From f3ad194918dbbf00dcc9aebb226728294161ed7a Mon Sep 17 00:00:00 2001 From: Kotresh HR Date: Fri, 16 Jan 2015 14:32:09 +0530 Subject: geo-rep: Handle copying of common_secret.pem.pub to slave correctly. Current Behaviour: 1. Geo-replication gsec_create creates common_secret.pem.pub file containing public keys of the all the nodes of master cluster in the location /var/lib/glusterd/ 2. Geo-replication create push-pem copies the common_secret.pem.pub to the same location on all the slave nodes with same name. Problem: Wrong public keys might get copied on to slave nodes in multiple geo-replication sessions simultaneosly. E.g. A geo-rep session is established between Node1(vol1:Master) to Node2 (vol2:Slave). And one more geo-rep session where Node2 (vol3) becomes master to Node3 (vol4) as below. Session1: Node1 (vol1) ---> Node2 (vol2) Session2: Node2 (vol3) ---> Node3 (vol4) If steps followed to create both geo-replication session is as follows, wrong public keys are copied on to Node3 from Node2. 1. gsec_create is done on Node1 (vol1) -Session1 2. gsec_create is done on Node2 (vol3) -Session2 3. create push-pem is done Node1 - Session1. -This overwrites common_secret.pem.pub in Node2 created by gsec_create in second step. 4. create push-pem on Node2 (vol3) copies overwrited common_secret.pem.pub keys to Node3. -Session2 Consequence: Session2 fails to start with Permission denied because of wrong public keys Solution: On geo-rep create push-pem, don't copy common_secret.pem.pub file with same name on to all slave nodes. Prefix master and slave volume names to the filename. NOTE: This brings change in manual steps to be followed to setup non-root geo-replication (mountbroker). To copy ssh public keys, extra two arguments needs to be followed. set_geo_rep_pem_keys.sh \ Path to set_geo_rep_pem_keys.sh: Source Installation: /usr/local/libexec/glusterfs/set_geo_rep_pem_keys.sh Rpm Installatino: /usr/libexec/glusterfs/set_geo_rep_pem_keys.sh Change-Id: If38cd4e6f58d674d5fe2d93da15803c73b660c33 BUG: 1183229 Signed-off-by: Kotresh HR Reviewed-on: http://review.gluster.org/9460 Reviewed-by: Aravinda VK Tested-by: Gluster Build System Reviewed-by: Venky Shankar Tested-by: Venky Shankar --- .../S56glusterd-geo-rep-create-post.sh | 27 ++++++++++++++++++---- geo-replication/src/peer_add_secret_pub.in | 24 ++++++++++++------- geo-replication/src/set_geo_rep_pem_keys.sh | 23 ++++++++++++++---- xlators/mgmt/glusterd/src/glusterd-geo-rep.c | 6 ++--- 4 files changed, 61 insertions(+), 19 deletions(-) diff --git a/extras/hook-scripts/S56glusterd-geo-rep-create-post.sh b/extras/hook-scripts/S56glusterd-geo-rep-create-post.sh index 835daf819c9..8d3734e8097 100755 --- a/extras/hook-scripts/S56glusterd-geo-rep-create-post.sh +++ b/extras/hook-scripts/S56glusterd-geo-rep-create-post.sh @@ -4,6 +4,12 @@ key_val_pair1=`echo $2 | cut -d ',' -f 1` key_val_pair2=`echo $2 | cut -d ',' -f 2` key_val_pair3=`echo $2 | cut -d ',' -f 3` key_val_pair4=`echo $2 | cut -d ',' -f 4` +key_val_pair5=`echo $2 | cut -d ',' -f 5` + +mastervol=`echo $1 | cut -d '=' -f 2` +if [ "$mastervol" == "" ]; then + exit; +fi key=`echo $key_val_pair1 | cut -d '=' -f 1` val=`echo $key_val_pair1 | cut -d '=' -f 2` @@ -22,7 +28,10 @@ fi if [ "$val" == "" ]; then exit; fi + pub_file=`echo $val` +pub_file_bname="$(basename $pub_file)" +pub_file_dname="$(dirname $pub_file)" pub_file_tmp=`echo $val`_tmp key=`echo $key_val_pair3 | cut -d '=' -f 1` @@ -45,17 +54,27 @@ if [ "$val" == "" ]; then fi slave_ip=`echo $val` +key=`echo $key_val_pair5 | cut -d '=' -f 1` +val=`echo $key_val_pair5 | cut -d '=' -f 2` +if [ "$key" != "slave_vol" ]; then + exit; +fi +if [ "$val" == "" ]; then + exit; +fi +slavevol=`echo $val` + if [ -f $pub_file ]; then # For a non-root user copy the pub file to the user's home directory # For a root user copy the pub files to priv_dir->geo-rep. if [ "$slave_user" != "root" ]; then slave_user_home_dir=`ssh $slave_user@$slave_ip "getent passwd $slave_user | cut -d ':' -f 6"` scp $pub_file $slave_user@$slave_ip:$slave_user_home_dir/common_secret.pem.pub_tmp - ssh $slave_user@$slave_ip "mv $slave_user_home_dir/common_secret.pem.pub_tmp $slave_user_home_dir/common_secret.pem.pub" + ssh $slave_user@$slave_ip "mv $slave_user_home_dir/common_secret.pem.pub_tmp $slave_user_home_dir/${mastervol}_${slavevol}_common_secret.pem.pub" else scp $pub_file $slave_ip:$pub_file_tmp - ssh $slave_ip "mv $pub_file_tmp $pub_file" - ssh $slave_ip "gluster system:: copy file /geo-replication/common_secret.pem.pub > /dev/null" - ssh $slave_ip "gluster system:: execute add_secret_pub > /dev/null" + ssh $slave_ip "mv $pub_file_tmp ${pub_file_dname}/${mastervol}_${slavevol}_${pub_file_bname}" + ssh $slave_ip "gluster system:: copy file /geo-replication/${mastervol}_${slavevol}_common_secret.pem.pub > /dev/null" + ssh $slave_ip "gluster system:: execute add_secret_pub root $mastervol $slavevol > /dev/null" fi fi diff --git a/geo-replication/src/peer_add_secret_pub.in b/geo-replication/src/peer_add_secret_pub.in index 97011f204d2..5a9fd9ac347 100644 --- a/geo-replication/src/peer_add_secret_pub.in +++ b/geo-replication/src/peer_add_secret_pub.in @@ -1,18 +1,26 @@ #!/bin/bash -if [ "$1" == "" ]; then - user="root" - home_dir=`getent passwd root | cut -d ':' -f 6`; -else - user=$1 - home_dir=`getent passwd $1 | cut -d ':' -f 6`; -fi +user=$1 +mastervol=$2 +slavevol=$3 if [ "$user" == "" ]; then echo "Invalid User"; exit 1; fi +if [ "$mastervol" == "" ]; then + echo "Invalid master volume"; + exit 1; +fi + +if [ "$slavevol" == "" ]; then + echo "Invalid slave volume"; + exit 1; +fi + +home_dir=`getent passwd $user | cut -d ':' -f 6`; + if [ "$home_dir" == "" ]; then echo "Invalid home dir"; exit 1; @@ -30,4 +38,4 @@ if [ ! -d $home_dir/.ssh/authorized_keys ]; then chown $user: $home_dir/.ssh/authorized_keys; fi -cat "$GLUSTERD_WORKDIR"/geo-replication/common_secret.pem.pub >> $home_dir/.ssh/authorized_keys; +cat "$GLUSTERD_WORKDIR"/geo-replication/${mastervol}_${slavevol}_common_secret.pem.pub >> $home_dir/.ssh/authorized_keys; diff --git a/geo-replication/src/set_geo_rep_pem_keys.sh b/geo-replication/src/set_geo_rep_pem_keys.sh index 7b825693fad..c7cbdf36e4b 100755 --- a/geo-replication/src/set_geo_rep_pem_keys.sh +++ b/geo-replication/src/set_geo_rep_pem_keys.sh @@ -10,11 +10,26 @@ function main() { user=$1 + master_vol=$2 + slave_vol=$3 + if [ "$user" == "" ]; then echo "Please enter the user's name" exit 1; fi + if [ "$master_vol" == "" ]; then + echo "Invalid master volume name" + exit 1; + fi + + if [ "$slave_vol" == "" ]; then + echo "Invalid slave volume name" + exit 1; + fi + + COMMON_SECRET_PEM_PUB=${master_vol}_${slave_vol}_common_secret.pem.pub + if [ "$user" == "root" ]; then echo "This script is not needed for root" exit 1; @@ -27,10 +42,10 @@ function main() exit 1; fi - if [ -f $home_dir/common_secret.pem.pub ]; then - cp $home_dir/common_secret.pem.pub ${GLUSTERD_WORKDIR}/geo-replication/ - gluster system:: copy file /geo-replication/common_secret.pem.pub - gluster system:: execute add_secret_pub $user + if [ -f $home_dir/${COMMON_SECRET_PEM_PUB} ]; then + cp $home_dir/${COMMON_SECRET_PEM_PUB} ${GLUSTERD_WORKDIR}/geo-replication/ + gluster system:: copy file /geo-replication/${COMMON_SECRET_PEM_PUB} + gluster system:: execute add_secret_pub $user ${master_vol} ${slave_vol} else echo "$home_dir/common_secret.pem.pub not present. Please run geo-replication command on master with push-pem option to generate the file" exit 1; diff --git a/xlators/mgmt/glusterd/src/glusterd-geo-rep.c b/xlators/mgmt/glusterd/src/glusterd-geo-rep.c index b48ea6f40fd..f75f7261ca1 100644 --- a/xlators/mgmt/glusterd/src/glusterd-geo-rep.c +++ b/xlators/mgmt/glusterd/src/glusterd-geo-rep.c @@ -5294,9 +5294,9 @@ glusterd_op_gsync_create (dict_t *dict, char **op_errstr, dict_t *rsp_dict) is_pem_push = 0; snprintf(hooks_args, sizeof(hooks_args), - "is_push_pem=%d,pub_file=%s,slave_user=%s,slave_ip=%s", - is_pem_push, common_pem_file, slave_user, slave_ip); - + "is_push_pem=%d,pub_file=%s,slave_user=%s,slave_ip=%s," + "slave_vol=%s", is_pem_push, common_pem_file, + slave_user, slave_ip, slave_vol); } else snprintf(hooks_args, sizeof(hooks_args), "This argument will stop the hooks script"); -- cgit