From aa71a1968fb60753ccb66c81cc5f4055d611810f Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Sun, 28 Jun 2026 17:50:19 +0300 Subject: [PATCH] Rename use_auth to use_perms --- mon/antietcd_adapter.js | 4 ++-- src/cmd/cli.cpp | 2 +- src/cmd/cli_serve.cpp | 20 ++++++++++---------- src/osd/osd.cpp | 6 +++--- src/osd/osd.h | 2 +- src/osd/osd_primary.cpp | 2 +- src/osd/osd_primary_describe.cpp | 2 +- src/osd/osd_primary_sync.cpp | 2 +- src/osd/osd_secondary.cpp | 2 +- tests/common.sh | 2 +- 10 files changed, 22 insertions(+), 22 deletions(-) diff --git a/mon/antietcd_adapter.js b/mon/antietcd_adapter.js index 5747fe0b..9fe206be 100644 --- a/mon/antietcd_adapter.js +++ b/mon/antietcd_adapter.js @@ -78,8 +78,8 @@ class AntiEtcdAdapter delete antietcd_config.cluster; delete antietcd_config.cluster_key; } - const use_auth = config.use_auth || config.use_auth == null && config.client_ca; - if (use_auth) + const use_perms = config.use_perms || config.use_perms == null && config.client_ca; + if (use_perms) { antietcd_config.client_cert_auth = true; antietcd_config.auth_filter = vitastor_auth_filter; diff --git a/src/cmd/cli.cpp b/src/cmd/cli.cpp index 30a59c34..5a6e09ae 100644 --- a/src/cmd/cli.cpp +++ b/src/cmd/cli.cpp @@ -265,7 +265,7 @@ static const char* help_text = " --bind_address ADDR Specify server IP address or addresses, separated by space. Default is 127.0.0.1.\n" " --port 8080 Specify server port.\n" " --server_cert FILE Path to server TLS certificate file (PEM format).\n" - " --server_key FILE Path to server TLS private key file.\n" + " --server_pkey FILE Path to server TLS private key file.\n" " --client_ca FILE Path to file with TLS CA certificates used to validate client connections.\n" "\n" "Use vitastor-cli --help for command details or vitastor-cli --help --all for all details.\n" diff --git a/src/cmd/cli_serve.cpp b/src/cmd/cli_serve.cpp index 715e47db..aee13ff4 100644 --- a/src/cmd/cli_serve.cpp +++ b/src/cmd/cli_serve.cpp @@ -76,7 +76,7 @@ struct cli_serve_t int port = 0; int listen_backlog = 0; bool ssl = false; - bool use_auth = false; + bool use_perms = false; std::vector listen_fds; http_context_t *http_ctx = NULL; std::set connections; @@ -115,8 +115,8 @@ struct cli_serve_t { std::string tls_cert = (parent->cli->config.find("server_cert") != parent->cli->config.end() ? parent->cli->config["server_cert"].string_value() : ""); - std::string tls_key = (parent->cli->config.find("server_key") != parent->cli->config.end() - ? parent->cli->config["server_key"].string_value() : ""); + std::string tls_key = (parent->cli->config.find("server_pkey") != parent->cli->config.end() + ? parent->cli->config["server_pkey"].string_value() : ""); std::string tls_ca = (parent->cli->config.find("client_ca") != parent->cli->config.end() ? parent->cli->config["client_ca"].string_value() : ""); if (tls_cert != "" || tls_key != "" || tls_ca != "") @@ -124,14 +124,14 @@ struct cli_serve_t ssl = true; if (tls_cert == "" || tls_key == "") { - result = (cli_result_t){ .err = EINVAL, .text = "server_cert and server_key are required to serve HTTPS" }; + result = (cli_result_t){ .err = EINVAL, .text = "server_cert and server_pkey are required to serve HTTPS" }; state = 100; return; } - // use_auth is enabled by default when client_ca is set - use_auth = (parent->cli->config["use_auth"].is_null() + // use_perms is enabled by default when client_ca is set + use_perms = (parent->cli->config["use_perms"].is_null() ? (tls_ca != "") - : json_is_true(parent->cli->config["use_auth"])); + : json_is_true(parent->cli->config["use_perms"])); std::string error; http_ctx = http_context_init(parent->epmgr->tfd, tls_cert, tls_key, tls_ca, tls_ca != "", error); if (error != "") @@ -360,7 +360,7 @@ struct cli_serve_t conn->request_path = std::move(req_line[1]); conn->request_body = std::move(msg->body); conn->response_type = ""; - if (use_auth) + if (use_perms) { conn->p->user = parent->cli->st_cli->get_user(msg->headers["_tls_common_name"]); } @@ -391,7 +391,7 @@ struct cli_serve_t { conn->response_type = "application/json"; conn->result = { .text = openapi_description }; - if (use_auth) + if (use_perms) { // Filter available paths by privileges if (conn->p->user->type == user_type_t::CLIENT) @@ -426,7 +426,7 @@ struct cli_serve_t { conn->result = { .err = ENOSYS, .text = "method /"+uri[0]+" only allows POST requests" }; } - else if (use_auth && conn->p->user->type == user_type_t::CLIENT && !cmd_it->second.allow_client) + else if (use_perms && conn->p->user->type == user_type_t::CLIENT && !cmd_it->second.allow_client) { conn->result = { .err = EACCES, .text = "Access denied" }; } diff --git a/src/osd/osd.cpp b/src/osd/osd.cpp index 12c5fc03..69f9b4a3 100644 --- a/src/osd/osd.cpp +++ b/src/osd/osd.cpp @@ -191,10 +191,10 @@ void osd_t::parse_config(bool init) msgr.parse_config(config, init); if (init) { - // use_auth is enabled by default when encryption is enabled - use_auth = (config["use_auth"].is_null() + // use_perms is enabled by default when encryption is enabled + use_perms = (config["use_perms"].is_null() ? msgr.is_encryption_enabled() - : json_is_true(config["use_auth"])); + : json_is_true(config["use_perms"])); // Vital Blockstore parameters bs_block_size = config["block_size"].uint64_value(); if (!bs_block_size) diff --git a/src/osd/osd.h b/src/osd/osd.h index de293288..744db21b 100644 --- a/src/osd/osd.h +++ b/src/osd/osd.h @@ -161,7 +161,7 @@ class osd_t std::unique_ptr st_cli; std::function bs_factory; osd_messenger_t msgr; - bool use_auth = false; + bool use_perms = false; int etcd_failed_attempts = 0; std::string etcd_lease_id; json11::Json self_state; diff --git a/src/osd/osd_primary.cpp b/src/osd/osd_primary.cpp index 3ec7d35d..bcef3876 100644 --- a/src/osd/osd_primary.cpp +++ b/src/osd/osd_primary.cpp @@ -71,7 +71,7 @@ bool osd_t::prepare_primary_rw(osd_op_t *cur_op) finish_op(cur_op, -EINVAL); return false; } - if (use_auth && cur_op->client_id != SELF_CLIENT) + if (use_perms && cur_op->client_id != SELF_CLIENT) { osd_client_t *cl = msgr.clients.at(cur_op->client_id); if (cl->hs_result.peer_is_osd) diff --git a/src/osd/osd_primary_describe.cpp b/src/osd/osd_primary_describe.cpp index 0704619e..c118f460 100644 --- a/src/osd/osd_primary_describe.cpp +++ b/src/osd/osd_primary_describe.cpp @@ -91,7 +91,7 @@ static void scan_lists(std::vector & lists, uint64_t limit, desc // Describe unclean objects void osd_t::continue_primary_describe(osd_op_t *cur_op) { - if (use_auth) + if (use_perms) { osd_client_t *cl = msgr.clients.at(cur_op->client_id); if (cl->hs_result.peer_is_osd) diff --git a/src/osd/osd_primary_sync.cpp b/src/osd/osd_primary_sync.cpp index 6174a7e9..18de8fd5 100644 --- a/src/osd/osd_primary_sync.cpp +++ b/src/osd/osd_primary_sync.cpp @@ -8,7 +8,7 @@ void osd_t::continue_primary_sync(osd_op_t *cur_op) { if (!cur_op->op_data) { - if (use_auth && cur_op->client_id != SELF_CLIENT) + if (use_perms && cur_op->client_id != SELF_CLIENT) { osd_client_t *cl = msgr.clients.at(cur_op->client_id); if (cl->hs_result.peer_is_osd) diff --git a/src/osd/osd_secondary.cpp b/src/osd/osd_secondary.cpp index de35787e..bc55cfcb 100644 --- a/src/osd/osd_secondary.cpp +++ b/src/osd/osd_secondary.cpp @@ -115,7 +115,7 @@ bool osd_t::sec_check_pg_lock(osd_num_t primary_osd, const object_id &oid, uint3 void osd_t::exec_secondary_real(osd_op_t *cur_op) { osd_client_t *cl = msgr.clients.at(cur_op->client_id); - if (use_auth && !cl->hs_result.peer_is_osd) + if (use_perms && !cl->hs_result.peer_is_osd) { // Non-OSDs are not allowed to execute "secondary" operations except LIST bool allowed = false; diff --git a/tests/common.sh b/tests/common.sh index be4c7b08..20ef9f5b 100644 --- a/tests/common.sh +++ b/tests/common.sh @@ -144,7 +144,7 @@ if [[ "$OSD_TLS" = "1" ]]; then VITASTOR_CFG="$VITASTOR_CFG"',"client_ca":"'$(pwd)'/testdata/client_ca.crt"' VITASTOR_CFG="$VITASTOR_CFG"',"cert":"'$(pwd)'/testdata/cli.crt"' VITASTOR_CFG="$VITASTOR_CFG"',"pkey":"'$(pwd)'/testdata/cli.key"' - VITASTOR_CFG="$VITASTOR_CFG"',"use_auth":false' + VITASTOR_CFG="$VITASTOR_CFG"',"use_perms":false' fi echo "{$VITASTOR_CFG}" > ./testdata/vitastor.conf VITASTOR_CFG=./testdata/vitastor.conf