You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

257 lines
7.2 KiB

3 years ago
7 years ago
7 years ago
9 months ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
FEATURE: add JWT to HTTP endpoints of Filer and use them in S3 Client - one JWT for reading and one for writing, analogous to how the JWT between Master and Volume Server works - I did not implement IP `whiteList` parameter on the filer Additionally, because http_util.DownloadFile now sets the JWT, the `download` command should now work when `jwt.signing.read` is configured. By looking at the code, I think this case did not work before. ## Docs to be adjusted after a release Page `Amazon-S3-API`: ``` # Authentication with Filer You can use mTLS for the gRPC connection between S3-API-Proxy and the filer, as explained in [Security-Configuration](Security-Configuration) - controlled by the `grpc.*` configuration in `security.toml`. Starting with version XX, it is also possible to authenticate the HTTP operations between the S3-API-Proxy and the Filer (especially uploading new files). This is configured by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. With both configurations (gRPC and JWT), it is possible to have Filer and S3 communicate in fully authenticated fashion; so Filer will reject any unauthenticated communication. ``` Page `Security Overview`: ``` The following items are not covered, yet: - master server http REST services Starting with version XX, the Filer HTTP REST services can be secured with a JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. ... Before version XX: "weed filer -disableHttp", disable http operations, only gRPC operations are allowed. This works with "weed mount" by FUSE. It does **not work** with the [S3 Gateway](Amazon S3 API), as this does HTTP calls to the Filer. Starting with version XX: secured by JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. **This now works with the [S3 Gateway](Amazon S3 API).** ... # Securing Filer HTTP with JWT To enable JWT-based access control for the Filer, 1. generate `security.toml` file by `weed scaffold -config=security` 2. set `filer_jwt.signing.key` to a secret string - and optionally filer_jwt.signing.read.key` as well to a secret string 3. copy the same `security.toml` file to the filers and all S3 proxies. If `filer_jwt.signing.key` is configured: When sending upload/update/delete HTTP operations to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.key`. If `filer_jwt.signing.read.key` is configured: When sending GET or HEAD requests to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.read.key`. The S3 API Gateway reads the above JWT keys and sends authenticated HTTP requests to the filer. ``` Page `Security Configuration`: ``` (update scaffold file) ... [filer_jwt.signing] key = "blahblahblahblah" [filer_jwt.signing.read] key = "blahblahblahblah" ``` Resolves: #158
3 years ago
3 years ago
FEATURE: add JWT to HTTP endpoints of Filer and use them in S3 Client - one JWT for reading and one for writing, analogous to how the JWT between Master and Volume Server works - I did not implement IP `whiteList` parameter on the filer Additionally, because http_util.DownloadFile now sets the JWT, the `download` command should now work when `jwt.signing.read` is configured. By looking at the code, I think this case did not work before. ## Docs to be adjusted after a release Page `Amazon-S3-API`: ``` # Authentication with Filer You can use mTLS for the gRPC connection between S3-API-Proxy and the filer, as explained in [Security-Configuration](Security-Configuration) - controlled by the `grpc.*` configuration in `security.toml`. Starting with version XX, it is also possible to authenticate the HTTP operations between the S3-API-Proxy and the Filer (especially uploading new files). This is configured by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. With both configurations (gRPC and JWT), it is possible to have Filer and S3 communicate in fully authenticated fashion; so Filer will reject any unauthenticated communication. ``` Page `Security Overview`: ``` The following items are not covered, yet: - master server http REST services Starting with version XX, the Filer HTTP REST services can be secured with a JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. ... Before version XX: "weed filer -disableHttp", disable http operations, only gRPC operations are allowed. This works with "weed mount" by FUSE. It does **not work** with the [S3 Gateway](Amazon S3 API), as this does HTTP calls to the Filer. Starting with version XX: secured by JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. **This now works with the [S3 Gateway](Amazon S3 API).