From caa8a4ea50734378e7e19f70b39a837c58e9d229 Mon Sep 17 00:00:00 2001 From: Jeff Darcy Date: Thu, 17 Apr 2014 23:21:05 +0000 Subject: rpc/auth: allow SSL identity to be used for authorization Access to a volume is now controlled by the following options, based on whether SSL is enabled or not. * server.ssl-allow: get identity from certificate, no password needed * auth.allow: get identity and matching password from command line It is not possible to allow both simultaneously, since the connection itself is either using SSL or it isn't. Change-Id: I5a5be66520f56778563d62f4b3ab35c66cc41ac0 BUG: 1114604 Signed-off-by: Jeff Darcy Reviewed-on: http://review.gluster.org/3695 Tested-by: Gluster Build System Reviewed-by: Vijay Bellur --- xlators/mgmt/glusterd/src/glusterd-volgen.c | 10 ++++++++++ xlators/mgmt/glusterd/src/glusterd-volume-set.c | 6 ++++++ 2 files changed, 16 insertions(+) (limited to 'xlators/mgmt') diff --git a/xlators/mgmt/glusterd/src/glusterd-volgen.c b/xlators/mgmt/glusterd/src/glusterd-volgen.c index 664c37af9d6..777e69535df 100644 --- a/xlators/mgmt/glusterd/src/glusterd-volgen.c +++ b/xlators/mgmt/glusterd/src/glusterd-volgen.c @@ -1517,6 +1517,7 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo, gf_boolean_t quota_enabled = _gf_true; gf_boolean_t pgfid_feat = _gf_false; char *value = NULL; + char *ssl_user = NULL; brickinfo = param; path = brickinfo->path; @@ -1816,6 +1817,15 @@ server_graph_builder (volgen_graph_t *graph, glusterd_volinfo_t *volinfo, return -1; } + if (dict_get_str (volinfo->dict, "auth.ssl-allow", &ssl_user) == 0) { + memset (key, 0, sizeof (key)); + snprintf (key, sizeof (key), "auth.login.%s.ssl-allow", path); + + ret = xlator_set_option (xl, key, ssl_user); + if (ret) + return -1; + } + ret = volgen_graph_set_options_generic (graph, set_dict, (xlator && loglevel) ? (void *)set_dict : volinfo, (xlator && loglevel) ? &server_spec_extended_option_handler : diff --git a/xlators/mgmt/glusterd/src/glusterd-volume-set.c b/xlators/mgmt/glusterd/src/glusterd-volume-set.c index b1d3fe54f88..4a0a50dfe66 100644 --- a/xlators/mgmt/glusterd/src/glusterd-volume-set.c +++ b/xlators/mgmt/glusterd/src/glusterd-volume-set.c @@ -950,6 +950,12 @@ struct volopt_map_entry glusterd_volopt_map[] = { .type = NO_DOC, .op_version = 2 }, + { .key = "auth.ssl-allow", + .voltype = "protocol/server", + .option = "!ssl-allow", + .type = NO_DOC, + .op_version = GD_OP_VERSION_3_6_0, + }, { .key = "server.manage-gids", .voltype = "protocol/server", .op_version = GD_OP_VERSION_3_6_0, -- cgit