glusterfs.git/rpc/rpc-transport/socket/src, branch release-3.5

socket: disallow CBC cipher modes

2014-10-28T15:49:41+00:00

This is related to CVE-2014-3566 a.k.a. POODLE.

	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566

POODLE is specific to CBC cipher modes in SSLv3.  Because there is no
way to prevent SSLv3 fallback on a system with an unpatched version of
OpenSSL, users of such systems can only be protected by disallowing CBC
modes.  The default cipher-mode specification in our code has been
changed accordingly.  Users can still set their own cipher modes if they
wish.  To support them, the ssl-authz.t test script provides an example
of how to combine the CBC exclusion with other criteria in a script.

Cherry picked from commit 378a0a19d95e552220d71b13be685f4772c576cd:
> Change-Id: Ib1fa547082fbb7de9df94ffd182b1800d6e354e5
> BUG: 1155328
> Signed-off-by: Jeff Darcy 
> Reviewed-on: http://review.gluster.org/8962
> Tested-by: Gluster Build System 
> Reviewed-by: Kaleb KEITHLEY 
> Reviewed-by: Vijay Bellur 

ssl-auth.t has been modified to not set the auth.ssl-allow option. This
option is not available in the 3.5 branch.

Change-Id: Ib1fa547082fbb7de9df94ffd182b1800d6e354e5
BUG: 1157661
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8979
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Jeff Darcy 
Tested-by: Gluster Build System

socket: Fixed parsing RPC records containing multi fragments

2014-09-25T11:28:17+00:00

In __socket_proto_state_machine(), when parsing RPC records containing
multi fragments, just change the state of parsing process, had not
processed the memory to coalesce the multi fragments.

Cherry picked from commit fb6702b7f8ba19333b7ba4af543d908e3f5e1923:
> Change-Id: I5583e578603bd7290814a5d26885b31759c73115
> BUG: 1139598
> Signed-off-by: Gu Feng 
> Reviewed-on: http://review.gluster.org/8662
> Tested-by: Gluster Build System 
> Reviewed-by: Niels de Vos 
> Reviewed-by: Raghavendra G 
> Tested-by: Raghavendra G 

Change-Id: I5583e578603bd7290814a5d26885b31759c73115
BUG: 1136221
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8848
Tested-by: Gluster Build System

mgmt/glusterd: make sure quota enforcer has established connection with quotad before marking quota as enabled.

2014-01-29T06:46:35+00:00

without this patch there is a window of time when quota is marked as
enabled in quota-enforcer, but connection to quotad wouldn't have been
established. Any checklimit done during this period can result in a
failed fop because of unavailability of quotad.

Change-Id: I0d509fabc434dd55ce9ec59157123524197fcc80
Signed-off-by: Raghavendra G 
BUG: 969461
Signed-off-by: Raghavendra G 
Reviewed-on: http://review.gluster.org/6572
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur 
Reviewed-on: http://review.gluster.org/6820

socket: limit vector count to IOV_MAX

2013-11-26T18:31:04+00:00

IOV_MAX is the maximum supported vector count on a given platform.
Limit the count to IOV_MAX if higher. As we are performing non-blocking
IO getting a smaller return value is handled naturally.

Change-Id: I94ef67a03ed0e10da67a776af2b55506bf721611
BUG: 1034398
Signed-off-by: Anand Avati 
Reviewed-on: http://review.gluster.org/6354
Tested-by: Gluster Build System 
Reviewed-by: Amar Tumballi

rpcsvc: implement per-client RPC throttling

2013-10-28T07:33:19+00:00

Implement a limit on the total number of outstanding RPC requests
from a given cient. Once the limit is reached the client socket
is removed from POLL-IN event polling.

Change-Id: I8071b8c89b78d02e830e6af5a540308199d6bdcd
BUG: 1008301
Signed-off-by: Anand Avati 
Reviewed-on: http://review.gluster.org/6114
Reviewed-by: Santosh Pradhan 
Reviewed-by: Rajesh Joseph 
Reviewed-by: Harshavardhana 
Reviewed-by: Vijay Bellur 
Tested-by: Gluster Build System

transport/socket: don't try to set TCP_DELAY on unix domain sockets

2013-10-12T07:42:12+00:00

Change-Id: I290cd983bd0dff2e32e5ee90a12e888a3b31c6fd
BUG: 969461
Signed-off-by: Raghavendra G 
Reviewed-on: http://review.gluster.org/5954
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

core: block unused signals in created threads

2013-09-25T08:33:16+00:00

Block all signal except those which are set for explicit handling
in glusterfs_signals_setup(). Since thread spawning code in
libglusterfs and xlators can get called from application threads
when used through libgfapi, it is necessary to do this blocking.

Change-Id: Ia320f80521a83d2edcda50b9ad414583a0175281
BUG: 1011662
Signed-off-by: Anand Avati 
Reviewed-on: http://review.gluster.org/5995
Tested-by: Gluster Build System 
Reviewed-by: Amar Tumballi 
Reviewed-by: Vijay Bellur

glusterfsd: Round robin DNS should not be relied upon with

2013-09-06T22:56:34+00:00

config service availability for clients.

Backupvolfile server as it stands is slow and prone to errors
with mount script and its combination with RRDNS. Instead in
theory it should use all the available nodes in 'trusted pool'
by default (Right now we don't have a mechanism in place for
this)

Nevertheless this patch provides a scenario where a list of
volfile-server can be provided on command as shown below

-----------------------------------------------------------------
$ glusterfs -s server1 .. -s serverN --volfile-id= \
      
-----------------------------------------------------------------
                   OR
-----------------------------------------------------------------
$ mount -t glusterfs -obackup-volfile-servers=: \
      :...: :/ 
-----------------------------------------------------------------

Here ':' is used as a separator for mount script parsing

Now these will be remembered and recursively attempted for
fetching vol-file until exhausted. This would ensure that the
clients get 'volume' configs in a consistent manner avoiding the
need to poll through RRDNS.

Change-Id: If808bb8a52e6034c61574cdae3ac4e7e83513a40
BUG: 986429
Signed-off-by: Harshavardhana 
Reviewed-on: http://review.gluster.org/5400
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

mgmt/glusterd, socket: Change logging for brick disconnects

2013-06-11T14:52:16+00:00

For unix path based sockets, the socket path is
cryptic (md5sum of path) and may not be useful for
the user in debugging so log it in DEBUG.

Changed logging in brick_rpc_notify to log brickinfo
for disconnects.

Change-Id: I69174bbbbde8352d38837723e950ad8fc15232aa
BUG: 963153
Signed-off-by: Pranith Kumar K 
Reviewed-on: http://review.gluster.org/5009
Reviewed-by: Niels de Vos 
Reviewed-by: Krishnan Parthasarathi 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

transport/socket: fix connect/disconnect races

2013-06-04T22:37:54+00:00

We might receive a connect request while a disconnect is still in
progress, requiring more states and (the return of) poller generation
numbers to avoid redundant pollers.  We might also get either kind of
request from within our own rpc_transport_notify upcall, so we have to
avoid locking and use the PLEASE_DIE state instead.

Change-Id: Icbaacf96c516b607a79ff62c90b74d42b241780f
BUG: 970194
Signed-off-by: Jeff Darcy 
Reviewed-on: http://review.gluster.org/5137
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati