From 0bd58241143e91b683a3e5c4335aabf9eed537fe Mon Sep 17 00:00:00 2001 From: Atin Mukherjee Date: Mon, 20 Mar 2017 05:15:25 +0530 Subject: protocol : fix auth-allow regression One of the brick multiplexing patches (commit 1a95fc3) had some changes in gf_auth () & server_setvolume () functions which caused auth-allow feature to be broken. mount doesn't succeed even if it's part of the auth-allow list. This fix does the following: 1. Reintroduce the peer-info data back in gf_auth () so that fnmatch has valid input and it can decide on the result. 2. config-params dict should capture key values pairs for all the bricks in case brick multiplexing is on. In case brick multiplexing isn't enabled, then config-params should carry attributes from protocol/server such that all rpc auth related attributes stay in tact in the dictionary. Change-Id: I007c4c6d78620a896b8858a29459a77de8b52412 BUG: 1433815 Signed-off-by: Atin Mukherjee Reviewed-on: https://review.gluster.org/16920 Tested-by: Jeff Darcy Smoke: Gluster Build System NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Jeff Darcy Reviewed-by: MOHIT AGRAWAL --- tests/bugs/protocol/bug-1433815-auth-allow.t | 39 ++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 tests/bugs/protocol/bug-1433815-auth-allow.t (limited to 'tests/bugs') diff --git a/tests/bugs/protocol/bug-1433815-auth-allow.t b/tests/bugs/protocol/bug-1433815-auth-allow.t new file mode 100644 index 00000000000..fa22ad8afd5 --- /dev/null +++ b/tests/bugs/protocol/bug-1433815-auth-allow.t @@ -0,0 +1,39 @@ +#!/bin/bash + +. $(dirname $0)/../../include.rc +. $(dirname $0)/../../volume.rc + +check_mounted () { + df | grep $1 | wc -l +} + +get_addresses () { + ip addr | sed -n '/.*inet \([0-9.]*\).*/s//\1/p' | tr '\n' ',' +} + +TEST glusterd +TEST $CLI volume create $V0 $H0:$B0/$V0 + +# Set auth.allow so it *doesn't* include ourselves. +TEST $CLI volume set $V0 auth.allow 1.2.3.4 +TEST $CLI volume start $V0 + +# "System getspec" will include the username and password if the request comes +# from a server (which we are). Unfortunately, this will cause authentication +# to succeed in auth.login regardless of whether auth.addr is working properly +# or not, which is useless to us. To get a proper test, strip out those lines. +$CLI system getspec $V0 | sed -e /username/d -e /password/d > fubar.vol + +# This mount should fail because auth.allow doesn't include us. +TEST $GFS -f fubar.vol $M0 +# If we had DONT_EXPECT_WITHIN we could use that, but we don't. +sleep 10 +EXPECT 0 check_mounted $M0 + +# Set auth.allow to include us. This mount should therefore succeed. +TEST $CLI volume set $V0 auth.allow "$(get_addresses)" +TEST $GFS -f fubar.vol $M0 +sleep 10 +EXPECT 1 check_mounted $M0 + +cleanup -- cgit