Now that we can differentiate content based on export name, we also need to be able to differentiate content for a --tls=on server, since TLS is optional according to whether the client has authenticated. For internal code and filters, this means adding a new parameter; the sh plugin can do likewise. For plugins, we can't add a parameter until the V3 protocol, so in the meantime, we add nbdkit_is_tls(), even though it will be deprecated alongside nbdkit_export_name() when we do get to V3. Signed-off-by: Eric Blake <eblake(a)redhat.com&gt; --- docs/nbdkit-filter.pod | 12 ++++++++---- docs/nbdkit-plugin.pod | 32 +++++++++++++++++++++++++++---- docs/nbdkit-tls.pod | 5 ++++- filters/log/nbdkit-log-filter.pod | 2 +- plugins/sh/nbdkit-sh-plugin.pod | 5 +++-- include/nbdkit-filter.h | 2 +- include/nbdkit-plugin.h | 1 + server/internal.h | 3 ++- server/backend.c | 6 +++--- server/filters.c | 6 ++++-- server/nbdkit.syms | 1 + server/plugins.c | 14 +++++++++----- server/public.c | 16 ++++++++++++++++ plugins/sh/methods.c | 1 + filters/cow/cow.c | 2 +- filters/exitlast/exitlast.c | 2 +- filters/ext2/ext2.c | 2 +- filters/gzip/gzip.c | 2 +- filters/limit/limit.c | 2 +- filters/log/log.c | 16 +++++++++------- filters/partition/partition.c | 2 +- filters/rate/rate.c | 2 +- filters/retry/retry.c | 2 +- filters/tar/tar.c | 2 +- filters/truncate/truncate.c | 2 +- filters/xz/xz.c | 2 +- tests/test-layers-filter.c | 2 +- TODO | 13 ++++++------- 28 files changed, 109 insertions(+), 50 deletions(-) diff --git a/docs/nbdkit-filter.pod b/docs/nbdkit-filter.pod index 12343dbf..b6ed5504 100644 --- a/docs/nbdkit-filter.pod +++ b/docs/nbdkit-filter.pod @@ -403,7 +403,7 @@ Returns a copy of the C<i>'th export. =head2 C<.open> void * (*open) (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname); + int readonly, const char *exportname, int is_tls); This is called when a new client connection is opened and can be used to allocate any per-connection data structures needed by the filter. @@ -420,8 +420,9 @@ error message and return C<NULL>. This callback is optional, but if provided, it must call C<next>, passing C<readonly> and C<exportname> possibly modified according to -how the filter plans to use the plugin. Typically, the filter passes -the same values as it received, or passes readonly=true to provide a +how the filter plans to use the plugin (C<is_tls> is not passed, +because a filter cannot modify it). Typically, the filter passes the +same values as it received, or passes readonly=true to provide a writable layer on top of a read-only backend. However, it is also acceptable to attempt write access to the plugin even if this filter is readonly, such as when a file system mounted read-only still @@ -430,7 +431,10 @@ to be replayed for consistency as part of the mounting process. The C<exportname> string is only guaranteed to be available during the call. If the filter needs to use it (other than immediately passing -it down to the next layer) it must take a copy. +it down to the next layer) it must take a copy. The C<exportname> and +C<is_tls> parameters are provided so that filters do not need to use +the plugin-only interfaces of C<nbdkit_export_name> and +C<nbdkit_is_tls>. The filter should generally call C<next> as its first step, to allocate from the plugin outwards, so that C<.close> running from the diff --git a/docs/nbdkit-plugin.pod b/docs/nbdkit-plugin.pod index 9341f282..6237b749 100644 --- a/docs/nbdkit-plugin.pod +++ b/docs/nbdkit-plugin.pod @@ -728,10 +728,18 @@ connection to be readonly (even if this flag is false) by returning false from the C<.can_write> callback. So if your plugin can only serve