1. 06 Apr, 2015 2 commits
  2. 31 Mar, 2015 1 commit
    • Mike Hibler's avatar
      Add sitevar to determine whether clients should use UDP or TCP for NFS. · f1ae820e
      Mike Hibler authored
      Yes, out of the blue and off the wall. But I got tired of trying to
      guess what we had Linux and FreeBSD use. I was surprised to discover
      that we were using UDP on Linux (which caused Clemson CloudLab to fail
      because they have jumbo frames enabled on their control net switches
      but ops had the MTU set to 1500).
      
      Anyway, here it is. The default setting is UDP for backward compat.
      We should probably set it to TCP nowadays. There is also an 'osdefault'
      setting which says use the default setting on the client OS.
      f1ae820e
  3. 06 Mar, 2015 1 commit
  4. 05 Mar, 2015 1 commit
  5. 03 Feb, 2015 1 commit
  6. 22 Jan, 2015 1 commit
  7. 08 Jan, 2015 1 commit
    • Kirk Webb's avatar
      Backend support for simultaneous read-only dataset access. · 9b6e1a59
      Kirk Webb authored
      Any number of users/experiments can mount a given dataset (given that
      they have permission) in read-only mode.  Attempts to mount RW will
      fail if the dataset is currently in use.  Attempts to mount RO while
      the dataset is in use RW are also prohibited.
      
      Under the hood, iSCSI lease exports (targets) are now managed per-lease
      instead of per-experiment.  The set of authorized initiators (based
      on network) is manipulated as consumers come and go.  When the last
      consumer goes, the export is torn down. Likewise, if there are no
      current consumers, a new consumer will cause an iSCSI export to be
      created for the lease.
      
      Also included in this commit is a small tweak to implicit lease permissions.
      9b6e1a59
  8. 21 Dec, 2014 1 commit
  9. 07 Dec, 2014 1 commit
    • Mike Hibler's avatar
      Generalize bootlog read-more-from-socket code. · c36f6eab
      Mike Hibler authored
      Long ago Leigh added code in the bootlog command to account for the fact that
      you might not get all the data associated with a TCP-based command in one
      read from the socket. This case also showed up with the hostkeys command
      with uploaded multiple pubkeys.
      
      So I moved the code up to handle_requests so that for all TCP-based
      commands, we read til we get EOF.
      c36f6eab
  10. 02 Dec, 2014 1 commit
  11. 01 Dec, 2014 1 commit
    • Mike Hibler's avatar
      Rudimentary TRIM support. · bdde40fe
      Mike Hibler authored
      We pass through a flag in the tmcd loadinfo call to tell whether to attempt
      to do a TRIM when loading the disk (or after loading the disk). If TRIM=1
      then we do so.
      
      Since it is not clear from what I have read whether repeated TRIMming is
      a detriment to SSD life, we throttle it as follows:
      
      1. We don't TRIM at all unless the sitevariable general/bootdisk_trim_interval
         is non zero. If it is set, we will wait at least that many seconds after
         the previous TRIM before we do it again.
      
      2. We keep track of the last trim via the node_attribute "bootdisk_lasttrim"
         which is a unix timestamp of the last time that tmcd responded to a
         loadinfo request in which it returned TRIM=1.
      
      2. We track, on a per-node basis, whether the boot disk should be TRIMmed
         or not. If the node or node-type attribute "bootdisk_trim" is non-zero,
         we will attempt a trim if the interval has passed since the last trim.
      
      So, we never trim if the sitevariable is 0 (the default value). If it is
      non-zero, we only trim the boot disk of those nodes that have the node or
      node_type attribute set and only after a sufficient interval has passed.
      
      This does not address non-boot disks, but currently frisbee won't mess
      with any other disk anyway. Eventually, we will have to have per-disk or
      per-disktype attributes if we want to do this better.
      bdde40fe
  12. 26 Nov, 2014 1 commit
    • Kirk Webb's avatar
      Fix account listing for vnodes on shared hosts. · 2b2c7bd3
      Kirk Webb authored
      In my cleanup of the "doaccounts" code, it looks like I was a bit
      overzealous. The logic for detecting when a node is a shared vnode
      host was incomplete, and so matched for the vnodes themselves too.
      2b2c7bd3
  13. 25 Nov, 2014 1 commit
  14. 19 Nov, 2014 1 commit
    • Kirk Webb's avatar
      Sprinkle taint checks throughout tmcd to avert privilege escalation. · d9c27fac
      Kirk Webb authored
      Also add utility function to allow the node to get the exact details of
      the image it is running ('imageinfo').
      
