From nobody Tue Feb 10 13:16:40 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1529004160437211.2813687017964; Thu, 14 Jun 2018 12:22:40 -0700 (PDT) Received: from localhost ([::1]:42269 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTXpK-00079P-Hi for importer@patchew.org; Thu, 14 Jun 2018 15:22:34 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53539) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fTXi1-0001gF-8h for qemu-devel@nongnu.org; Thu, 14 Jun 2018 15:15:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fTXhw-0001cV-VG for qemu-devel@nongnu.org; Thu, 14 Jun 2018 15:15:01 -0400 Received: from mx3-rdu2.redhat.com ([66.187.233.73]:41198 helo=mx1.redhat.com) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fTXhn-0001UZ-Nv; Thu, 14 Jun 2018 15:14:47 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 61DD6406DE3D; Thu, 14 Jun 2018 19:14:47 +0000 (UTC) Received: from blackfin.pond.sub.org (ovpn-117-1.ams2.redhat.com [10.36.117.1]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 1F1F22314A; Thu, 14 Jun 2018 19:14:47 +0000 (UTC) Received: by blackfin.pond.sub.org (Postfix, from userid 1000) id 4A70E11386BE; Thu, 14 Jun 2018 21:14:44 +0200 (CEST) From: Markus Armbruster To: qemu-devel@nongnu.org Date: Thu, 14 Jun 2018 21:14:42 +0200 Message-Id: <20180614191443.14361-18-armbru@redhat.com> In-Reply-To: <20180614191443.14361-1-armbru@redhat.com> References: <20180614191443.14361-1-armbru@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.11.54.5 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 14 Jun 2018 19:14:47 +0000 (UTC) X-Greylist: inspected by milter-greylist-4.5.16 (mx1.redhat.com [10.11.55.7]); Thu, 14 Jun 2018 19:14:47 +0000 (UTC) for IP:'10.11.54.5' DOMAIN:'int-mx05.intmail.prod.int.rdu2.redhat.com' HELO:'smtp.corp.redhat.com' FROM:'armbru@redhat.com' RCPT:'' X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 66.187.233.73 Subject: [Qemu-devel] [PATCH v2 17/18] rbd: New parameter auth-client-required X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kwolf@redhat.com, jcody@redhat.com, qemu-block@nongnu.org, mreitz@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Parameter auth-client-required lets you configure authentication methods. We tried to provide that in v2.9.0, but backed out due to interface design doubts (commit 464444fcc16). This commit is similar to what we backed out, but simpler: we use a list of enumeration values instead of a list of objects with a member of enumeration type. Let's review our reasons for backing out the first try, as stated in the commit message: * The implementation uses deprecated rados_conf_set() key "auth_supported". No biggie. Fixed: we use "auth-client-required". * The implementation makes -drive silently ignore invalid parameters "auth" and "auth-supported.*.X" where X isn't "auth". Fixable (in fact I'm going to fix similar bugs around parameter server), so again no biggie. That fix is commit 2836284db60. This commit doesn't bring the bugs back. * BlockdevOptionsRbd member @password-secret applies only to authentication method cephx. Should it be a variant member of RbdAuthMethod? We've had time to ponder, and we decided to stick to the way Ceph configuration works: the key configured separately, and silently ignored if the authentication method doesn't use it. * BlockdevOptionsRbd member @user could apply to both methods cephx and none, but I'm not sure it's actually used with none. If it isn't, should it be a variant member of RbdAuthMethod? Likewise. * The client offers a *set* of authentication methods, not a list. Should the methods be optional members of BlockdevOptionsRbd instead of members of list @auth-supported? The latter begs the question what multiple entries for the same method mean. Trivial question now that RbdAuthMethod contains nothing but @type, but less so when RbdAuthMethod acquires other members, such the ones discussed above. Again, we decided to stick to the way Ceph configuration works, except we make auth-client-required a list of enumeration values instead of a string containing keywords separated by delimiters. * How BlockdevOptionsRbd member @auth-supported interacts with settings from a configuration file specified with @conf is undocumented. I suspect it's untested, too. Not actually true, the documentation for @conf says "Values in the configuration file will be overridden by options specified via QAPI", and we've tested this. Signed-off-by: Markus Armbruster Reviewed-by: Kevin Wolf --- block/rbd.c | 42 ++++++++++++++++++++++++++++++++---------- qapi/block-core.json | 13 +++++++++++++ 2 files changed, 45 insertions(+), 10 deletions(-) diff --git a/block/rbd.c b/block/rbd.c index 82346a2a5e..ea0575d068 100644 --- a/block/rbd.c +++ b/block/rbd.c @@ -240,20 +240,42 @@ static void qemu_rbd_refresh_limits(BlockDriverState = *bs, Error **errp) =20 =20 static int qemu_rbd_set_auth(rados_t cluster, const char *secretid, + BlockdevOptionsRbd *opts, Error **errp) { - if (secretid =3D=3D 0) { - return 0; - } + char *acr; + int r; + GString *accu; + RbdAuthModeList *auth; + + if (secretid) { + gchar *secret =3D qcrypto_secret_lookup_as_base64(secretid, + errp); + if (!secret) { + return -1; + } =20 - gchar *secret =3D qcrypto_secret_lookup_as_base64(secretid, - errp); - if (!secret) { - return -1; + rados_conf_set(cluster, "key", secret); + g_free(secret); } =20 - rados_conf_set(cluster, "key", secret); - g_free(secret); + if (opts->has_auth_client_required) { + accu =3D g_string_new(""); + for (auth =3D opts->auth_client_required; auth; auth =3D auth->nex= t) { + if (accu->str[0]) { + g_string_append_c(accu, ';'); + } + g_string_append(accu, RbdAuthMode_str(auth->value)); + } + acr =3D g_string_free(accu, FALSE); + r =3D rados_conf_set(cluster, "auth_client_required", acr); + g_free(acr); + if (r < 0) { + error_setg_errno(errp, -r, + "Could not set 'auth_client_required'"); + return r; + } + } =20 return 0; } @@ -585,7 +607,7 @@ static int qemu_rbd_connect(rados_t *cluster, rados_ioc= tx_t *io_ctx, } } =20 - if (qemu_rbd_set_auth(*cluster, secretid, errp) < 0) { + if (qemu_rbd_set_auth(*cluster, secretid, opts, errp) < 0) { r =3D -EIO; goto failed_shutdown; } diff --git a/qapi/block-core.json b/qapi/block-core.json index fff23fc82b..0f68ca56f3 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -3177,6 +3177,14 @@ '*timeout': 'int' } } =20 =20 +## +# @RbdAuthMode: +# +# Since: 3.0 +## +{ 'enum': 'RbdAuthMode', + 'data': [ 'cephx', 'none' ] } + ## # @BlockdevOptionsRbd: # @@ -3192,6 +3200,10 @@ # # @user: Ceph id name. # +# @auth-client-required: Acceptable authentication modes. +# This maps to Ceph configuration option +# "auth_client_required". (Since 3.0) +# # @server: Monitor host address and port. This maps # to the "mon_host" Ceph option. # @@ -3203,6 +3215,7 @@ '*conf': 'str', '*snapshot': 'str', '*user': 'str', + '*auth-client-required': ['RbdAuthMode'], '*server': ['InetSocketAddressBase'] } } =20 ## --=20 2.17.1