read-only, you can ignore this parameter. -This callback is called after the NBD handshake has completed, which -includes TLS authentication (if required). If the plugin defines a -C<.preconnect> callback, then it must be called and return with -success before C<.open> is called. +If the plugin wants to differentiate the content it served based on +client input, then this is the spot to use C<nbdkit_export_name()> to +determine which export the client requested. See also L</EXPORT NAME> +below. + +This callback is called after the NBD handshake has completed; if the +server requires TLS authentication, then that has occurred as well. +But if the server is set up to have optional TLS authentication, you +may check C<nbdkit_is_tls> to learn whether the client has completed +TLS authentication. When running the server in a mode that permits +but not requires TLS, be careful that you do not allow unauthenticated +clients to cause a denial of service against authentication. If there is an error, C<.open> should call C<nbdkit_error> with an error message and return C<NULL>. @@ -1466,6 +1474,22 @@ client data, be cautious when parsing it.> On error, C<nbdkit_error> is called and the call returns C<NULL>. +=head1 AUTHENTICATION + +A server may use C<nbdkit_is_tls> to limit which export names work +until after a client has completed TLS authentication. See +L<nbdkit-tls(1)>. + +=head2 C<nbdkit_is_tls> + + int nbdkit_is_tls (void); + +Return true if the client has completed TLS authentication, or false +if the connection is still plaintext. + +On error (such as calling this function outside of the context of +C<.open>), C<nbdkit_error> is called and the call returns C<-1>. + =head1 PEER NAME It is possible to get the address of the client when you are running diff --git a/docs/nbdkit-tls.pod b/docs/nbdkit-tls.pod index 628512a9..450e0850 100644 --- a/docs/nbdkit-tls.pod +++ b/docs/nbdkit-tls.pod @@ -22,7 +22,10 @@ connect, it will be rejected by the server (in other words, as if the server doesn't support TLS). I<--tls=on> means that the client may choose to connect either with or -without TLS. +without TLS. In this mode, a plugin may wish to serve different +content depending on whether the client has authenticated; the +function C<nbdkit_is_tls()> can be used during the C<.open> callback +for that purpose. Because I<--tls=on> is subject to downgrade attacks where a malicious proxy pretends not to support TLS in order to force either the client diff --git a/filters/log/nbdkit-log-filter.pod b/filters/log/nbdkit-log-filter.pod index 5f690457..721fc118 100644 --- a/filters/log/nbdkit-log-filter.pod +++ b/filters/log/nbdkit-log-filter.pod @@ -74,7 +74,7 @@ before performing a single successful read is: 2020-08-06 02:07:23.080415 ListExports id=1 readonly=0 default_only=0 ... 2020-08-06 02:07:23.080502 ...ListExports id=1 exports=[""] return=0 - 2020-08-06 02:07:23.080712 connection=1 Connect export='' size=0x400 write=1 flush=1 rotational=0 trim=1 zero=2 fua=2 extents=1 cache=2 fast_zero=1 + 2020-08-06 02:07:23.080712 connection=1 Connect export='' tls=0 size=0x400 write=1 flush=1 rotational=0 trim=1 zero=2 fua=2 extents=1 cache=2 fast_zero=1 2020-08-06 02:07:23.080907 connection=1 Read id=1 offset=0x0 count=0x200 ... 2020-08-06 02:07:23.080927 connection=1 ...Read id=1 return=0 (Success) 2020-08-06 02:07:23.081255 connection=1 Disconnect transactions=1 diff --git a/plugins/sh/nbdkit-sh-plugin.pod b/plugins/sh/nbdkit-sh-plugin.pod index 678116f2..07d90b57 100644 --- a/plugins/sh/nbdkit-sh-plugin.pod +++ b/plugins/sh/nbdkit-sh-plugin.pod @@ -320,11 +320,12 @@ as a name and no description. =item C<open> - /path/to/script open <readonly> <exportname> + /path/to/script open <readonly> <exportname> <tls> The C<readonly> parameter will be C<true> or C<false>. The C<exportname> parameter, if present, is the export name passed to the -server from the client. +server from the client. The C<tls> parameter, if present, will be +C<true> or C<false> depending on whether the client is using TLS. On success this should print the handle (any string) on stdout and exit with code C<0>. If the handle ends with a newline character then diff --git a/include/nbdkit-filter.h b/include/nbdkit-filter.h index 08c6abc4..708a1b54 100644 --- a/include/nbdkit-filter.h +++ b/include/nbdkit-filter.h @@ -175,7 +175,7 @@ struct nbdkit_filter { struct nbdkit_exports *exports); void * (*open) (nbdkit_next_open *next, nbdkit_backend *nxdata, - int readonly, const char *exportname); + int readonly, const char *exportname, int is_tls); void (*close) (void *handle); int (*prepare) (struct nbdkit_next_ops *next_ops, nbdkit_backend *nxdata, diff --git a/include/nbdkit-plugin.h b/include/nbdkit-plugin.h index 86b8565d..e20391b8 100644 --- a/include/nbdkit-plugin.h +++ b/include/nbdkit-plugin.h @@ -146,6 +146,7 @@ struct nbdkit_plugin { extern void nbdkit_set_error (int err); extern const char *nbdkit_export_name (void); +extern int nbdkit_is_tls (void); #define NBDKIT_REGISTER_PLUGIN(plugin) \ NBDKIT_CXX_LANG_C \ diff --git a/server/internal.h b/server/internal.h index f84696ca..d043225a 100644 --- a/server/internal.h +++ b/server/internal.h @@ -367,7 +367,8 @@ struct backend { int (*preconnect) (struct backend *, int readonly); int (*list_exports) (struct backend *, int readonly, int default_only, struct nbdkit_exports *exports); - void *(*open) (struct backend *, int readonly, const char *exportname); + void *(*open) (struct backend *, int readonly, const char *exportname, + int is_tls); int (*prepare) (struct backend *, void *handle, int readonly); int (*finalize) (struct backend *, void *handle); void (*close) (struct backend *, void *handle); diff --git a/server/backend.c b/server/backend.c index 75ca53be..8f4fed9d 100644 --- a/server/backend.c +++ b/server/backend.c @@ -186,8 +186,8 @@ backend_open (struct backend *b, int readonly, const char *exportname) GET_CONN; struct handle *h = get_handle (conn, b->i); - controlpath_debug ("%s: open readonly=%d exportname=\"%s\"", - b->name, readonly, exportname); + controlpath_debug ("%s: open readonly=%d exportname=\"%s\" tls=%d", + b->name, readonly, exportname, conn->using_tls); assert (h->handle == NULL); assert ((h->state & HANDLE_OPEN) == 0); @@ -212,7 +212,7 @@ backend_open (struct backend *b, int readonly, const char *exportname) /* Most filters will call next_open first, resulting in * inner-to-outer ordering. */ - h->handle = b->open (b, readonly, exportname); + h->handle = b->open (b, readonly, exportname, conn->using_tls); controlpath_debug ("%s: open returned handle %p", b->name, h->handle); if (h->handle == NULL) { diff --git a/server/filters.c b/server/filters.c index 20518354..90a9a948 100644 --- a/server/filters.c +++ b/server/filters.c @@ -250,7 +250,8 @@ filter_list_exports (struct backend *b, int readonly, int default_only, } static void * -filter_open (struct backend *b, int readonly, const char *exportname) +filter_open (struct backend *b, int readonly, const char *exportname, + int is_tls) { struct backend_filter *f = container_of (b, struct backend_filter, backend); void *handle; @@ -259,7 +260,8 @@ filter_open (struct backend *b, int readonly, const char *exportname) * inner-to-outer ordering. */ if (f->filter.open) - handle = f->filter.open (backend_open, b->next, readonly, exportname); + handle = f->filter.open (backend_open, b->next, readonly, exportname, + is_tls); else if (backend_open (b->next, readonly, exportname) == -1) handle = NULL; else diff --git a/server/nbdkit.syms b/server/nbdkit.syms index 6cc6ed32..a67669b7 100644 --- a/server/nbdkit.syms +++ b/server/nbdkit.syms @@ -53,6 +53,7 @@ nbdkit_extents_free; nbdkit_extents_new; nbdkit_get_extent; + nbdkit_is_tls; nbdkit_nanosleep; nbdkit_parse_bool; nbdkit_parse_int8_t; diff --git a/server/plugins.c b/server/plugins.c index d4364cd2..bc57623a 100644 --- a/server/plugins.c +++ b/server/plugins.c @@ -292,7 +292,8 @@ plugin_list_exports (struct backend *b, int readonly, int default_only, } static void * -plugin_open (struct backend *b, int readonly, const char *exportname) +plugin_open (struct backend *b, int readonly, const char *exportname, + int is_tls) { GET_CONN; struct backend_plugin *p = container_of (b, struct backend_plugin, backend); @@ -302,11 +303,14 @@ plugin_open (struct backend *b, int readonly, const char *exportname) /* Save the exportname since the lifetime of the string passed in * here is likely to be brief. In addition this provides a place * for nbdkit_export_name to retrieve it if called from the plugin. + * While readonly and the export name can be altered in plugins, the + * tls mode cannot. * - * In API V3 we propose to pass the exportname as an extra parameter - * to the (new) plugin.open and deprecate nbdkit_export_name for V3 - * users. Even then we will still need to save it in the handle - * because of the lifetime issue. + * In API V3 we propose to pass the exportname and tls mode as extra + * parameters to the (new) plugin.open and deprecate + * nbdkit_export_name and nbdkit_is_tls for V3 users. Even then we + * will still need to save the export name in the handle because of + * the lifetime issue. */ if (conn->exportname == NULL) { conn->exportname = strdup (exportname); diff --git a/server/public.c b/server/public.c index c00a5cb6..f682d732 100644 --- a/server/public.c +++ b/server/public.c @@ -670,6 +670,22 @@ nbdkit_export_name (void) return conn->exportname; } +/* This function will be deprecated for API V3 users. The preferred + * approach will be to get the tls mode from .open(). + */ +int +nbdkit_is_tls (void) +{ + struct connection *conn = threadlocal_get_conn (); + + if (!conn) { + nbdkit_error ("no connection in this thread"); + return -1; + } + + return conn->using_tls; +} + int nbdkit_peer_name (struct sockaddr *addr, socklen_t *addrlen) { diff --git a/plugins/sh/methods.c b/plugins/sh/methods.c index 9f247524..c59198ca 100644 --- a/plugins/sh/methods.c +++ b/plugins/sh/methods.c @@ -341,6 +341,7 @@ sh_open (int readonly) { script, method, readonly ? "true" : "false", nbdkit_export_name () ? : "", + nbdkit_is_tls () ? "true" : "false", NULL }; struct sh_handle *h = malloc (sizeof *h); diff --git a/filters/cow/cow.c b/filters/cow/cow.c index 0faf2726..51ca64a4 100644 --- a/filters/cow/cow.c +++ b/filters/cow/cow.c @@ -94,7 +94,7 @@ cow_config (nbdkit_next_config *next, void *nxdata, static void * cow_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { /* Always pass readonly=1 to the underlying plugin. */ if (next (nxdata, 1, exportname) == -1) diff --git a/filters/exitlast/exitlast.c b/filters/exitlast/exitlast.c index 378cda75..4c879cc9 100644 --- a/filters/exitlast/exitlast.c +++ b/filters/exitlast/exitlast.c @@ -51,7 +51,7 @@ static _Atomic unsigned connections; static void * exitlast_open (nbdkit_next_open *next, nbdkit_backend *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { if (next (nxdata, readonly, exportname) == -1) return