[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 21/26] rbd: New parameter auth-client-required
From: |
Kevin Wolf |
Subject: |
[Qemu-devel] [PULL 21/26] rbd: New parameter auth-client-required |
Date: |
Fri, 15 Jun 2018 16:21:03 +0200 |
From: Markus Armbruster <address@hidden>
Parameter auth-client-required lets you configure authentication
methods. We tried to provide that in v2.9.0, but backed out due to
interface design doubts (commit 464444fcc16).
This commit is similar to what we backed out, but simpler: we use a
list of enumeration values instead of a list of objects with a member
of enumeration type.
Let's review our reasons for backing out the first try, as stated in
the commit message:
* The implementation uses deprecated rados_conf_set() key
"auth_supported". No biggie.
Fixed: we use "auth-client-required".
* The implementation makes -drive silently ignore invalid parameters
"auth" and "auth-supported.*.X" where X isn't "auth". Fixable (in
fact I'm going to fix similar bugs around parameter server), so
again no biggie.
That fix is commit 2836284db60. This commit doesn't bring the bugs
back.
* BlockdevOptionsRbd member @password-secret applies only to
authentication method cephx. Should it be a variant member of
RbdAuthMethod?
We've had time to ponder, and we decided to stick to the way Ceph
configuration works: the key configured separately, and silently
ignored if the authentication method doesn't use it.
* BlockdevOptionsRbd member @user could apply to both methods cephx
and none, but I'm not sure it's actually used with none. If it
isn't, should it be a variant member of RbdAuthMethod?
Likewise.
* The client offers a *set* of authentication methods, not a list.
Should the methods be optional members of BlockdevOptionsRbd instead
of members of list @auth-supported? The latter begs the question
what multiple entries for the same method mean. Trivial question
now that RbdAuthMethod contains nothing but @type, but less so when
RbdAuthMethod acquires other members, such the ones discussed above.
Again, we decided to stick to the way Ceph configuration works, except
we make auth-client-required a list of enumeration values instead of a
string containing keywords separated by delimiters.
* How BlockdevOptionsRbd member @auth-supported interacts with
settings from a configuration file specified with @conf is
undocumented. I suspect it's untested, too.
Not actually true, the documentation for @conf says "Values in the
configuration file will be overridden by options specified via QAPI",
and we've tested this.
Signed-off-by: Markus Armbruster <address@hidden>
Reviewed-by: Kevin Wolf <address@hidden>
Signed-off-by: Kevin Wolf <address@hidden>
---
qapi/block-core.json | 13 +++++++++++++
block/rbd.c | 42 ++++++++++++++++++++++++++++++++----------
2 files changed, 45 insertions(+), 10 deletions(-)
diff --git a/qapi/block-core.json b/qapi/block-core.json
index fff23fc82b..0f68ca56f3 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -3178,6 +3178,14 @@
##
+# @RbdAuthMode:
+#
+# Since: 3.0
+##
+{ 'enum': 'RbdAuthMode',
+ 'data': [ 'cephx', 'none' ] }
+
+##
# @BlockdevOptionsRbd:
#
# @pool: Ceph pool name.
@@ -3192,6 +3200,10 @@
#
# @user: Ceph id name.
#
+# @auth-client-required: Acceptable authentication modes.
+# This maps to Ceph configuration option
+# "auth_client_required". (Since 3.0)
+#
# @server: Monitor host address and port. This maps
# to the "mon_host" Ceph option.
#
@@ -3203,6 +3215,7 @@
'*conf': 'str',
'*snapshot': 'str',
'*user': 'str',
+ '*auth-client-required': ['RbdAuthMode'],
'*server': ['InetSocketAddressBase'] } }
##
diff --git a/block/rbd.c b/block/rbd.c
index 82346a2a5e..ea0575d068 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -240,20 +240,42 @@ static void qemu_rbd_refresh_limits(BlockDriverState *bs,
Error **errp)
static int qemu_rbd_set_auth(rados_t cluster, const char *secretid,
+ BlockdevOptionsRbd *opts,
Error **errp)
{
- if (secretid == 0) {
- return 0;
- }
+ char *acr;
+ int r;
+ GString *accu;
+ RbdAuthModeList *auth;
+
+ if (secretid) {
+ gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
+ errp);
+ if (!secret) {
+ return -1;
+ }
- gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
- errp);
- if (!secret) {
- return -1;
+ rados_conf_set(cluster, "key", secret);
+ g_free(secret);
}
- rados_conf_set(cluster, "key", secret);
- g_free(secret);
+ if (opts->has_auth_client_required) {
+ accu = g_string_new("");
+ for (auth = opts->auth_client_required; auth; auth = auth->next) {
+ if (accu->str[0]) {
+ g_string_append_c(accu, ';');
+ }
+ g_string_append(accu, RbdAuthMode_str(auth->value));
+ }
+ acr = g_string_free(accu, FALSE);
+ r = rados_conf_set(cluster, "auth_client_required", acr);
+ g_free(acr);
+ if (r < 0) {
+ error_setg_errno(errp, -r,
+ "Could not set 'auth_client_required'");
+ return r;
+ }
+ }
return 0;
}
@@ -585,7 +607,7 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t
*io_ctx,
}
}
- if (qemu_rbd_set_auth(*cluster, secretid, errp) < 0) {
+ if (qemu_rbd_set_auth(*cluster, secretid, opts, errp) < 0) {
r = -EIO;
goto failed_shutdown;
}
--
2.13.6
- [Qemu-devel] [PULL 12/26] block: Factor out qobject_input_visitor_new_flat_confused(), (continued)
- [Qemu-devel] [PULL 12/26] block: Factor out qobject_input_visitor_new_flat_confused(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 13/26] block: Make remaining uses of qobject input visitor more robust, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 15/26] block-qdict: Tweak qdict_flatten_qdict(), qdict_flatten_qlist(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 17/26] block-qdict: Simplify qdict_is_list() some, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 16/26] block-qdict: Clean up qdict_crumple() a bit, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 09/26] block: Fix -blockdev for certain non-string scalars, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 22/26] rbd: New parameter key-secret, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 20/26] block: Fix -blockdev / blockdev-add for empty objects and arrays, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 18/26] check-block-qdict: Rename qdict_flatten()'s variables for clarity, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 19/26] check-block-qdict: Cover flattening of empty lists and dictionaries, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 21/26] rbd: New parameter auth-client-required,
Kevin Wolf <=
- [Qemu-devel] [PULL 11/26] block: Clean up a misuse of qobject_to() in .bdrv_co_create_opts(), Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 23/26] block: Remove deprecated -drive geometry options, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 26/26] block: Remove dead deprecation warning code, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 24/26] block: Remove deprecated -drive option addr, Kevin Wolf, 2018/06/15
- [Qemu-devel] [PULL 25/26] block: Remove deprecated -drive option serial, Kevin Wolf, 2018/06/15