      Some of the taint checks are rather heavy-handed presently.  Pretty much
      any vector that could be used by the user to do something as root has
      been severed right at the top of the relevant tmcd calls.
      
      Calls affected:
      
      manifest ('blackbox' and 'useronly' taintstates)
      rpms ('blackbox' and 'useronly' taintstates)
      tarballs ('blackbox' and 'useronly' taintstates)
      blobs ('blackbox' and 'useronly' taintstates)
      startupcmd ('blackbox' taintstate)
      mounts ('blackbox' taintstate)
      programs ('blackbox' taintstate)
      
      Taint handling for the 'accounts' call was dealt with in a prior commit.
      d9c27fac
  15. 12 Nov, 2014 1 commit
  16. 11 Nov, 2014 1 commit
    • Kirk Webb's avatar
      Add taint checking and enforcement to the tmcc "accounts" command. · 16a63146
      Kirk Webb authored
      Taints applied to a node are now extracted from the database and can be
      used wherever taint checking needs to happen in tmcd.  I've applied them
      to the "accounts" command.  tmcd will never set the "root" flag for
      non-admin users on OSes tainted with "useronly".  It won't return any
      regular user accounts on nodes with the "blackbox" taint (but will
      pass along admin accounts).
      16a63146
  17. 06 Oct, 2014 2 commits
    • Mike Hibler's avatar
      Refine the interface info returned by hwinfo. · 5a2bc8fd
      Mike Hibler authored
      We do NOT return interfaces:
        - with obviously hacky and fake addresses: '000000xxxxxx'
      
        - when they are management (role == 'mngmnt') interfaces.
          Currently there is no OS visible HW for these, the corresponding
          MACs are just used by the management HW.
      
        - for Infiniband (guid != NULL) interfaces. We need support on
          the client side before we start sending those over.
      5a2bc8fd
    • Mike Hibler's avatar
      Move setting of IQN prefix to defs-* file. · f5431f50
      Mike Hibler authored
      No more hardwiring in bsdefs.h (which has been moved out
      of the clientside dir since it is only used in tmcd.c).
      f5431f50
  18. 15 Sep, 2014 1 commit
  19. 02 Sep, 2014 1 commit
  20. 20 Aug, 2014 1 commit
  21. 14 Aug, 2014 1 commit
  22. 07 Aug, 2014 2 commits
  23. 25 Jul, 2014 1 commit
  24. 17 Jul, 2014 1 commit
    • Mike Hibler's avatar
      Retroactively add a version number check before returning BOOTPART= · ea0d1fcc
      Mike Hibler authored
      From the comment:
           * "BOOTPART=" confuses the old rc.frisbee argument parsing
           * which looks for "PART=" with the RE ".*PART=" which will
           * match BOOTPART= instead. Thus an old script loading a
           * whole disk image (PART=0) winds up trying to load it in
           * partition 2 (BOOTPART=2). So we can pick one of two
           * versions, the one in effect when rc.frisbee changed its
           * argument parsing (v30, circa 6/28/2010) or the version
           * in effect when BOOTPART was added (v36, circa 6/13/2013).
           * We choose the latter.
      ea0d1fcc
  25. 12 Jul, 2014 1 commit
    • Mike Hibler's avatar
      Make sure we use -i for sendmail when we pipe into it. · 355f5aa8
      Mike Hibler authored
      This prevents a line with a single "." from meaning EOF to sendmail.
      How arcane!
      
      I discovered this when I ran a create_image and I didn't get the complete
      log mailed to me. This is because create_image did a frisbee download of an
      image with a single chunk, which of course printed out:
      
        Using Multicast 235.252.1.187
        Joined the team after 0 sec. ID is 1586355915. File is 1 chunks (963200 bytes)
        .
      
