Bug 764731 (GLUSTER-2999)
| Summary: | Support SSL in socket transport | ||
|---|---|---|---|
| Product: | [Community] GlusterFS | Reporter: | Jeff Darcy <jdarcy> |
| Component: | transport | Assignee: | Vijay Bellur <vbellur> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | medium | ||
| Version: | mainline | CC: | amarts, gluster-bugs |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | glusterfs-3.4.0 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-07-24 17:48:53 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 895528 | ||
vijay, Du is not working on this. As Jeff already has it working, putting you as assignee to take care of this. CHANGE: http://review.gluster.com/362 (rpc-transport/socket: Add SSL support.) merged in master by Anand Avati (avati) CHANGE: http://review.gluster.com/3701 (rpc/socket: finish initialization in own thread) merged in master by Anand Avati (avati) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#3) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#4) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#5) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#6) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#7) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#8) for review on master by Jeff Darcy (jdarcy) REVIEW: http://review.gluster.org/3695 (rpc/auth: allow SSL identity to be used for authorization) posted (#9) for review on master by Jeff Darcy (jdarcy) |
I have a patch that adds SSL (based on OpenSSL) as an option for the socket transport. Actually it's three options: * transport.socket.ssl-own-cert: this server's certificate * transport.socket.ssl-private-key: key matching own-cert * transport.socket.ssl-ca-list: list of trusted certificates (including CA certs) If all three options are specified, then SSL support will be enabled. If one or two are specified, a warning will be issued and SSL will not be enabled. If none are specified, behavior remains as it was before. This patch also includes socket multi-threading ("gatling gun") changes, to mitigate the performance impact of calling ssl_read/ssl_write from a single polling thread. This is also controlled by an option: * transport.socket.own-thread: use own per-socket polling thread This option is initially enabled if SSL is enabled (see above) but can be overridden in the volfile. It's effect on performance without SSL ranges from neutral to slightly positive (e.g. one client connecting to many servers). With SSL enabled, it can have about a 2.5x positive effect on performance - probably even more with increasing numbers of servers and cores.