glusterfs.git/tests, branch v3.5.3beta2

socket: disallow CBC cipher modes

2014-10-28T15:49:41+00:00

This is related to CVE-2014-3566 a.k.a. POODLE.

	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3566

POODLE is specific to CBC cipher modes in SSLv3.  Because there is no
way to prevent SSLv3 fallback on a system with an unpatched version of
OpenSSL, users of such systems can only be protected by disallowing CBC
modes.  The default cipher-mode specification in our code has been
changed accordingly.  Users can still set their own cipher modes if they
wish.  To support them, the ssl-authz.t test script provides an example
of how to combine the CBC exclusion with other criteria in a script.

Cherry picked from commit 378a0a19d95e552220d71b13be685f4772c576cd:
> Change-Id: Ib1fa547082fbb7de9df94ffd182b1800d6e354e5
> BUG: 1155328
> Signed-off-by: Jeff Darcy 
> Reviewed-on: http://review.gluster.org/8962
> Tested-by: Gluster Build System 
> Reviewed-by: Kaleb KEITHLEY 
> Reviewed-by: Vijay Bellur 

ssl-auth.t has been modified to not set the auth.ssl-allow option. This
option is not available in the 3.5 branch.

Change-Id: Ib1fa547082fbb7de9df94ffd182b1800d6e354e5
BUG: 1157661
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8979
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Jeff Darcy 
Tested-by: Gluster Build System

glusterd/quota: Heal pgfid xattr on existing data when the quota is

2014-10-20T16:13:34+00:00

enable

        Backport of: http://review.gluster.org/8878

The pgfid extended attributes are used to construct the ancestry path
(from the file to the volume root) for nameless lookups on files.
As NFS relies on nameless lookups heavily, quota enforcement through NFS
would be inconsistent if quota were to be enabled on a volume with
existing data.

Solution is to heal the pgfid extended attributes as a part of lookup
perfomed by quota-crawl process. In a posix lookup check for pgfid xattr
and if it is missing set the xattr.

Change-Id: I956128907aa1d975cd5719ed3ab2f4f9b37d4c31
BUG: 1153900
Signed-off-by: vmallika 
Signed-off-by: Krutika Dhananjay 
Reviewed-on: http://review.gluster.org/8938
Tested-by: Gluster Build System 
Reviewed-by: Niels de Vos

mount/fuse: Handle fd resolution failures

2014-10-01T10:44:28+00:00

        Backport of http://review.gluster.org/8402

Problem:
Even when the fd resolution failed, the fop is continuing on the
new graph which may not have valid inode. This lead to NULL layout
subvols in dht which lead to crash in fsync after graph migration.

Fix:
- Remove resolution error handling in FUSE_FOP as it was only added
  to handle fd migration failures.
- check in fuse_resolve_done for fd resolution failures and fail the
  fop right away.
- loc resolution failures are already handled in the corresponding
  fops.
- Return errno from state->resolve.op_errno in resume functions.
- Send error to fuse on frame allocation failures.
- Removed unused variable state->resolved
- Removed unused macro FUSE_FOP_COOKIE

BUG: 1136835
Change-Id: I5074f7a9b177c54051ef37a4f73de7f8d1fcc5b7
Signed-off-by: Pranith Kumar K 
Reviewed-on: http://review.gluster.org/8595
Tested-by: Gluster Build System 
Reviewed-by: Niels de Vos

cluster/dht: Fix dht_access treating directory like files

2014-09-29T10:50:14+00:00

When the cluster topology changes due to add-brick, all sub
volumes of DHT will not contain the directories till a rebalance
is completed. Till the rebalance is run, if a caller bypasses
lookup and calls access due to saved/cached inode information
(like NFS server does) then, dht_access misreads the error
(ESTALE/ENOENT) from the new subvolumes and incorrectly tries
to handle the inode as a file. This results in the directories
in memory state in DHT to be corrupted and not heal even post
a rebalance.

This commit fixes the problem in dht_access thereby preventing
DHT from misrepresenting a directory as a file in the case
presented above.

Change-Id: Idcdaa3837db71c8fe0a40ec0084a6c3dbe27e772
BUG: 1140338
Signed-off-by: Shyam 
Reviewed-on: http://review.gluster.org/8462
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur 
(cherry picked from commit 6630fff4812f4e8617336b98d8e3ac35976e5990)
Signed-off-by: Nithya Balachandran 
Reviewed-on: http://review.gluster.org/8721
Reviewed-by: Niels de Vos

dht: fix rename race

2014-09-17T15:33:52+00:00

If two clients try to rename the same file at the same time, we
sometimes end up with *no file at all* in either the old or new
location.  That's kind of bad.  The culprit seems to be some overly
aggressive cleanup code.  AFAICT, based on today's study of the code,
the intent of the changed section is to remove any linkfile we might
have created before the actual rename.  However, what we're removing
might not be our extra link.  If we're racing with another client that's
also doing a rename, it might be the only remaining link to the user's
data.  The solution, which is good enough to pass this test but almost
certainly still not complete, is to be more selective about when we do
this unlink.  Now, we only do it if we know that, at some point, we did
in fact create the link without error (notably ENOENT on the source or
EEXIST on the destination) ourselves.