NULL; diff --git a/filters/ext2/ext2.c b/filters/ext2/ext2.c index 72b7ac9f..75ac2c4c 100644 --- a/filters/ext2/ext2.c +++ b/filters/ext2/ext2.c @@ -122,7 +122,7 @@ struct handle { /* Create the per-connection handle. */ static void * ext2_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h; diff --git a/filters/gzip/gzip.c b/filters/gzip/gzip.c index 8323b882..d92e00d9 100644 --- a/filters/gzip/gzip.c +++ b/filters/gzip/gzip.c @@ -75,7 +75,7 @@ gzip_thread_model (void) static void * gzip_open (nbdkit_next_open *next, nbdkit_backend *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { /* Always pass readonly=1 to the underlying plugin. */ if (next (nxdata, 1, exportname) == -1) diff --git a/filters/limit/limit.c b/filters/limit/limit.c index 7c4477eb..fb862df7 100644 --- a/filters/limit/limit.c +++ b/filters/limit/limit.c @@ -91,7 +91,7 @@ limit_preconnect (nbdkit_next_preconnect *next, nbdkit_backend *nxdata, static void * limit_open (nbdkit_next_open *next, nbdkit_backend *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { if (next (nxdata, readonly, exportname) == -1) return NULL; diff --git a/filters/log/log.c b/filters/log/log.c index c89f5001..f8da9ad8 100644 --- a/filters/log/log.c +++ b/filters/log/log.c @@ -135,6 +135,7 @@ struct handle { uint64_t connection; uint64_t id; char *exportname; + int tls; }; /* Compute the next id number on the current connection. */ @@ -283,7 +284,7 @@ log_list_exports (nbdkit_next_list_exports *next, void *nxdata, /* Open a connection. */ static void * log_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h; @@ -296,9 +297,9 @@ log_open (nbdkit_next_open *next, void *nxdata, return NULL; } - /* Save the exportname in the handle so we can display it in - * log_prepare. We must take a copy because this string has a short - * lifetime. + /* Save the exportname and tls state in the handle so we can display + * it in log_prepare. We must take a copy because this string has a + * short lifetime. */ h->exportname = strdup (exportname); if (h->exportname == NULL) { @@ -306,6 +307,7 @@ log_open (nbdkit_next_open *next, void *nxdata, free (h); return NULL; } + h->tls = is_tls; ACQUIRE_LOCK_FOR_CURRENT_SCOPE (&lock); h->connection = ++connections; @@ -343,9 +345,9 @@ log_prepare (struct nbdkit_next_ops *next_ops, void *nxdata, void *handle, e < 0 || c < 0 || Z < 0) return -1; - output (h, "Connect", 0, "export='%s' size=0x%" PRIx64 " write=%d flush=%d " - "rotational=%d trim=%d zero=%d fua=%d extents=%d cache=%d " - "fast_zero=%d", exportname, size, w, f, r, t, z, F, e, c, Z); + output (h, "Connect", 0, "export='%s' tls=%d size=0x%" PRIx64 " write=%d " + "flush=%d rotational=%d trim=%d zero=%d fua=%d extents=%d cache=%d " + "fast_zero=%d", exportname, h->tls, size, w, f, r, t, z, F, e, c, Z); return 0; } diff --git a/filters/partition/partition.c b/filters/partition/partition.c index c348664b..849f0cc7 100644 --- a/filters/partition/partition.c +++ b/filters/partition/partition.c @@ -88,7 +88,7 @@ struct handle { /* Open a connection. */ static void * partition_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h; diff --git a/filters/rate/rate.c b/filters/rate/rate.c index 6e99fcc7..32c47fdf 100644 --- a/filters/rate/rate.c +++ b/filters/rate/rate.c @@ -163,7 +163,7 @@ rate_get_ready (nbdkit_next_get_ready *next, void *nxdata) /* Create the per-connection handle. */ static void * rate_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct rate_handle *h; diff --git a/filters/retry/retry.c b/filters/retry/retry.c index be334c39..a2e57d77 100644 --- a/filters/retry/retry.c +++ b/filters/retry/retry.c @@ -113,7 +113,7 @@ struct retry_handle { static