oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

iprop: Support hierarchical iprop

Browse Source
This commit is contained in:
Nicolas Williams
2020-09-17 23:40:12 -05:00
parent c12ca129b6
commit 0e09fa7fde
9 changed files with 283 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/kadm5/iprop.8
View File

@@ -139,6 +139,12 @@ There is a keep-alive feature logged in the master's
file (e.g.\&
.Pa /var/heimdal/slave-stats ) .
.Pp
Note that hierarchical replication is supported by running
an
.Nm ipropd-master
on the same KDC as an
.Nm ipropd-slave .
.Pp
Supported options for
.Nm ipropd-master :
.Bl -tag -width Ds

13
lib/kadm5/ipropd_master.c
View File

@@ -47,6 +47,7 @@ static int time_before_missing;
static int time_before_gone;
const char *master_hostname;
const char *pidfile_basename;
static krb5_socket_t
make_signal_socket (krb5_context context)
@@ -937,9 +938,13 @@ get_first(kadm5_server_context *server_context, int log_fd,
ret = kadm5_log_get_version_fd(server_context, log_fd, LOG_VERSION_FIRST,
initial_verp, initial_timep);
if (ret == HEIM_ERR_EOF)
ret = kadm5_log_get_version_fd(server_context, log_fd,
LOG_VERSION_UBER, initial_verp,
initial_timep);
if (ret != 0) {
flock(log_fd, LOCK_UN);
krb5_warnx(context, "could not read initial log entry");
krb5_warn(context, ret, "could not read initial log entry");
return -1;
}
@@ -1529,8 +1534,10 @@ static struct getargs args[] = {
"port ipropd will listen to", "port"},
{ "detach", 0, arg_flag, &detach_from_console,
"detach from console", NULL },
{ "daemon-child", 0 , arg_integer, &daemon_child,
{ "daemon-child", 0, arg_integer, &daemon_child,
"private argument, do not use", NULL },
{ "pidfile-basename", 0, arg_string, &pidfile_basename,
"basename of pidfile; private argument for testing", "NAME" },
{ "hostname", 0, arg_string, rk_UNCONST(&master_hostname),
"hostname of master (if not same as hostname)", "hostname" },
{ "verbose", 0, arg_flag, &verbose, NULL, NULL },
@@ -1573,7 +1580,7 @@ main(int argc, char **argv)
if (detach_from_console && daemon_child == -1)
daemon_child = roken_detach_prep(argc, argv, "--daemon-child");
rk_pidfile(NULL);
rk_pidfile(pidfile_basename);
ret = krb5_init_context(&context);
if (ret)