Change-Id: I8d8cce150b6f8b372c9fb813c90be58d69f8eb7b
BUG: 1129527
Signed-off-by: Jeff Darcy 
Reviewed-on: http://review.gluster.org/8269
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur 
(cherry picked from commit 950f9d8abe714708ca62b86f304e7417127e1132)
Signed-off-by: Nithya Balachandran 
Reviewed-on: http://review.gluster.org/8714

nfs: prevent assertion error with MOUNT over UDP

2014-07-10T07:15:18+00:00

The MOUNT service over UDP runs in a separate thread. This thread does
not have the correct *THIS xlator set. *THIS points to the global (base)
xlator structure, but GF_CALLOC() requires it to be the NFS-xlator so
that assertions can get validated correctly.

This is solved by passing the NFS-xlator to the pthread function, and
setting the *THIS pointer explicitly in the new thread.

It seems that on occasion (needs further investigation) MOUNT over UDP
does not unregister itself. There can also be issues when the kernel NLM
implementation has been registered at portmap/rpcbind, so adding some
unregister procedures in the cleanup of the test-cases.

Cherry picked from commit ec74ceedaa41047b88d270c00eeb071b73e19664:
> Change-Id: I3be5a420fc800bbcc14198d0b6faf4cf2c7300b1
> BUG: 1116503
> Signed-off-by: Niels de Vos 
> Reviewed-on: http://review.gluster.org/8241
> Reviewed-by: Santosh Pradhan 
> Tested-by: Gluster Build System 
> Reviewed-by: Vijay Bellur 

Change-Id: I3be5a420fc800bbcc14198d0b6faf4cf2c7300b1
BUG: 1116997
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8258
Tested-by: Gluster Build System 
Reviewed-by: Kaleb KEITHLEY 
Reviewed-by: Santosh Pradhan

features/gfid-access: Fix entry operations

2014-07-08T08:13:15+00:00

        Backport of http://review.gluster.org/8204

Problem:
When more than one aux-mounts are performing rmdir .gfid//dir
simultaneously, then sometimes a hang is observed.  In gfid-access xlator When
virtual parent/inode are replaced with real parent/inode in loc, virtual
pargfid/gfid are not replaced with real pargfid/gfid respectively. Afr is using
parent_loc->gfids to order the entry locks. But parent_loc->gfid contains
random/virtual gfid generated by gfid-access xlator. Entrylk in client xlator
is using loc->inod->gfid for sending entrylk which has 'real' gfid. Because the
ordering is happening based on random gfids, One mount orders the locks as (L1,
L2) where as the other orders them as (L2, L1) leading to a dead-lock thus
a hang.

Fix:
Replace virtual pargfid/gfid with real pargfid/gfid when virtual-inodes are
replaced with real-inodes in loc.

BUG: 1114501
Change-Id: I13016de1da11762e0697792d76e6e946d991c0a4
Signed-off-by: Pranith Kumar K 
Reviewed-on: http://review.gluster.org/8251
Reviewed-by: Kotresh HR 
Tested-by: Gluster Build System 
Reviewed-by: Niels de Vos

features/gfid-access: Fix inode leaks and loc path corruption

2014-07-08T08:11:50+00:00

        Backport of http://review.gluster.org/8009
        Backport of http://review.gluster.org/8163

BUG: 1112659
Change-Id: Ic70a3ddfcfef88909c12ca6791a8e20c3fee2eae
Signed-off-by: Pranith Kumar K 
Reviewed-on: http://review.gluster.org/8250
Reviewed-by: Kotresh HR 
Tested-by: Gluster Build System 
Reviewed-by: Niels de Vos

tests: support regex in EXPECT constructs

2014-07-04T07:44:00+00:00

            Backport of http://review.gluster.org/6788

Instead of just strings, provide the ability to specify a regex
of the pattern to expect

Change-Id: I288db2290612accd795c3498f74e8b70bab21f2c
BUG: 1115369
Signed-off-by: Pranith Kumar K 
Reviewed-on: http://review.gluster.org/8235
Reviewed-by: Ravishankar N 
Reviewed-by: Niels de Vos 
Tested-by: Gluster Build System

gNFS: Support wildcard in RPC auth allow/reject

2014-07-02T11:28:21+00:00

RFE: Support wildcard in "nfs.rpc-auth-allow" and
"nfs.rpc-auth-reject". e.g.
  *.redhat.com
  192.168.1[1-5].*
  192.168.1[1-5].*, *.redhat.com, 192.168.21.9

  Along with wildcard, support for subnetwork or IP range e.g.
  192.168.10.23/24

The option will be validated for following categories:
1) Anonymous i.e. "*"
2) Wildcard pattern i.e. string containing any ('*', '?', '[')
3) IPv4 address
4) IPv6 address
5) FQDN
6) subnetwork or IPv4 range

Currently this does not support IPv6 subnetwork.

Cherry-picked from 00e247ee44067f2b3e7ca5f7e6dc2f7934c97181:
> Change-Id: Iac8caf5e490c8174d61111dad47fd547d4f67bf4
> BUG: 1086097
> Signed-off-by: Santosh Kumar Pradhan 
> Reviewed-on: http://review.gluster.org/7485
> Reviewed-by: Poornima G 
> Reviewed-by: Harshavardhana 
> Tested-by: Gluster Build System 
> Reviewed-by: Vijay Bellur 

Change-Id: I18ef0a914cd403c1f9e66d1b03ecd29465cbce95
BUG: 1115369
Signed-off-by: Niels de Vos 
Reviewed-on: http://review.gluster.org/8223
Tested-by: Gluster Build System 
Reviewed-by: Santosh Pradhan