diff options
Diffstat (limited to 'xlators')
| -rw-r--r-- | xlators/mgmt/glusterd/src/glusterd.c | 37 | ||||
| -rw-r--r-- | xlators/protocol/server/src/server.c | 6 |
2 files changed, 38 insertions, 5 deletions
diff --git a/xlators/mgmt/glusterd/src/glusterd.c b/xlators/mgmt/glusterd/src/glusterd.c index 3e8a3e2e17a..adf58cc7dde 100644 --- a/xlators/mgmt/glusterd/src/glusterd.c +++ b/xlators/mgmt/glusterd/src/glusterd.c @@ -68,7 +68,7 @@ rpcsvc_cbk_program_t glusterd_cbk_prog = { struct rpcsvc_program *gd_inet_programs[] = { &gd_svc_peer_prog, - &gd_svc_cli_trusted_progs, + &gd_svc_cli_trusted_progs, /* Must be index 1 for secure_mgmt! */ &gd_svc_mgmt_prog, &gd_svc_mgmt_v3_prog, &gluster_pmap_prog, @@ -1327,8 +1327,34 @@ init (xlator_t *this) goto out; } + if (this->ctx->secure_mgmt) { + /* + * The socket code will turn on SSL based on the same check, + * but that will by default turn on own-thread as well and + * we're not multi-threaded enough to handle that. Thus, we + * override the value here. + */ + ret = dict_set_str (this->options, + "transport.socket.own-thread", "off"); + if (ret != 0) { + gf_log (this->name, GF_LOG_ERROR, + "failed to clear own-thread"); + goto out; + } + /* + * With strong authentication, we can afford to allow + * privileged operations over TCP. + */ + gd_inet_programs[1] = &gd_svc_cli_prog; + /* + * This is the only place where we want secure_srvr to reflect + * the management-plane setting. + */ + this->ctx->secure_srvr = MGMT_SSL_ALWAYS; + } + /* - * only one (atmost a pair - rdma and socket) listener for + * only one (at most a pair - rdma and socket) listener for * glusterd1_mop_prog, gluster_pmap_prog and gluster_handshake_prog. */ ret = rpcsvc_create_listeners (rpc, this->options, this->name); @@ -1352,9 +1378,10 @@ init (xlator_t *this) } } - /* Start a unix domain socket listener just for cli commands - * This should prevent ports from being wasted by being in TIMED_WAIT - * when cli commands are done continuously + /* + * Start a unix domain socket listener just for cli commands This + * should prevent ports from being wasted by being in TIMED_WAIT when + * cli commands are done continuously */ uds_rpc = glusterd_init_uds_listener (this); if (uds_rpc == NULL) { diff --git a/xlators/protocol/server/src/server.c b/xlators/protocol/server/src/server.c index 3de856e8e09..6c4f81067cb 100644 --- a/xlators/protocol/server/src/server.c +++ b/xlators/protocol/server/src/server.c @@ -913,6 +913,12 @@ init (xlator_t *this) goto out; } + /* + * This is the only place where we want secure_srvr to reflect + * the data-plane setting. + */ + this->ctx->secure_srvr = MGMT_SSL_COPY_IO; + ret = rpcsvc_create_listeners (conf->rpc, this->options, this->name); if (ret < 1) { |