[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [RFC PATCH 18/19] rbd: New parameter auth-client-required
From: |
Markus Armbruster |
Subject: |
[Qemu-devel] [RFC PATCH 18/19] rbd: New parameter auth-client-required |
Date: |
Thu, 7 Jun 2018 08:25:58 +0200 |
Parameter auth-client-required lets you configure authentication
methods. We tried to provide that in v2.9.0, but backed out due to
interface design doubts (commit 464444fcc16).
This commit is similar to what we backed out, but simpler: we use a
list of enumeration values instead of a list of objects with a member
of enumeration type.
Let's review our reasons for backing out the first try, as stated in
the commit message:
* The implementation uses deprecated rados_conf_set() key
"auth_supported". No biggie.
Fixed: we use "auth-client-required".
* The implementation makes -drive silently ignore invalid parameters
"auth" and "auth-supported.*.X" where X isn't "auth". Fixable (in
fact I'm going to fix similar bugs around parameter server), so
again no biggie.
That fix is commit 2836284db60. This commit doesn't bring the bugs
back.
* BlockdevOptionsRbd member @password-secret applies only to
authentication method cephx. Should it be a variant member of
RbdAuthMethod?
We've had time to ponder, and we decided to stick to the way Ceph
configuration works: the key configured separately, and silently
ignored if the authentication method doesn't use it.
* BlockdevOptionsRbd member @user could apply to both methods cephx
and none, but I'm not sure it's actually used with none. If it
isn't, should it be a variant member of RbdAuthMethod?
Likewise.
* The client offers a *set* of authentication methods, not a list.
Should the methods be optional members of BlockdevOptionsRbd instead
of members of list @auth-supported? The latter begs the question
what multiple entries for the same method mean. Trivial question
now that RbdAuthMethod contains nothing but @type, but less so when
RbdAuthMethod acquires other members, such the ones discussed above.
Again, we decided to stick to the way Ceph configuration works, except
we make auth-client-required a list of enumeration values instead of a
string containing keywords separated by delimiters.
* How BlockdevOptionsRbd member @auth-supported interacts with
settings from a configuration file specified with @conf is
undocumented. I suspect it's untested, too.
Not actually true, the documentation for @conf says "Values in the
configuration file will be overridden by options specified via QAPI",
and we've tested this.
Signed-off-by: Markus Armbruster <address@hidden>
---
block/rbd.c | 42 ++++++++++++++++++++++++++++++++----------
qapi/block-core.json | 11 +++++++++++
2 files changed, 43 insertions(+), 10 deletions(-)
diff --git a/block/rbd.c b/block/rbd.c
index 82346a2a5e..ea0575d068 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -240,20 +240,42 @@ static void qemu_rbd_refresh_limits(BlockDriverState *bs,
Error **errp)
static int qemu_rbd_set_auth(rados_t cluster, const char *secretid,
+ BlockdevOptionsRbd *opts,
Error **errp)
{
- if (secretid == 0) {
- return 0;
- }
+ char *acr;
+ int r;
+ GString *accu;
+ RbdAuthModeList *auth;
+
+ if (secretid) {
+ gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
+ errp);
+ if (!secret) {
+ return -1;
+ }
- gchar *secret = qcrypto_secret_lookup_as_base64(secretid,
- errp);
- if (!secret) {
- return -1;
+ rados_conf_set(cluster, "key", secret);
+ g_free(secret);
}
- rados_conf_set(cluster, "key", secret);
- g_free(secret);
+ if (opts->has_auth_client_required) {
+ accu = g_string_new("");
+ for (auth = opts->auth_client_required; auth; auth = auth->next) {
+ if (accu->str[0]) {
+ g_string_append_c(accu, ';');
+ }
+ g_string_append(accu, RbdAuthMode_str(auth->value));
+ }
+ acr = g_string_free(accu, FALSE);
+ r = rados_conf_set(cluster, "auth_client_required", acr);
+ g_free(acr);
+ if (r < 0) {
+ error_setg_errno(errp, -r,
+ "Could not set 'auth_client_required'");
+ return r;
+ }
+ }
return 0;
}
@@ -585,7 +607,7 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t
*io_ctx,
}
}
- if (qemu_rbd_set_auth(*cluster, secretid, errp) < 0) {
+ if (qemu_rbd_set_auth(*cluster, secretid, opts, errp) < 0) {
r = -EIO;
goto failed_shutdown;
}
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 4b1de474a9..6964fb707f 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -3093,6 +3093,14 @@
'*timeout': 'int' } }
+##
+# @RbdAuthMode:
+#
+# Since: 3.0
+##
+{ 'enum': 'RbdAuthMode',
+ 'data': [ 'cephx', 'none' ] }
+
##
# @BlockdevOptionsRbd:
#
@@ -3108,6 +3116,8 @@
#
# @user: Ceph id name.
#
+# @auth-client-required: Acceptable authentication modes (since 3.0).
+#
# @server: Monitor host address and port. This maps
# to the "mon_host" Ceph option.
#
@@ -3119,6 +3129,7 @@
'*conf': 'str',
'*snapshot': 'str',
'*user': 'str',
+ '*auth-client-required': ['RbdAuthMode'],
'*server': ['InetSocketAddressBase'] } }
##
--
2.17.1
- [Qemu-devel] [RFC PATCH 17/19] block: Fix -blockdev / blockdev-add for empty objects and arrays, (continued)
- [Qemu-devel] [RFC PATCH 17/19] block: Fix -blockdev / blockdev-add for empty objects and arrays, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 06/19] block: Fix -blockdev for certain non-string scalars, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 16/19] check-block-qdict: Cover flattening of empty lists and dictionaries, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 12/19] block-qdict: Tweak qdict_flatten_qdict(), qdict_flatten_qlist(), Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 13/19] block-qdict: Clean up qdict_crumple() a bit, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 04/19] fixup block: Add block-specific QDict header, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 15/19] check-block-qdict: Rename qdict_flatten()'s variables for clarity, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 18/19] rbd: New parameter auth-client-required,
Markus Armbruster <=
- [Qemu-devel] [RFC PATCH 19/19] rbd: New parameter key-secret, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 10/19] block: Make remaining uses of qobject input visitor more robust, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 01/19] rbd: Drop deprecated -drive parameter "filename", Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 08/19] block: Clean up a misuse of qobject_to() in .bdrv_co_create_opts(), Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 09/19] block: Factor out qobject_input_visitor_new_flat_confused(), Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 03/19] block: Add block-specific QDict header, Markus Armbruster, 2018/06/07
- [Qemu-devel] [RFC PATCH 05/19] qobject: Move block-specific qdict code to block-qdict.c, Markus Armbruster, 2018/06/07
- Re: [Qemu-devel] [RFC PATCH 00/19] block: Configuration fixes and rbd authentication, Jeff Cody, 2018/06/07