** ... # Securing Filer HTTP with JWT To enable JWT-based access control for the Filer, 1. generate `security.toml` file by `weed scaffold -config=security` 2. set `filer_jwt.signing.key` to a secret string - and optionally filer_jwt.signing.read.key` as well to a secret string 3. copy the same `security.toml` file to the filers and all S3 proxies. If `filer_jwt.signing.key` is configured: When sending upload/update/delete HTTP operations to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.key`. If `filer_jwt.signing.read.key` is configured: When sending GET or HEAD requests to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.read.key`. The S3 API Gateway reads the above JWT keys and sends authenticated HTTP requests to the filer. ``` Page `Security Configuration`: ``` (update scaffold file) ... [filer_jwt.signing] key = "blahblahblahblah" [filer_jwt.signing.read] key = "blahblahblahblah" ``` Resolves: #158
3 years ago
FEATURE: add JWT to HTTP endpoints of Filer and use them in S3 Client - one JWT for reading and one for writing, analogous to how the JWT between Master and Volume Server works - I did not implement IP `whiteList` parameter on the filer Additionally, because http_util.DownloadFile now sets the JWT, the `download` command should now work when `jwt.signing.read` is configured. By looking at the code, I think this case did not work before. ## Docs to be adjusted after a release Page `Amazon-S3-API`: ``` # Authentication with Filer You can use mTLS for the gRPC connection between S3-API-Proxy and the filer, as explained in [Security-Configuration](Security-Configuration) - controlled by the `grpc.*` configuration in `security.toml`. Starting with version XX, it is also possible to authenticate the HTTP operations between the S3-API-Proxy and the Filer (especially uploading new files). This is configured by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. With both configurations (gRPC and JWT), it is possible to have Filer and S3 communicate in fully authenticated fashion; so Filer will reject any unauthenticated communication. ``` Page `Security Overview`: ``` The following items are not covered, yet: - master server http REST services Starting with version XX, the Filer HTTP REST services can be secured with a JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. ... Before version XX: "weed filer -disableHttp", disable http operations, only gRPC operations are allowed. This works with "weed mount" by FUSE. It does **not work** with the [S3 Gateway](Amazon S3 API), as this does HTTP calls to the Filer. Starting with version XX: secured by JWT, by setting `filer_jwt.signing.key` and `filer_jwt.signing.read.key` in `security.toml`. **This now works with the [S3 Gateway](Amazon S3 API).** ... # Securing Filer HTTP with JWT To enable JWT-based access control for the Filer, 1. generate `security.toml` file by `weed scaffold -config=security` 2. set `filer_jwt.signing.key` to a secret string - and optionally filer_jwt.signing.read.key` as well to a secret string 3. copy the same `security.toml` file to the filers and all S3 proxies. If `filer_jwt.signing.key` is configured: When sending upload/update/delete HTTP operations to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.key`. If `filer_jwt.signing.read.key` is configured: When sending GET or HEAD requests to a filer server, the request header `Authorization` should be the JWT string (`Authorization: Bearer [JwtToken]`). The operation is authorized after the filer validates the JWT with `filer_jwt.signing.read.key`. The S3 API Gateway reads the above JWT keys and sends authenticated HTTP requests to the filer. ``` Page `Security Configuration`: ``` (update scaffold file) ... [filer_jwt.signing] key = "blahblahblahblah" [filer_jwt.signing.read] key = "blahblahblahblah" ``` Resolves: #158
