GlusterFS中控端密码验证功能实现

思路：在不改变客户端代码的情况下，只改变中控端代码。客户端传volid的时候传入客户端IP地址和卷密码串的md5值。在中控端进行验证，验证成功后返回vol数据，否则goto fail;

 

客户端mount方式如下：

/usr/sbin/glusterfs --log-level=WARNING --volfile-server=xen-gfs-monitor --volfile-id=abc*ce23aa721f24ec3458c5d3be1f81b792 /dfs_abc

 

其中，ce23aa721f24ec3458c5d3be1f81b792为客户端IP和卷abc的密码组合后的MD5值。

修改xlators/protocol/server/src/server-protocol.c

函数：mop_getspec - getspec function for server protocol

在build_volfile_path函数前加上如下代码，其中需要包含md5.c md5.h文件。

 

//NEW char *client_md5_str; char server_md5_str[32]; char **vlist = NULL; int i = 0; int vcount = 0; dict_t *config_params = NULL; peer_info_t *peerinfo = NULL; peerinfo = &(TRANSPORT_FROM_FRAME(frame))->peerinfo; char *temp_identifier = strdup(peerinfo->identifier); char *searchstr = NULL; config_params = dict_copy_with_ref (frame->this->options, NULL); if (strstr(key, "*")) { if (gf_strsplit ((const char*)key, "*", &vlist, &vcount) != 0 || vcount != 2 || strlen(vlist[1]) != 32 ) { //分割客户端传来的”volid”(例如sq*abc) gf_log (frame->this->name, GF_LOG_ERROR, "Failed_key:%s", key); goto fail; //拒绝提供vol } key = vlist[0]; //取分割后的第一段为volid client_md5_str = vlist[1]; //第二段为ip和密码组合后md5 } char *username = key, *password = NULL; int32_t auth_ret = AUTH_DONT_CARE; asprintf (&searchstr, "auth.login.%s.password", username); auth_ret = dict_get_str (config_params, searchstr, &password); dict_unref (config_params); if (auth_ret >= 0){ char *client_ip = strtok(temp_identifier, ":"); gf_log (frame->this->name, GF_LOG_DEBUG, "Succeed_key:%s, Client IP:%s", key, client_ip); //计算并比较MD5值 int j; md5_context ctx; unsigned char md5sum[16]; char *msg = NULL; asprintf(&msg, "%s_%s", client_ip, password); md5_starts( &ctx ); md5_update( &ctx, (uint8 *) msg, strlen(msg) ); md5_finish( &ctx, md5sum ); for( j = 0; j < 16; j++ ) { sprintf( server_md5_str + j*2, "%02x", md5sum[j]); } if (strcmp (server_md5_str, client_md5_str) != 0 ) { gf_log (frame->this->name, GF_LOG_ERROR, "Cannot authenticate client from %s, key:%s, client_md5_str:%s", peerinfo->identifier, key, client_md5_str); goto fail; } } else { gf_log (frame->this->name, GF_LOG_DEBUG, "AUTH_DONT_CARE: client from %s", peerinfo->identifier); } // ret = build_volfile_path (frame->this, key, filename, sizeof (filename));