64
lib/kadm5/ipropd_slave.c
View File

@@ -43,7 +43,8 @@ static krb5_log_facility *log_facility;
static char five_min[] = "5 min";
static char *server_time_lost = five_min;
static int time_before_lost;
const char *slave_str = NULL;
static const char *slave_str;
static const char *pidfile_basename;
static int
connect_to_master (krb5_context context, const char *master,
@@ -305,9 +306,9 @@ append_to_log_file(krb5_context context,
}
static int
receive_loop (krb5_context context,
krb5_storage *sp,
kadm5_server_context *server_context)
receive_loop(krb5_context context,
krb5_storage *sp,
kadm5_server_context *server_context)
{
int ret;
off_t left, right, off;
@@ -316,6 +317,11 @@ receive_loop (krb5_context context,
if (verbose)
krb5_warnx(context, "receiving diffs");
ret = kadm5_log_exclusivelock(server_context);
if (ret)
krb5_err(context, IPROPD_RESTART, ret,
"Failed to lock iprop log for writes");
/*
* Seek to the first entry in the message from the master that is
* past the current version of the local database.
@@ -433,6 +439,12 @@ receive(krb5_context context,
if (ret)
krb5_err(context, IPROPD_RESTART_SLOW, ret, "db->close");
(void) kadm5_log_sharedlock(server_context);
if (verbose)
krb5_warnx(context, "downgraded iprop log lock to shared");
kadm5_log_signal_master(server_context);
if (verbose)
krb5_warnx(context, "signaled master for hierarchical iprop");
return ret2;
}
@@ -481,6 +493,9 @@ reinit_log(krb5_context context,
ret = kadm5_log_reinit(server_context, vno);
if (ret)
krb5_err(context, IPROPD_RESTART_SLOW, ret, "kadm5_log_reinit");
(void) kadm5_log_sharedlock(server_context);
if (verbose)
krb5_warnx(context, "downgraded iprop log lock to shared");
}
@@ -500,6 +515,10 @@ receive_everything(krb5_context context, int fd,
krb5_warnx(context, "receive complete database");
ret = kadm5_log_exclusivelock(server_context);
if (ret)
krb5_err(context, IPROPD_RESTART, ret,
"Failed to lock iprop log for writes");
ret = asprintf(&dbname, "%s-NEW", server_context->db->hdb_name);
if (ret == -1)
krb5_err(context, IPROPD_RESTART, ENOMEM, "asprintf");
@@ -673,8 +692,10 @@ static struct getargs args[] = {
"port ipropd-slave will connect to", "port"},
{ "detach", 0, arg_flag, &detach_from_console,
"detach from console", NULL },
{ "daemon-child", 0 , arg_integer, &daemon_child,
{ "daemon-child", 0, arg_integer, &daemon_child,
"private argument, do not use", NULL },
{ "pidfile-basename", 0, arg_string, &pidfile_basename,
"basename of pidfile; private argument for testing", "NAME" },
{ "hostname", 0, arg_string, rk_UNCONST(&slave_str),
"hostname of slave (if not same as hostname)", "hostname" },
{ "verbose", 0, arg_flag, &verbose, NULL, NULL },
@@ -729,7 +750,7 @@ main(int argc, char **argv)
if (detach_from_console && daemon_child == -1)
daemon_child = roken_detach_prep(argc, argv, "--daemon-child");
rk_pidfile(NULL);
rk_pidfile(pidfile_basename);
ret = krb5_init_context(&context);
if (ret)
@@ -804,13 +825,16 @@ main(int argc, char **argv)
if (ret)
krb5_err (context, 1, ret, "db->open");
ret = kadm5_log_init (server_context);
ret = kadm5_log_init(server_context);
if (ret)
krb5_err (context, 1, ret, "kadm5_log_init");
krb5_err(context, 1, ret, "kadm5_log_init");
(void) kadm5_log_sharedlock(server_context);
if (verbose)
krb5_warnx(context, "downgraded iprop log lock to shared");
ret = server_context->db->hdb_close (context, server_context->db);
ret = server_context->db->hdb_close(context, server_context->db);
if (ret)
krb5_err (context, 1, ret, "db->close");
krb5_err(context, 1, ret, "db->close");
get_creds(context, keytab_str, &ccache, master);
@@ -977,18 +1001,30 @@ main(int argc, char **argv)
continue;
}
/*
* It's unclear why we open th HDB and call kadm5_log_init() here.
*
* We don't need it to process the log entries we receive in the
* FOR_YOU case: we already call kadm5_log_recover() in receive() /
* receive_loop(). Maybe it's just just in case, though at the
* cost of synchronization with ipropd-master if we're running one
* for hierarchical iprop.
*/
ret = server_context->db->hdb_open(context,
server_context->db,
O_RDWR | O_CREAT, 0600);
if (ret)
krb5_err (context, 1, ret, "db->open while handling a "
"message from the master");
ret = kadm5_log_init(server_context);
if (ret) {
krb5_err(context, IPROPD_RESTART, ret, "kadm5_log_init while "
"handling a message from the master");
}
(void) kadm5_log_sharedlock(server_context);
if (verbose)
krb5_warnx(context, "downgraded iprop log lock to shared");
ret = server_context->db->hdb_close (context, server_context->db);
if (ret)
krb5_err (context, 1, ret, "db->close while handling a "
@@ -1019,6 +1055,7 @@ main(int argc, char **argv)
krb5_warnx(context, "master sent us a full dump");
ret = receive_everything(context, master_fd, server_context,
auth_context);
(void) kadm5_log_sharedlock(server_context);
if (ret == 0) {
ret = ihave(context, auth_context, master_fd,
server_context->log_context.version);
@@ -1027,6 +1064,11 @@ main(int argc, char **argv)
connected = FALSE;
else
is_up_to_date(context, status_file, server_context);
if (verbose)
krb5_warnx(context, "downgraded iprop log lock to shared");
kadm5_log_signal_master(server_context);
if (verbose)
krb5_warnx(context, "signaled master for hierarchical iprop");
break;
case ARE_YOU_THERE :
if (verbose)

2
lib/kadm5/libkadm5srv-exports.def
View File

@@ -61,7 +61,9 @@ EXPORTS
kadm5_s_init_with_creds
kadm5_s_chpass_principal_cond
kadm5_s_create_principal_with_key
kadm5_log_exclusivelock
kadm5_log_set_version
kadm5_log_sharedlock
kadm5_log_signal_master
;! kadm5_log_signal_socket
kadm5_log_signal_socket_info ;!

34
lib/kadm5/log.c
View File

@@ -682,6 +682,40 @@ kadm5_log_init(kadm5_server_context *server_context)
return log_init(server_context, LOCK_EX);
}
/* Upgrade log lock to exclusive */
kadm5_ret_t
kadm5_log_exclusivelock(kadm5_server_context *server_context)
{
kadm5_log_context *log_context = &server_context->log_context;
if (log_context->lock_mode == LOCK_EX)
return 0;
if (log_context->log_fd == -1)
return EINVAL;
if (flock(log_context->log_fd, LOCK_EX) < 0)
return errno;
log_context->read_only = 0;
log_context->lock_mode = LOCK_EX;
return 0;
}
/* Downgrade log lock to shared */
kadm5_ret_t
kadm5_log_sharedlock(kadm5_server_context *server_context)
{
kadm5_log_context *log_context = &server_context->log_context;
if (log_context->lock_mode == LOCK_SH)
return 0;
if (log_context->log_fd == -1)
return EINVAL;
if (flock(log_context->log_fd, LOCK_SH) < 0)
return errno;
log_context->read_only = 1;
log_context->lock_mode = LOCK_SH;
return 0;
}
/* Open the log with an exclusive non-blocking lock */
kadm5_ret_t
kadm5_log_init_nb(kadm5_server_context *server_context)

2
lib/kadm5/version-script.map
View File

@@ -64,7 +64,9 @@ HEIMDAL_KAMD5_SERVER_1.0 {
kadm5_s_init_with_creds;
kadm5_s_chpass_principal_cond;
kadm5_s_create_principal_with_key;
kadm5_log_exclusivelock;
kadm5_log_set_version;
kadm5_log_sharedlock;
kadm5_log_signal_master;
kadm5_log_signal_socket;
kadm5_log_previous;