. Note that servers don't pick up changes +# automagically like clients do, so we have to stop/start ourselves. +TEST $CLI volume stop $V0 +TEST $CLI volume set $V0 auth.ssl-allow NotYou +TEST $CLI volume start $V0 + +# This mount should FAIL because the identity given by our certificate does not +# match the allowed user. In other words, authentication works (they know who +# we are) but authorization doesn't (we're not the right person). +TEST glusterfs --volfile-server=$H0 --volfile-id=$V0 $M0 + +# Looks like /*/bin/glusterfs isn't returning error status correctly (again). +# Actually try doing something to get a real error. +TEST ! ping_file $M0/after + +cleanup; diff --git a/xlators/mgmt/glusterd/src/glusterd-volgen.c b/xlators/mgmt/glusterd/src/glusterd-volgen.c index 664c37af9d6..777e69535df 100644 --- a/xlators/mgmt/glusterd/src/glusterd-volgen.c +++ b/xlators/mgmt/glusterd/src/glusterd-volgen.c @@ -1517,6 +1517,7 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo, gf_boolean_t quota_enabled = _gf_true; gf_boolean_t pgfid_feat = _gf_false; char *value = NULL; + char *ssl_user = NULL; brickinfo = param; path = brickinfo->path; @@ -1816,6 +1817,15 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo, return -1; } + if (dict_get_str (volinfo->dict, "auth.ssl-allow", &ssl_user) == 0) { + memset (key, 0, sizeof (key)); + snprintf (key, sizeof (key), "auth.login.%s.ssl-allow", path); + + ret = xlator_set_option (xl, key, ssl_user); + if (ret) + return -1; + } + ret = volgen_graph_set_options_generic (graph, set_dict, (xlator && loglevel) ? (void *)set_dict : volinfo, (xlator && loglevel) ? &server_spec_extended_option_handler : diff --git a/xlators/mgmt/glusterd/src/glusterd-volume-set.c b/xlators/mgmt/glusterd/src/glusterd-volume-set.c index b1d3fe54f88..4a0a50dfe66 100644 --- a/xlators/mgmt/glusterd/src/glusterd-volume-set.c +++ b/xlators/mgmt/glusterd/src/glusterd-volume-set.c @@ -950,6 +950,12 @@ struct volopt_map_entry glusterd_volopt_map[] = { .type = NO_DOC, .op_version = 2 }, + { .key = "auth.ssl-allow", + .voltype = "protocol/server", + .option = "!ssl-allow", + .type = NO_DOC, + .op_version = GD_OP_VERSION_3_6_0, + }, { .key = "server.manage-gids", .voltype = "protocol/server", .op_version = GD_OP_VERSION_3_6_0, diff --git a/xlators/protocol/auth/login/src/login.c b/xlators/protocol/auth/login/src/login.c index c2f0bf0d0c7..56b93a9f9e9 100644 --- a/xlators/protocol/auth/login/src/login.c +++ b/xlators/protocol/auth/login/src/login.c @@ -19,36 +19,43 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params) { auth_result_t result = AUTH_DONT_CARE; - int ret = 0; - data_t *allow_user = NULL; - data_t *username_data = NULL; - data_t *passwd_data = NULL; - data_t *password_data = NULL; - char *username = NULL; - char *password = NULL; - char *brick_name = NULL; - char *searchstr = NULL; - char *username_str = NULL; - char *tmp = NULL; - char *username_cpy = NULL; - - username_data = dict_get (input_params, "username"); - if (!username_data) { - gf_log ("auth/login", GF_LOG_DEBUG, - "username not found, returning DONT-CARE"); - goto out; + int ret = 0; + data_t *allow_user = NULL; + data_t *username_data = NULL; + data_t *passwd_data = NULL; + data_t *password_data = NULL; + char *username = NULL; + char *password = NULL; + char *brick_name = NULL; + char *searchstr = NULL; + char *username_str = NULL; + char *tmp = NULL; + char *username_cpy = NULL; + gf_boolean_t using_ssl = _gf_false; + + username_data = dict_get (input_params, "ssl-name"); + if (username_data) { + gf_log ("auth/login", GF_LOG_INFO, + "connecting user name: %s", username_data->data); + using_ssl = _gf_true; + result = AUTH_REJECT; } - - username = data_to_str (username_data); - - password_data = dict_get (input_params, "password"); - if (!password_data) { - gf_log ("auth/login", GF_LOG_WARNING, - "password not found, returning DONT-CARE"); - goto out; + else { + username_data = dict_get (input_params, "username"); + if (!username_data) { + gf_log ("auth/login", GF_LOG_DEBUG, + "username not found, returning DONT-CARE"); + goto out; + } + password_data = dict_get (input_params, "password"); + if (!password_data) { + gf_log ("auth/login", GF_LOG_WARNING, + "password not found, returning DONT-CARE"); + goto out; + } + password = data_to_str (password_data); } - - password = data_to_str (password_data); + username = data_to_str (username_data); brick_name = data_to_str (dict_get (input_params, "remote-subvolume")); if (!brick_name) { @@ -58,7 +65,8 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params) goto out; } - ret = gf_asprintf (&searchstr, "auth.login.%s.allow", brick_name); + ret = gf_asprintf (&searchstr, "auth.login.%s.%s", brick_name, + using_ssl ? "ssl-allow" : "allow"); if (-1 == ret) { gf_log ("auth/login", GF_LOG_WARNING, "asprintf failed while setting search string, " @@ -70,14 +78,26 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params) GF_FREE (searchstr); if (allow_user) { + gf_log ("auth/login", GF_LOG_INFO, + "allowed user names: %s", allow_user->data); username_cpy = gf_strdup (allow_user->data); if (!username_cpy) goto out; username_str = strtok_r (username_cpy, " ,", &tmp); + /* + * We have to match a user's *authenticated* name to one in the + * list. If we're using SSL, they're already authenticated. + * Otherwise, they need a matching password to complete the + * process. + */ while (username_str) { if (!fnmatch (username_str, username, 0)) { + if (using_ssl) { + result = AUTH_ACCEPT; + break; + } ret = gf_asprintf (&searchstr, "auth.login.%s.password", username); diff --git a/xlators/protocol/server/src/server-handshake.c b/xlators/protocol/server/src/server-handshake.c index 6b1a39936f4..98418e77893 100644 --- a/xlators/protocol/server/src/server-handshake.c +++ b/xlators/protocol/server/src/server-handshake.c @@ -450,6 +450,13 @@ server_setvolume (rpcsvc_request_t *req) req->trans->xl_private = client; auth_set_username_passwd (params, config_params, client); + if (req->trans->ssl_name) { + if (dict_set_str(params,"ssl-name",req->trans->ssl_name) != 0) { + gf_log (this->name, GF_LOG_WARNING, + "failed to set ssl_name %s", req->trans->ssl_name); + /* Not fatal, auth will just fail. */ + } + } ret = dict_get_int32 (params, "fops-version", &fop_version); if (ret < 0) { |