      Fortunately, "arcane" is my middle name, so it didn't take me long to find
      this...
      355f5aa8
  26. 02 Jul, 2014 1 commit
  27. 01 Jul, 2014 1 commit
  28. 30 May, 2014 1 commit
  29. 07 May, 2014 1 commit
    • Mike Hibler's avatar
      Introducing TMCD version 38! Returns additional "loadinfo" info. · 4a8604b1
      Mike Hibler authored
      New loadinfo returns:
      
      IMAGELOW, IMAGEHIGH: range of sectors covered by the image.
          This is NOT the same as what imageinfo or imagedump will show.
          For partition images, these low and high values are adjusted
          for the MBR offset of the partition in question. So when loading
          a Linux image, expect values like 6G and 12G. The intent here
          (not yet realized) is that these values will be used to construct
          an MBR/GPT on the fly, rather than using hardcode magic MBR versions.
          You can get the uncompressed size of the image with (high - low + 1).
      
      IMAGESSIZE: the units of the low/high values.
          Always 512 right now, may be 4096 someday.
      
      IMAGERELOC: non-zero if the image can be placed at an offset other
          than IMAGELOW (i.e., it can be relocated). This may or may not
          prove useful for dynamic MBR construction...we will see.
      
      Probably didn't need to bump the version here, but I am playing it safe.
      4a8604b1
  30. 07 Apr, 2014 1 commit
  31. 03 Apr, 2014 2 commits
    • Gary Wong's avatar
      Increase the limit on certain geni-get response lengths (esp. manifests). · 21c48518
      Gary Wong authored
      The old limit (2K) was big enough that essentially any hand-written
      rspec would work fine, but also small enough that pretty much any manifest
      for a Flack-generated request rspec would fail.
      21c48518
    • Leigh Stoller's avatar
      Return the root password hash in the jailconfig call. · fddcd467
      Leigh Stoller authored
      This allows dom0 to set the password of the guest at creation time, so
      that if something goes wrong, we can get in on the console. This also
      fixes an error where on a shared node, we were returning the password
      hash for the physical host. Return a per-node hash instead.
      
      Also abstract out the various places we get read from /dev/urandom.
      fddcd467
  32. 25 Mar, 2014 3 commits
    • Leigh Stoller's avatar
      Minor fix to previous revision. · 46cc4ef7
      Leigh Stoller authored
      46cc4ef7
    • Leigh Stoller's avatar
      Minor fix to previous revision. · ac13f646
      Leigh Stoller authored
      ac13f646
    • Leigh Stoller's avatar
      Server side of firewall support for XEN containers. · 2faea2f3
      Leigh Stoller authored
      This differs from the current firewall support, which assumes a single
      firewall for an entire experiment, hosted on a dedicated physical
      node. At some point, it would be better to host the dedicated firewall
      inside a XEN container, but that is a project for another day (year).
      
      Instead, I added two sets of firewall rules to the default_firewall_rules
      table, one for dom0 and another for domU. These follow the current
      style setup of open,basic,closed, while elabinelab is ignored since it
      does not make sense for this yet.
      
      These two rules sets are independent, the dom0 rules can be applied to
      the physical host, and domU rules can be applied to specific
      containers.
      
      My goal is that all shared nodes will get the dom0 closed rules (ssh
      from local boss only) to avoid the ssh attacks that all of the racks
      are seeing.
      
      DomU rules can be applied on a per-container (node) basis. As
      mentioned above this is quite different, and needed minor additions to
      the virt_nodes table to allow it.
      2faea2f3
  33. 10 Mar, 2014 1 commit
    • Mike Hibler's avatar
      Support "no NFS mount" experiments. · 5446760e
      Mike Hibler authored
      We have had the mechanism implemented in the client for some time and
      available at the site-level or, in special cases, at the node level.
      New NS command:
      
          tb-set-nonfs 1
      
      will ensure that no nodes in the experiment attempt to mount shared
      filesystems from ops (aka, "fs"). In this case, a minimal homdir is
      created on each node with basic dotfiles and your .ssh keys. There will
      also be empty /proj, /share, etc. directories created.
      
      One additional mechanism that we have now is that we do not export filesystems
      from ops to those nodes. Previously, it was all client-side and you could
      mount the shared FSes if you wanted to. By prohibiting the export of these
      filesystems, the mechanism is more suitable for "security" experiments.
      5446760e
  34. 22 Jan, 2014 1 commit
    • Mike Hibler's avatar
      Pass PERMS= param in storageconfig command. · 59b1c489
      Mike Hibler authored
      For persistent blockstores, is based on the value of the "readonly"
      virt_blockstore_attributes attribute if it exists. The RO attribute
      is set by libvtop when an attempt is made to use a lease that is in
      the 'grace' state.
      59b1c489