void * retry_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct retry_handle *h; diff --git a/filters/tar/tar.c b/filters/tar/tar.c index c04f09dd..ab041153 100644 --- a/filters/tar/tar.c +++ b/filters/tar/tar.c @@ -113,7 +113,7 @@ struct handle { static void * tar_open (nbdkit_next_open *next, nbdkit_backend *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h; diff --git a/filters/truncate/truncate.c b/filters/truncate/truncate.c index ee384871..00b5d8ce 100644 --- a/filters/truncate/truncate.c +++ b/filters/truncate/truncate.c @@ -125,7 +125,7 @@ struct handle { /* Open a connection. */ static void * truncate_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h; diff --git a/filters/xz/xz.c b/filters/xz/xz.c index 9154dbeb..26cfa959 100644 --- a/filters/xz/xz.c +++ b/filters/xz/xz.c @@ -90,7 +90,7 @@ struct xz_handle { /* Create the per-connection handle. */ static void * xz_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct xz_handle *h; diff --git a/tests/test-layers-filter.c b/tests/test-layers-filter.c index 397af575..5c5b3f0f 100644 --- a/tests/test-layers-filter.c +++ b/tests/test-layers-filter.c @@ -117,7 +117,7 @@ test_layers_filter_list_exports (nbdkit_next_list_exports *next, void *nxdata, static void * test_layers_filter_open (nbdkit_next_open *next, void *nxdata, - int readonly, const char *exportname) + int readonly, const char *exportname, int is_tls) { struct handle *h = malloc (sizeof *h); diff --git a/TODO b/TODO index 46f92443..262327fb 100644 --- a/TODO +++ b/TODO @@ -62,11 +62,11 @@ General ideas for improvements continue to keep their non-standard handshake while utilizing nbdkit to prototype new behaviors in serving the kernel. -* When using --tls=on (encryption is supported but not required), - plugins need to be able to differentiate which content they serve to - plaintext clients vs. secure clients. This may require an - alteration of the signature for .list_exports and .open, or a new - utility function nbdkit_tls_mode() similar to nbdkit_export_name(). +* The current signature of .list_exports is awkward; it overloads the + list response to NBD_OPT_LIST with the resolution of the default + export name in .open, and it is missing a tls parameter. It is + probably worth splitting out a new .default_export callback for the + latter purpose, as well as fixing the signature for the former. * Background thread for filters. Some filters (readahead, cache and proposed scan filter - see below) could be more effective if they @@ -308,7 +308,6 @@ using ‘#define NBDKIT_API_VERSION <version>’. and filters, and the type of the values, and both check and parse them for the plugin. -* Modify open() API so it takes an export name parameter, and maybe a - tls mode. +* Modify open() API so it takes an export name and tls parameter. * Change config_help from a variable to a function. -- 2.28.0

The next patch wants to add a filter that will prevent DoS attacks from a plaintext client; to be successful, the filter must guarantee that nbdkit did not settle on SERIALIZE_CONNECTIONS. The easiest way to solve this is to expose the final thread model to .get_ready, which is after the point where .config_complete may have altered it, and before any connections are permitted. Signed-off-by: Eric Blake <eblake(a)redhat.com&gt; --- docs/nbdkit-filter.pod | 9 ++++++++- include/nbdkit-filter.h | 3 ++- server/filters.c | 4 ++-- filters/extentlist/extentlist.c | 3 ++- filters/log/log.c | 2 +- filters/rate/rate.c | 2 +- filters/stats/stats.c | 2 +- tests/test-layers-filter.c | 2 +- 8 files changed, 18 insertions(+), 9 deletions(-) diff --git a/docs/nbdkit-filter.pod b/docs/nbdkit-filter.pod