glusterfs.git/rpc/rpc-lib/src/rpcsvc-auth.c, branch v3.7.16

rpc: fix binding brick issue while bind-insecure is enabled

2015-07-27T04:31:56+00:00

This patch is backport of http://review.gluster.org/#/c/11512/

> problem:

> When bind-insecure is turned on (which is the default now), it may happen
> that brick is not able to bind to port assigned by Glusterd for example
> 49192-49195...
>
> It seems to occur because the rpc_clnt connections are binding to ports in
> the same range. so brick fails to bind to a port which is already used by
> someone else
>
> solution:
>
> fix for now is to  make rpc_clnt to get port numbers from 65535 in a
> descending
> order, as a result port clash is minimized
>
> other fixes:
>
> previously rdma binds to port >= 1024 if it cannot find a free port < 1024,
> even when bind insecure was turned off(ref to commit '0e3fd04e'), this patch
> add's a check for bind-insecure in gf_rdma_client_bind function
>
> This patch also re-enable bind-insecure and allow insecure by default
> which was reverted (ref: commit cef1720) previously

> Change-Id: Ia1cfa93c5454e2ae0ff57813689b75de282ebd07
> BUG: 1238661
> Signed-off-by: Prasanna Kumar Kalever 

Change-Id: Iea55f9b2a57b5e24d3df2c5fafae12fe99e9dee0
BUG: 1246481
Signed-off-by: Prasanna Kumar Kalever 
Reviewed-on: http://review.gluster.org/11758
Tested-by: NetBSD Build System 
Tested-by: Gluster Build System 
Reviewed-by: Raghavendra G

Revert "rpc: By default set allow-insecure, bind-insecure to on"

2015-07-02T15:46:13+00:00

This reverts commit 243a5b429f225acb8e7132264fe0a0835ff013d5.

This patch introduced a regression where client no longer binds to 
privileged port. This is causing lots of regressions. Hence reverting 
this patch for now and will be resent after suitable modifications.

Change-Id: I302252fd3832b0a5a03b04e30cfa0def37597404
Reviewed-on: http://review.gluster.org/11508
Reviewed-by: Raghavendra G 
Tested-by: Raghavendra G

rpc: By default set allow-insecure, bind-insecure to on

2015-07-01T06:59:51+00:00

        Backport of http://review.gluster.org/11039

since we now use SSL (Secure Sockets Layer) for the security issues, the patch
changes the default setting to allow connections/requests from non-privilaged
ports by setting allow-insecure and bind-insecure to 1

Also added bind functionality for insecure binding which can select from
available local ports dynamically

BUG: 1232660
Change-Id: I927e112223f33611452093e38cd846a0b9347e57
Signed-off-by: Pranith Kumar K 
Signed-off-by: Prasanna Kumar Kalever 
Reviewed-on: http://review.gluster.org/11274
Tested-by: NetBSD Build System 
Tested-by: Gluster Build System 
Reviewed-by: Raghavendra G

rpc-lib: Fixing the coverity issues

2015-04-10T11:29:42+00:00

Coverity CIDs:
1210973
1124887
1124888
1124682
1124849
1124503

Change-Id: I012f6cf9d14753f572ab94aae6d442d1ef8df79a
BUG: 789278
Signed-off-by: Nandaja Varma 
Reviewed-on: http://review.gluster.org/9600
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

rpc/auth: Avoid NULL dereference in rpcsvc_auth_request_init()

2014-01-09T04:42:15+00:00

Code section is bogus!
------------------------------------------
370:       if (!auth->authops->request_init)
371:              ret = auth->authops->request_init (req, auth->authprivate);
------------------------------------------

Seems to have been never been used historically since
logically above code has never been true to actually execute
"authops->request_init() --> auth_glusterfs_{v2,}_request_init()"

On top of that under "rpcsvc_request_init()"
verf.flavour and verf.datalen are initialized from what is
provided through 'callmsg'.
------------------------------------------
        req->verf.flavour = rpc_call_verf_flavour (callmsg);
        req->verf.datalen = rpc_call_verf_len (callmsg);

        /* AUTH */
        rpcsvc_auth_request_init (req);
        return req;
------------------------------------------

So the code in 'auth_glusterfs_{v2,}_request_init()'
performing this operation will over-write the original
flavour and datalen.

------------------------------------------
      if (!req)
                return -1;
        memset (req->verf.authdata, 0, GF_MAX_AUTH_BYTES);
        req->verf.datalen = 0;
        req->verf.flavour = AUTH_NULL;
------------------------------------------

Refactoring the whole code into a more understandable version
and also avoiding a potential NULL dereference

Change-Id: I1a430fcb4d26de8de219bd0cb3c46c141649d47d
BUG: 1049735
Signed-off-by: Harshavardhana 
Reviewed-on: http://review.gluster.org/6591
Reviewed-by: Santosh Pradhan 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

rpc/server: add anonuid and anongid options for root-squash

2013-12-31T03:49:43+00:00

Introduce new options to modify the behaviour of server.root-squash.
With server.anonuid and server.anongid the uid/gid can be specified and
the root user (uid=0 and gid=0) will be mapped to the given uid/gid
instead of nfsnobody (uid=65534 and gid=65534).

Many thanks to Vikhyat Umrao for writing the majority of the test-case!

Change-Id: I6379a3d2ef52b9b9707f2f6f0529657580c8d779
BUG: 1043886
CC: Vikhyat Umrao 
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/6546
Reviewed-by: Santosh Pradhan 
Reviewed-by: Vikhyat Umrao 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

gNFS: RFE for NFS connection behavior

2013-11-15T00:07:02+00:00

Implement reconfigure() for NFS xlator so that volume set/reset wont
restart the NFS server process. But few options can not be reconfigured
dynamically e.g. nfs.mem-factor, nfs.port etc which needs NFS to be
restarted.

Change-Id: Ic586fd55b7933c0a3175708d8c41ed0475d74a1c
BUG: 1027409
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6236
Tested-by: Gluster Build System 
Reviewed-by: Rajesh Joseph 
Reviewed-by: Anand Avati

rpcsvc: allocate large auxgid list on demand

2013-09-17T18:44:21+00:00

For rpc requests having large aux group list, allocate large list
on demand. Else use small static array by default.

Without this patch, glusterfsd allocates 140+MB of resident memory
just to get started and initialized.

Change-Id: I3a07212b0076079cff67cdde18926e8f3b196258
Signed-off-by: Anand Avati 
BUG: 953694
Reviewed-on: http://review.gluster.org/5927
Tested-by: Gluster Build System 
Reviewed-by: Amar Tumballi

rpc/nfs: cleanup legacy code of general options

2013-04-02T23:05:24+00:00

Removing the code which handles "general" options.
Since it is no longer possible to set general options which
apply for all volumes by default, this was redundant.

This cleanup of general options code also solves a bug wherein
with nfs.addr-namelookup on, nfs.rpc-auth-reject wouldn't work
on ip addresses

Change-Id: Iba066e32f9a0255287c322ef85ad1d04b325d739
BUG: 921072
Signed-off-by: Rajesh Amaravathi 
Reviewed-on: http://review.gluster.org/4691
Tested-by: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Jeff Darcy

rpc: disable root-squash dynamically upon volume set command

2013-04-01T09:29:39+00:00

Change-Id: I2ba9ca339ffbe07cb74833165a46a941225b623d
BUG: 927616
Signed-off-by: Raghavendra Bhat 
Reviewed-on: http://review.gluster.org/4722
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur