glusterfs.git/xlators/storage/posix/src/posix-handle.h, branch v6.5

server: don't allow '/' in basename

2018-11-05T18:50:10+00:00

Server stack needs to have all the sort of validation, assuming
clients can be compromized. It is possible for a compromized
client to send basenames with paths with '/', and with that
create files without permission on server. By sanitizing the basename,
and not allowing anything other than actual directory as the parent
for any entry creation, we can mitigate the effects of clients
not able to exploit the server.

Fixes: CVE-2018-14651

Fixes: bz#1644755
Change-Id: I5dc0da0da2713452ff2b65ac2ddbccf1a267dc20
Signed-off-by: Amar Tumballi

Land clang-format changes

2018-09-12T11:52:48+00:00

Change-Id: I6f5d8140a06f3c1b2d196849299f8d483028d33b

server-protocol: don't allow '../' path in 'name'

2018-09-05T09:23:26+00:00

This will prevent any arbitrary file creation through glusterfs
by modifying the client bits.

Also check for the similar flaw inside posix too, so we prevent any
changes in layers in-between.

Fixes: bz#1625095

Signed-off-by: Amar Tumballi 
Change-Id: Id9fe0ef6e86459e8ed85ab947d977f058c5ae06e

posix/ctime: posix hooks to get consistent time xattr

2018-05-06T01:36:53+00:00

This patch uses the ctime posix APIs to get consistent
time across replica. The time attributes are got from
from inode context or from on disk if not found and
merged with iatt to be returned.

Credits: Rafi KC 
Updates: #208
Change-Id: Id737038ce52468f1f5ebc8a42cbf9c6ffbd63850
Signed-off-by: Kotresh HR

posix: reserve option behavior is not correct while using fallocate

2018-04-11T07:03:27+00:00

Problem: storage.reserve option is not working correctly while
         disk space is allocate throguh fallocate

Solution: In posix_disk_space_check_thread_proc after every 5 sec interval
          it calls posix_disk_space_check to monitor disk space and set the
          flag in posix priv.In 5 sec timestamp user can create big file with
          fallocate that can reach posix reserve limit and no error is shown on
          terminal even limit has reached.
          To resolve the same call posix_disk_space for every fallocate fop
          instead to call by a thread after 5 second

BUG: 1560411
Signed-off-by: Mohit Agrawal 
Change-Id: I39ba9390e2e6d084eedbf3bcf45cd6d708591577

cluster/dht: avoid overwriting client writes during migration

2018-02-02T15:24:38+00:00

For more details on this issue see
https://github.com/gluster/glusterfs/issues/308

Solution:
This is a restrictive solution where a file will not be migrated
if a client writes to it during the migration. This does not
check if the writes from the rebalance and the client actually
do overlap.

If dht_writev_cbk finds that the file is being migrated (PHASE1)
it will set an xattr on the destination file indicating the file
was updated by a non-rebalance client.
Rebalance checks if any other client has written to the dst file
and aborts the file migration if it finds the xattr.

updates gluster/glusterfs#308

Change-Id: I73aec28bc9dbb8da57c7425ec88c6b6af0fbc9dd
Signed-off-by: Susant Palai 
Signed-off-by: Raghavendra G 
Signed-off-by: N Balachandran

posix: Reorganize posix xlator to prepare for reuse with rio

2017-12-02T18:56:19+00:00

1. Split out entry and inode/fd based FOPs into
separate files from posix.c
2. Split out common routines (init, fini, reconf,
and such) into its own file, from posix.c
3. Retain just the method assignments in posix.c
(such that posix2 for RIO can assign its own methods in
the future for entry operations and such)
4. Based on the split in (1) and (2) split out
posix-handle.h into 2 files, such that macros that are
needed for inode ops are in one and rest are in the other

If the split is done as above, posix2 can compile with
its own entry ops, and hence not compile, the entry ops
as split in (1) above.

The split described in (4) can again help posix2 to
define its own macros to make entry and inode handles,
thus not impact existing POSIX xlator code.

Noted problems
- There are path references in certain cases where
quota is used (in the xattr FOPs), and thus will fail
on reuse in posix2, this needs to be handled when we
get there.
- posix_init does set root GFID on the brick root,
and this is incorrect for posix2, again will need
handling later when posix2 evolves based on this
code (other init checks seem fine on current inspection)

Merge of experimental branch patches with the following
gerrit change-IDs
> Change-Id: I965ce6dffe70a62c697f790f3438559520e0af20
> Change-Id: I089a4d9cf470c2f9c121611e8ef18dea92b2be70
> Change-Id: I2cec103f6ba8f3084443f3066bcc70b2f5ecb49a

Fixes gluster/glusterfs#327

Change-Id: I0ccfa78559a7c5a68f5e861e144cf856f5c9e19c
Signed-off-by: ShyamsundarR

Coverity Issue: PW.INCLUDE_RECURSION in several files

2017-11-09T13:21:11+00:00

Coverity ID: 407, 408, 409, 410, 411, 412, 413, 414, 415, 416, 417,
418, 419, 423, 424, 425, 426, 427, 428, 429, 436, 437, 438, 439,
440, 441, 442, 443

Issue: Event include_recursion

Removed redundant, recursive includes from the files.

Change-Id: I920776b1fa089a2d4917ca722d0075a9239911a7
BUG: 789278
Signed-off-by: Girjesh Rajoria

cluster/afr: Fix data loss due to race between sh and ongoing write

2015-12-22T08:29:07+00:00

Problem:

When IO is happening on a file and a brick goes down comes back up
during this time, protocol/client translator attempts reopening of the
fd on the gfid handle of the file. But if another client renames this
file while a brick was down && writes were in progress on it, once this
brick is back up, there can be a race between reopening of the fd and
entry self-heal replaying the effect of the rename() on the sink brick.
If the reopening of the fd happens first, the application's writes
continue to go into the data blocks associated with the gfid.
Now entry-self-heal deletes 'src' and creates 'dst' file on the sink,
marking dst as a 'newentry'.  Data self-heal is also completed on 'dst'
as a result and self-heal terminates. If at this point the application
is still writing to this fd, all writes on the file after self-heal
would go into the data blocks associated with this fd, which would be
lost once the fd is closed. The result - the 'dst' file on the source
and sink are not the same and there is no pending heal on the file,
leading to silent corruption on the sink.

Fix:

Leverage http://review.gluster.org/#/c/12816/ to ensure the gfid handle
path gets saved in .glusterfs/unlink until the fd is closed on the file.
During this time, when self-heal sends mknod() with gfid of the file,
do the following:
link() the gfid handle under .glusterfs/unlink to the new path to be
created in mknod() and
rename() the gfid handle to go back under .glusterfs/ab/cd/.

Change-Id: I86ef1f97a76ffe11f32653bb995f575f7648f798
BUG: 1292379
Signed-off-by: Krutika Dhananjay 
Reviewed-on: http://review.gluster.org/13001
Reviewed-by: Pranith Kumar Karampuri 
Tested-by: NetBSD Build System 
Tested-by: Gluster Build System

posix: posix_make_ancestryfromgfid shouldn't log ENOENT

2015-08-13T10:43:51+00:00

posix_make_ancestryfromgfid shouldn't log ENOENT
and it should set proper op_errno

Change-Id: I8a87f30bc04d33cab06c91c74baa9563a1c7b45d
BUG: 1251449
Signed-off-by: vmallika 
Reviewed-on: http://review.gluster.org/11861
Tested-by: NetBSD Build System 
Tested-by: Gluster Build System 
Reviewed-by: Manikandan Selvaganesh 
Reviewed-by: Raghavendra G