3 years ago
3 years ago
3 years ago
4 years ago
3 years ago
5 years ago
  1. package s3api
  2. import (
  3. "bytes"
  4. "fmt"
  5. "github.com/seaweedfs/seaweedfs/weed/filer"
  6. "github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
  7. "io"
  8. "net/http"
  9. "net/url"
  10. "strings"
  11. "time"
  12. "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
  13. "github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
  14. "github.com/seaweedfs/seaweedfs/weed/util/mem"
  15. "github.com/seaweedfs/seaweedfs/weed/glog"
  16. "github.com/seaweedfs/seaweedfs/weed/util"
  17. )
  18. func mimeDetect(r *http.Request, dataReader io.Reader) io.ReadCloser {
  19. mimeBuffer := make([]byte, 512)
  20. size, _ := dataReader.Read(mimeBuffer)
  21. if size > 0 {
  22. r.Header.Set("Content-Type", http.DetectContentType(mimeBuffer[:size]))
  23. return io.NopCloser(io.MultiReader(bytes.NewReader(mimeBuffer[:size]), dataReader))
  24. }
  25. return io.NopCloser(dataReader)
  26. }
  27. func urlEscapeObject(object string) string {
  28. t := urlPathEscape(removeDuplicateSlashes(object))
  29. if strings.HasPrefix(t, "/") {
  30. return t
  31. }
  32. return "/" + t
  33. }
  34. func entryUrlEncode(dir string, entry string, encodingTypeUrl bool) (dirName string, entryName string, prefix string) {
  35. if !encodingTypeUrl {
  36. return dir, entry, entry
  37. }
  38. return urlPathEscape(dir), url.QueryEscape(entry), urlPathEscape(entry)
  39. }
  40. func urlPathEscape(object string) string {
  41. var escapedParts []string
  42. for _, part := range strings.Split(object, "/") {
  43. escapedParts = append(escapedParts, strings.ReplaceAll(url.PathEscape(part), "+", "%2B"))
  44. }
  45. return strings.Join(escapedParts, "/")
  46. }
  47. func removeDuplicateSlashes(object string) string {
  48. result := strings.Builder{}
  49. result.Grow(len(object))
  50. isLastSlash := false
  51. for _, r := range object {
  52. switch r {
  53. case '/':
  54. if !isLastSlash {
  55. result.WriteRune(r)
  56. }
  57. isLastSlash = true
  58. default:
  59. result.WriteRune(r)
  60. isLastSlash = false
  61. }
  62. }
  63. return result.String()
  64. }
  65. func newListEntry(entry *filer_pb.Entry, dir string, name string, bucketPrefix string, fetchOwner bool, isDirectory bool) (listEntry ListEntry) {
  66. storageClass := "STANDARD"
  67. if v, ok := entry.Extended[s3_constants.AmzStorageClass]; ok {
  68. storageClass = string(v)
  69. }
  70. keyFormat := "%s/%s"
  71. if isDirectory {
  72. keyFormat += "/"
  73. }
  74. listEntry = ListEntry{
  75. Key: fmt.Sprintf(keyFormat, dir, name)[len(bucketPrefix):],
  76. LastModified: time.Unix(entry.Attributes.Mtime, 0).UTC(),
  77. ETag: "\"" + filer.ETag(entry) + "\"",
  78. Size: int64(filer.FileSize(entry)),
  79. StorageClass: StorageClass(storageClass),
  80. }
  81. if fetchOwner {
  82. listEntry.Owner = CanonicalUser{
  83. ID: fmt.Sprintf("%x", entry.Attributes.Uid),
  84. DisplayName: entry.Attributes.UserName,
  85. set: true,
  86. }
  87. }
  88. return listEntry
  89. }
  90. func (s3a *S3ApiServer) toFilerUrl(bucket, object string) string {
  91. object = urlPathEscape(removeDuplicateSlashes(object))
  92. destUrl := fmt.Sprintf("http://%s%s/%s%s",
  93. s3a.option.Filer.ToHttpAddress(), s3a.option.BucketsPath, bucket, object)
  94. return destUrl
  95. }
  96. func (s3a *S3ApiServer) GetObjectHandler(w http.ResponseWriter, r *http.Request) {
  97. bucket, object := s3_constants.GetBucketAndObject(r)
  98. glog.V(3).Infof("GetObjectHandler %s %s", bucket, object)
  99. if strings.HasSuffix(r.URL.Path, "/") {
  100. s3err.WriteErrorResponse(w, r, s3err.ErrNotImplemented)
  101. return
  102. }
  103. destUrl := s3a.toFilerUrl(bucket, object)
  104. s3a.proxyToFiler(w, r, destUrl, false, passThroughResponse)
  105. }
  106. func (s3a *S3ApiServer) HeadObjectHandler(w http.ResponseWriter, r *http.Request) {
  107. bucket, object := s3_constants.GetBucketAndObject(r)
  108. glog.V(3).Infof("HeadObjectHandler %s %s", bucket, object)
  109. destUrl := s3a.toFilerUrl(bucket, object)
  110. s3a.proxyToFiler(w, r, destUrl, false, passThroughResponse)
  111. }
