From 190fada1ef079186b6bc62feda5d571c5aaa274a Mon Sep 17 00:00:00 2001 From: Konstantin Lebedev Date: Mon, 8 Mar 2021 21:39:44 +0500 Subject: [PATCH] TLS allowed commonNames --- docker/Makefile | 17 ++++++++++++++++- docker/compose/dev.env | 0 docker/compose/local-dev-compose.yml | 28 ++++++++++++++++++++++++---- docker/compose/tls.env | 13 +++++++++++++ weed/command/scaffold.go | 5 ++++- weed/security/tls.go | 11 +++++++---- 6 files changed, 64 insertions(+), 10 deletions(-) create mode 100644 docker/compose/dev.env create mode 100644 docker/compose/tls.env diff --git a/docker/Makefile b/docker/Makefile index 67ee9acdf..c589fea83 100644 --- a/docker/Makefile +++ b/docker/Makefile @@ -5,7 +5,7 @@ all: gen gen: dev build: - cd ../weed; GOOS=linux go build; mv weed ../docker/ + cd ../weed; CGO_ENABLED=0 GOOS=linux go build -ldflags "-extldflags -static"; mv weed ../docker/ docker build --no-cache -t chrislusf/seaweedfs:local -f Dockerfile.local . rm ./weed @@ -15,6 +15,9 @@ s3tests_build: dev: build docker-compose -f compose/local-dev-compose.yml -p seaweedfs up +dev_tls: build certstrap + ENV_FILE="tls.env" docker-compose -f compose/local-dev-compose.yml -p seaweedfs up + dev_mount: build docker-compose -f compose/local-mount-compose.yml -p seaweedfs up @@ -41,3 +44,15 @@ filer_etcd: build clean: rm ./weed + +certstrap: + go get github.com/square/certstrap + certstrap --depot-path compose/tls init --passphrase "" --common-name "SeaweedFS CA" || true + certstrap --depot-path compose/tls request-cert --passphrase "" --common-name volume01 || true + certstrap --depot-path compose/tls request-cert --passphrase "" --common-name master01 || true + certstrap --depot-path compose/tls request-cert --passphrase "" --common-name filer01 || true + certstrap --depot-path compose/tls request-cert --passphrase "" --common-name client01 || true + certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" volume01 || true + certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" master01 || true + certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" filer01 || true + certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" client01 || true \ No newline at end of file diff --git a/docker/compose/dev.env b/docker/compose/dev.env new file mode 100644 index 000000000..e69de29bb diff --git a/docker/compose/local-dev-compose.yml b/docker/compose/local-dev-compose.yml index 18cccab3e..05103a7fc 100644 --- a/docker/compose/local-dev-compose.yml +++ b/docker/compose/local-dev-compose.yml @@ -6,33 +6,49 @@ services: ports: - 9333:9333 - 19333:19333 - command: "master -ip=master" + command: "-v=1 master -ip=master" + volumes: + - ./tls:/etc/seaweedfs/tls + env_file: + - ${ENV_FILE:-dev.env} volume: image: chrislusf/seaweedfs:local ports: - 8080:8080 - 18080:18080 - command: "volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1" + command: "-v=1 volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1" depends_on: - master + volumes: + - ./tls:/etc/seaweedfs/tls + env_file: + - ${ENV_FILE:-dev.env} filer: image: chrislusf/seaweedfs:local ports: - 8888:8888 - 18888:18888 - command: 'filer -master="master:9333"' + command: '-v=1 filer -master="master:9333"' depends_on: - master - volume + volumes: + - ./tls:/etc/seaweedfs/tls + env_file: + - ${ENV_FILE:-dev.env} s3: image: chrislusf/seaweedfs:local ports: - 8333:8333 - command: 's3 -filer="filer:8888"' + command: '-v=1 s3 -filer="filer:8888"' depends_on: - master - volume - filer + volumes: + - ./tls:/etc/seaweedfs/tls + env_file: + - ${ENV_FILE:-dev.env} mount: image: chrislusf/seaweedfs:local privileged: true @@ -40,6 +56,10 @@ services: - SYS_ADMIN mem_limit: 4096m command: '-v=4 mount -filer="filer:8888" -dirAutoCreate -dir=/mnt/seaweedfs -cacheCapacityMB=100 -concurrentWriters=128' + volumes: + - ./tls:/etc/seaweedfs/tls + env_file: + - ${ENV_FILE:-dev.env} depends_on: - master - volume diff --git a/docker/compose/tls.env b/docker/compose/tls.env new file mode 100644 index 000000000..220642919 --- /dev/null +++ b/docker/compose/tls.env @@ -0,0 +1,13 @@ +WEED_GRPC_CA=/etc/seaweedfs/tls/SeaweedFS_CA.crt +WEED_GRPC_MASTER_CERT=/etc/seaweedfs/tls/master01.crt +WEED_GRPC_MASTER_KEY=/etc/seaweedfs/tls/master01.key +WEED_GRPC_VOLUME_CERT=/etc/seaweedfs/tls/volume01.crt +WEED_GRPC_VOLUME_KEY=/etc/seaweedfs/tls/volume01.key +WEED_GRPC_FILER_CERT=/etc/seaweedfs/tls/filer01.crt +WEED_GRPC_FILER_KEY=/etc/seaweedfs/tls/filer01.key +WEED_GRPC_CLIENT_CERT=/etc/seaweedfs/tls/client01.crt +WEED_GRPC_CLIENT_KEY=/etc/seaweedfs/tls/client01.key +WEED_GRPC_MASTER_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01" +WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01" +WEED_GRPC_FILER_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01" +WEED_GRPC_CLIENT_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01" \ No newline at end of file diff --git a/weed/command/scaffold.go b/weed/command/scaffold.go index c2d53e4bd..79f827af5 100644 --- a/weed/command/scaffold.go +++ b/weed/command/scaffold.go @@ -444,18 +444,22 @@ ca = "" [grpc.volume] cert = "" key = "" +allowed_commonNames = "" [grpc.master] cert = "" key = "" +allowed_commonNames = "" [grpc.filer] cert = "" key = "" +allowed_commonNames = "" [grpc.msg_broker] cert = "" key = "" +allowed_commonNames = "" # use this for any place needs a grpc client # i.e., "weed backup|benchmark|filer.copy|filer.replicate|mount|s3|upload" @@ -463,7 +467,6 @@ key = "" cert = "" key = "" - # volume server https options # Note: work in progress! # this does not work with other clients, e.g., "weed filer|mount" etc, yet. diff --git a/weed/security/tls.go b/weed/security/tls.go index 437d658a8..b38745fbf 100644 --- a/weed/security/tls.go +++ b/weed/security/tls.go @@ -29,12 +29,15 @@ func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption // load cert/key, ca cert cert, err := tls.LoadX509KeyPair(config.GetString(component+".cert"), config.GetString(component+".key")) if err != nil { - glog.V(1).Infof("load cert/key error: %v", err) + glog.V(1).Infof("load cert: %s / key: %s error: %v", + config.GetString(component+".cert"), + config.GetString(component+".key"), + err) return nil, nil } caCert, err := ioutil.ReadFile(config.GetString("grpc.ca")) if err != nil { - glog.V(1).Infof("read ca cert file error: %v", err) + glog.V(1).Infof("read ca cert file %s error: %v", config.GetString("grpc.ca"), err) return nil, nil } caCertPool := x509.NewCertPool() @@ -44,11 +47,11 @@ func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption ClientCAs: caCertPool, ClientAuth: tls.RequireAndVerifyClientCert, }) - permitCommonNames := config.GetStringSlice(component + "permitCommonNames") + permitCommonNames := config.GetStringSlice(component + ".allowed_commonNames") if len(permitCommonNames) > 0 { permitCommonNamesMap := make(map[string]bool) - for _, s := range util.GetViper().GetStringSlice(component + "permitCommonNames") { + for _, s := range permitCommonNames { permitCommonNamesMap[s] = true } auther := Authenticator{