Commit Graph
231 Commits
Author SHA1 Message Date
Vitaliy Filippov 80a05c052a Add request size validation to prevent OOMDoS 2026-05-01 15:57:15 +03:00
Vitaliy Filippov a972c13571 Implement OSD-side authorization for operations 2026-04-29 02:42:23 +03:00
Vitaliy Filippov 9372df4beb Remove tls_ from option names 2026-04-27 15:41:00 +03:00
Vitaliy Filippov 24c27386b6 Remove TLS support (superseded by direct GCM) 2026-04-27 15:41:00 +03:00
Vitaliy Filippov 394de5e9aa Implement TLS 1.3-like handshake manually 2026-04-27 15:24:44 +03:00
Vitaliy Filippov be61e76df0 Extract openssl-related code, wire ssl implementation back 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 5cad126987 Coalesce entries in send_out_buf 2026-04-27 15:24:44 +03:00
Vitaliy Filippov afa50a05b8 Support isa-l_crypto for AES-XTS too 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 9ff833178e Fix xts+rdma encrypt errors 2026-04-27 15:24:44 +03:00
Vitaliy Filippov b152baa733 Fix "use-after-realloc" warning 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 8dbbf4097a Support isa-l_crypto for AES-GCM 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 17cb875e10 Remove WITH_OPENSSL from all files except http_client, always require OpenSSL 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 03e15338e5 Use pools for GCM contexts 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 440a8bc33a Implement direct AES-256-GCM with a static key for benchmark 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 78a21542da Make sure to send all TLS data before continuing 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 75ba9509ad Parse standard TLS record headers 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 8b58fe9808 Omit msgr_tls_record_hdr_t for non-tls data 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 331f345a78 Allow 2 and 4 byte per block chain_info (allow more than 255 snapshots with encryption) 2026-04-27 15:24:44 +03:00
Vitaliy Filippov d0a4ac914b Implement OSD TLS support 2026-04-27 15:24:44 +03:00
Vitaliy Filippov e42b812323 Allow to skip checksums for headers 2026-04-27 15:24:44 +03:00
Vitaliy Filippov ac5c753735 Implement protocol-level checksums (xxhash3) 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 3489c99640 Do not use scrap_buffer in the client (it would block protocol checksum support) 2026-04-27 15:24:44 +03:00
Vitaliy Filippov a21dcd4480 Support TLS CN authentication and per-image permissions in vitastor-cli serve 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 0053a0d825 Add image owner/owner_group/reader_group support (for antietcd VitastorAuthFilter) 2026-04-27 15:24:44 +03:00
Vitaliy Filippov c0e34b19c9 Support inline (string PEM) certificates and pkeys 2026-04-27 15:24:44 +03:00
Vitaliy Filippov e8abe99205 Show encryption keys (only IDs) in the listing 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 8225b37f53 Support storing image encryption keys in Vault 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 62b29b03c5 Prefer local etcd addresses and correctly cycle over them even when they need resolving
Seems slightly overcomplicated...
2026-04-27 15:24:44 +03:00
Vitaliy Filippov ae2f570b58 Support DNS resolving via libc-ares 2026-04-27 15:24:44 +03:00
Vitaliy Filippov d7f854ab3e Batch handle_immediate_ops more 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 66a016f8a1 Support reading from snapshots encrypted with different keys 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 34d01f44db Support decryption with multiple keys 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 3956982112 Allow to return chain_info in response to reads 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 713b17e574 Add basic AES-XTS client-side encryption support 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 4efa48c9ca Rework msgr send/receive to allow encryption support 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 6ca1b9eca9 Implement HTTP server support O_o 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 876dbd730a Rename http_response_t to http_message_t 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 4398ee0377 Extract common HTTP context 2026-04-27 15:24:44 +03:00
Vitaliy Filippov 2a093cbfb5 Add client certificate support 2026-04-27 15:24:43 +03:00
Vitaliy Filippov 094a181491 Do not re-initialize TLS context every connection 2026-04-27 15:24:43 +03:00
Vitaliy Filippov e9a6c58418 Implement etcd SSL support via OpenSSL
Maybe I should remove all of this and use libwebsockets :)
2026-04-27 15:24:43 +03:00
Vitaliy Filippov 4acfe149cb Release 3.0.10
Important bug fixes (new store):
- Fix OSDs possibly refusing to start with "write metadata failed at offset xxx: Invalid argument"
  (fix buffer alignment during initial garbage collection)
- Rollback change from 3.0.4 - on-disk garbage entries are not skipped on start again. This change
  doesn't have any impact normally, but OSDs originally running 3.0.0-3.0.2 and then upgraded
  to 3.0.9 may hit a bug where 3.0.9 refuses to start due to entries marked as garbage too
  early and flushed to disk in 3.0.0-3.0.2.

Other changes:
- Auto-select the only RDMA device/port if there is only one
- Rollback one 3.0.9 change - there was no actual use-after-free :)
  (the problem was only relevant to an unstable development version)
- Fix `vitastor-nfs --trace` option
- Fix an unintended 1 second sleep in vitastor-cli rm-data
- Fix inode statistics not being cleared for a deleted pool
- Fix print to stdout in client
2026-04-27 13:53:48 +03:00
Vitaliy Filippov 008ed5b269 Rollback 25ecca7625 - there was no actual use-after-free :) 2026-04-22 01:35:38 +03:00
Vitaliy Filippov 8832fc3b14 Fix print to stdout in client 2026-04-14 02:43:50 +03:00
Vitaliy Filippov bcc6419760 Auto-select the only RDMA device/port if there is only one 2026-04-08 15:46:10 +03:00
Vitaliy Filippov dd5941b9a4 Release 3.0.9
- Fix broken garbage collection in the new store leading to very high memory usage
- Make the new store do full garbage collection on OSD startup by default (can be turned off with a new gc_on_start parameter)
- Make startup logging with the new store more informative, allow to log amount of garbage with log_level > 1
- Fix clients reading from snapshots incorrectly on retries (for example when OSDs were restarted during read)
- Fix a possible "send-after-free" in OSD which could probably also affect snapshot reads
- Fix OSD crashing when handling a read_bitmap operation from a deleted object with the new store
2026-04-04 18:38:40 +03:00
Vitaliy Filippov 25ecca7625 Fix use-after-free in OSD ops (ooops) 2026-04-02 13:48:17 +00:00
Vitaliy Filippov 9949b9fb4e Fix incorrect reads from snapshots on retries 2026-03-31 02:06:53 +03:00
Vitaliy Filippov b30635b932 Release 3.0.8
- Surrogate increment-only peer IDs are now used instead of file descriptor numbers,
  and client cleanup sequence is reworked in another attempt to fix a possible PG hang
  in 'peering' states. The history of this bug is still unclear and it still hasn't been
  reproduced in tests, but several users have reported it since 3.0.4 (only with enabled RDMA).
- Fix a minor bug where an OSD could skip reporting misplaced PG state when moving
  an object in non-immediate_commit mode.
- Add Ubuntu 26.04 (Resolute Raccoon) support and patches for qemu 10.2 and libvirt 12.0
2026-03-30 02:09:02 +03:00
Vitaliy Filippov dd85315f22 Update CMake supported versions 2026-03-30 02:06:10 +03:00