  112. func (s3a *S3ApiServer) proxyToFiler(w http.ResponseWriter, r *http.Request, destUrl string, isWrite bool, responseFn func(proxyResponse *http.Response, w http.ResponseWriter) (statusCode int)) {
  113. glog.V(3).Infof("s3 proxying %s to %s", r.Method, destUrl)
  114. start := time.Now()
  115. proxyReq, err := http.NewRequest(r.Method, destUrl, r.Body)
  116. if err != nil {
  117. glog.Errorf("NewRequest %s: %v", destUrl, err)
  118. s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
  119. return
  120. }
  121. proxyReq.Header.Set("X-Forwarded-For", r.RemoteAddr)
  122. for k, v := range r.URL.Query() {
  123. if _, ok := s3_constants.PassThroughHeaders[strings.ToLower(k)]; ok {
  124. proxyReq.Header[k] = v
  125. }
  126. if k == "partNumber" {
  127. proxyReq.Header[s3_constants.SeaweedFSPartNumber] = v
  128. }
  129. }
  130. for header, values := range r.Header {
  131. proxyReq.Header[header] = values
  132. }
  133. // ensure that the Authorization header is overriding any previous
  134. // Authorization header which might be already present in proxyReq
  135. s3a.maybeAddFilerJwtAuthorization(proxyReq, isWrite)
  136. resp, postErr := s3a.client.Do(proxyReq)
  137. if postErr != nil {
  138. glog.Errorf("post to filer: %v", postErr)
  139. s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
  140. return
  141. }
  142. defer util.CloseResponse(resp)
  143. if resp.StatusCode == http.StatusPreconditionFailed {
  144. s3err.WriteErrorResponse(w, r, s3err.ErrPreconditionFailed)
  145. return
  146. }
  147. if resp.StatusCode == http.StatusRequestedRangeNotSatisfiable {
  148. s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRange)
  149. return
  150. }
  151. if r.Method == "DELETE" {
  152. if resp.StatusCode == http.StatusNotFound {
  153. // this is normal
  154. responseStatusCode := responseFn(resp, w)
  155. s3err.PostLog(r, responseStatusCode, s3err.ErrNone)
  156. return
  157. }
  158. }
  159. if resp.StatusCode == http.StatusNotFound {
  160. s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
  161. return
  162. }
  163. TimeToFirstByte(r.Method, start, r)
  164. if resp.Header.Get(s3_constants.SeaweedFSIsDirectoryKey) == "true" {
  165. responseStatusCode := responseFn(resp, w)
  166. s3err.PostLog(r, responseStatusCode, s3err.ErrNone)
  167. return
  168. }
  169. if resp.StatusCode == http.StatusInternalServerError {
  170. s3err.WriteErrorResponse(w, r, s3err.ErrInternalError)
  171. return
  172. }
  173. // when HEAD a directory, it should be reported as no such key
  174. // https://github.com/seaweedfs/seaweedfs/issues/3457
  175. if resp.ContentLength == -1 && resp.StatusCode != http.StatusNotModified {
  176. s3err.WriteErrorResponse(w, r, s3err.ErrNoSuchKey)
  177. return
  178. }
  179. if resp.StatusCode == http.StatusBadRequest {
  180. resp_body, _ := io.ReadAll(resp.Body)
  181. switch string(resp_body) {
  182. case "InvalidPart":
  183. s3err.WriteErrorResponse(w, r, s3err.ErrInvalidPart)
  184. default:
  185. s3err.WriteErrorResponse(w, r, s3err.ErrInvalidRequest)
  186. }
  187. resp.Body.Close()
  188. return
  189. }
  190. setUserMetadataKeyToLowercase(resp)
  191. responseStatusCode := responseFn(resp, w)
  192. s3err.PostLog(r, responseStatusCode, s3err.ErrNone)
  193. }
  194. func setUserMetadataKeyToLowercase(resp *http.Response) {
  195. for key, value := range resp.Header {
  196. if strings.HasPrefix(key, s3_constants.AmzUserMetaPrefix) {
  197. resp.Header[strings.ToLower(key)] = value
  198. delete(resp.Header, key)
  199. }
  200. }
  201. }
  202. func passThroughResponse(proxyResponse *http.Response, w http.ResponseWriter) (statusCode int) {
  203. for k, v := range proxyResponse.Header {
  204. w.Header()[k] = v
  205. }
  206. if proxyResponse.Header.Get("Content-Range") != "" && proxyResponse.StatusCode == 200 {
  207. w.WriteHeader(http.StatusPartialContent)
  208. statusCode = http.StatusPartialContent
  209. } else {
  210. statusCode = proxyResponse.StatusCode
  211. }
  212. w.WriteHeader(statusCode)
  213. buf := mem.Allocate(128 * 1024)
  214. defer mem.Free(buf)
  215. if n, err := io.CopyBuffer(w, proxyResponse.Body, buf); err != nil {
  216. glog.V(1).Infof("passthrough response read %d bytes: %v", n, err)
  217. }
  218. return statusCode
  219. }