index b6ed5504..32db0938 100644 --- a/docs/nbdkit-filter.pod +++ b/docs/nbdkit-filter.pod @@ -298,11 +298,18 @@ with an error message and return C<-1>. =head2 C<.get_ready> - int (*get_ready) (nbdkit_next_get_ready *next, void *nxdata); + int (*get_ready) (nbdkit_next_get_ready *next, void *nxdata, + int thread_model); This intercepts the plugin C<.get_ready> method and can be used by the filter to get ready to serve requests. +The C<thread_model> parameter informs the filter about the final +thread model chosen by nbdkit after considering the results of +C<.thread_model> of all filters in the chain after C<.config>. This +does not need to be passed on to C<next>, as the model can no longer +be altered at this point. + If there is an error, C<.get_ready> should call C<nbdkit_error> with an error message and return C<-1>. diff --git a/include/nbdkit-filter.h b/include/nbdkit-filter.h index 708a1b54..6aba1aec 100644 --- a/include/nbdkit-filter.h +++ b/include/nbdkit-filter.h @@ -166,7 +166,8 @@ struct nbdkit_filter { nbdkit_backend *nxdata); const char *config_help; int (*thread_model) (void); - int (*get_ready) (nbdkit_next_get_ready *next, nbdkit_backend *nxdata); + int (*get_ready) (nbdkit_next_get_ready *next, nbdkit_backend *nxdata, + int thread_model); int (*after_fork) (nbdkit_next_after_fork *next, nbdkit_backend *nxdata); int (*preconnect) (nbdkit_next_preconnect *next, nbdkit_backend *nxdata, int readonly); diff --git a/server/filters.c b/server/filters.c index 90a9a948..0cfae344 100644 --- a/server/filters.c +++ b/server/filters.c @@ -183,10 +183,10 @@ filter_get_ready (struct backend *b) { struct backend_filter *f = container_of (b, struct backend_filter, backend); - debug ("%s: get_ready", b->name); + debug ("%s: get_ready thread_model=%d", b->name, thread_model); if (f->filter.get_ready) { - if (f->filter.get_ready (next_get_ready, b->next) == -1) + if (f->filter.get_ready (next_get_ready, b->next, thread_model) == -1) exit (EXIT_FAILURE); } else diff --git a/filters/extentlist/extentlist.c b/filters/extentlist/extentlist.c index 3005b790..dfb5e808 100644 --- a/filters/extentlist/extentlist.c +++ b/filters/extentlist/extentlist.c @@ -260,7 +260,8 @@ parse_extentlist (void) } static int -extentlist_get_ready (nbdkit_next_get_ready *next, void *nxdata) +extentlist_get_ready (nbdkit_next_get_ready *next, void *nxdata, + int thread_model) { parse_extentlist (); diff --git a/filters/log/log.c b/filters/log/log.c index f8da9ad8..6a3a9b14 100644 --- a/filters/log/log.c +++ b/filters/log/log.c @@ -100,7 +100,7 @@ log_config_complete (nbdkit_next_config_complete *next, void *nxdata) /* Open the logfile. */ static int -log_get_ready (nbdkit_next_get_ready *next, void *nxdata) +log_get_ready (nbdkit_next_get_ready *next, void *nxdata, int thread_model) { int fd; diff --git a/filters/rate/rate.c b/filters/rate/rate.c index 32c47fdf..325f5657 100644 --- a/filters/rate/rate.c +++ b/filters/rate/rate.c @@ -145,7 +145,7 @@ rate_config (nbdkit_next_config *next, void *nxdata, } static int -rate_get_ready (nbdkit_next_get_ready *next, void *nxdata) +rate_get_ready (nbdkit_next_get_ready *next, void *nxdata, int thread_model) { /* Initialize the global buckets. */ bucket_init (&read_bucket, rate, BUCKET_CAPACITY); diff --git a/filters/stats/stats.c b/filters/stats/stats.c index 688078ec..687dd05b 100644 --- a/filters/stats/stats.c +++ b/filters/stats/stats.c @@ -210,7 +210,7 @@ stats_config_complete (nbdkit_next_config_complete *next, void *nxdata) } static int -stats_get_ready (nbdkit_next_get_ready *next, void *nxdata) +stats_get_ready (nbdkit_next_get_ready *next, void *nxdata, int thread_model) { int fd; diff --git a/tests/test-layers-filter.c b/tests/test-layers-filter.c index 5c5b3f0f..3f295588 100644 --- a/tests/test-layers-filter.c +++ b/tests/test-layers-filter.c @@ -84,7 +84,7 @@ test_layers_filter_config_complete (nbdkit_next_config_complete *next, static int test_layers_filter_get_ready (nbdkit_next_get_ready *next, - void *nxdata) + void *nxdata, int thread_model) { DEBUG_FUNCTION; return next (nxdata); -- 2.28.0

On 8/7/20 5:00 PM, Eric Blake wrote: I got a test working (although it still shows that we are bit awkward until nbdkit makes it easier for filters to skip calling next_open when it wants to) diff --git c/tests/Makefile.am i/tests/Makefile.am index b5ef96a7..dd756723 100644 --- c/tests/Makefile.am +++ i/tests/Makefile.am @@ -1501,6 +1501,10 @@ EXTRA_DIST += \ test-truncate-extents.sh \ $(NULL) +# tlsdummy filter test. +TESTS += test-tlsdummy.sh +EXTRA_DIST += test-tlsdummy.sh + # xz filter test. LIBGUESTFS_TESTS += test-xz diff --git c/tests/test-tlsdummy.sh i/tests/test-tlsdummy.sh new file mode 100755 index 00000000..40c29602 --- /dev/null +++ i/tests/test-tlsdummy.sh @@ -0,0 +1,98 @@ +#!/usr/bin/env bash +# nbdkit +# Copyright (C) 2019-2020 Red Hat Inc. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# * Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# * Neither the name of Red Hat nor the names of its contributors may be +# used to endorse or promote products derived from this software without +# specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, +# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A +# PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR +# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF +# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND +# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +# OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT +# OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +source ./functions.sh +set -e +set -x + +requires nbdsh -c 'exit (not h.supports_tls ())' + +# Does the nbdkit binary support TLS? +if ! nbdkit --dump-config | grep -sq tls=yes; then + echo "$0: nbdkit built without TLS support" + exit 77 +fi + +# Did we create the PSK keys file? +# Probably 'certtool' is missing. +if [ ! -s keys.psk ]; then + echo "$0: PSK keys file was not created by the test harness" + exit 77 +fi + +export sock=`mktemp -u` +pid="tlsdummy.pid" + +files="$sock $pid" +rm -f $files +cleanup_fn rm -f $files + +# Run dual-mode server +start_nbdkit -P $pid -U $sock --tls=on --tls-psk=keys.psk \ + --filter=tlsdummy sh - tlsreadme=$'dummy\n' <<\EOF +if test "$2" = insecure; then + echo 'EINVAL insecure handle' 2>&1; exit 1 +fi +case $1 in + list_exports) echo NAMES; echo hello; echo world ;; + open) if test "$4" != true; then + # nbdkit needs a fix to let tlsdummy skip .open when insecure... + # echo 'EINVAL unexpected tls mode' 2>&1; exit 1 + echo insecure; exit 0 + fi + echo $3 ;; + get_size) echo 6 ;; + pread) echo "$2" | dd skip=$4 count=$3 iflag=skip_bytes,count_bytes ;; + *) exit 2; +esac +EOF + +# Plaintext client sees only dummy volume +nbdsh -c ' +import os +h.set_export_name ("hello") +h.connect_unix (os.environ["sock"]) +assert h.get_size () == 512 +assert h.pread (5, 0) == b"dummy" +' + +# Encrypted client sees desired volumes +nbdsh -c ' +import os +h.set_export_name ("hello") +h.set_tls (nbd.TLS_REQUIRE) +h.set_tls_psk_file ("keys.psk") +h.set_tls_username ("qemu") +h.connect_unix (os.environ["sock"]) +assert h.get_size () == 6 +assert h.pread (5, 0) == b"hello" +' -- Eric Blake, Principal Software Engineer Red Hat, Inc. +1-919-301-3226 Virtualization: qemu.org | libvirt.org