TLS allowed commonNames

docker/Makefile

@@ -5,7 +5,7 @@ all: gen
 gen: dev
 
 build:
-	cd ../weed; GOOS=linux go build; mv weed ../docker/
+	cd ../weed; CGO_ENABLED=0 GOOS=linux go build -ldflags "-extldflags -static"; mv weed ../docker/
 	docker build --no-cache -t chrislusf/seaweedfs:local -f Dockerfile.local .
 	rm ./weed
 
@@ -15,6 +15,9 @@ s3tests_build:
 dev: build
 	docker-compose -f compose/local-dev-compose.yml -p seaweedfs up
 
+dev_tls: build certstrap
+	ENV_FILE="tls.env" docker-compose -f compose/local-dev-compose.yml -p seaweedfs up
+
 dev_mount: build
 	docker-compose -f compose/local-mount-compose.yml -p seaweedfs up
 
@@ -41,3 +44,15 @@ filer_etcd: build
 
 clean:
 	rm ./weed
+
+certstrap:
+	go get github.com/square/certstrap
+	certstrap --depot-path compose/tls init --passphrase "" --common-name "SeaweedFS CA" || true
+	certstrap --depot-path compose/tls request-cert --passphrase "" --common-name volume01 || true
+	certstrap --depot-path compose/tls request-cert --passphrase "" --common-name master01 || true
+	certstrap --depot-path compose/tls request-cert --passphrase "" --common-name filer01 || true
+	certstrap --depot-path compose/tls request-cert --passphrase "" --common-name client01 || true
+	certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" volume01 || true
+	certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" master01 || true
+	certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" filer01 || true
+	certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" client01 || true

docker/compose/local-dev-compose.yml

@@ -6,33 +6,49 @@ services:
     ports:
       - 9333:9333
       - 19333:19333
-    command: "master -ip=master"
+    command: "-v=1 master -ip=master"
+    volumes:
+      - ./tls:/etc/seaweedfs/tls
+    env_file:
+     - ${ENV_FILE:-dev.env}
   volume:
     image: chrislusf/seaweedfs:local
     ports:
       - 8080:8080
       - 18080:18080
-    command: "volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
+    command: "-v=1 volume -mserver=master:9333 -port=8080 -ip=volume -preStopSeconds=1"
     depends_on:
       - master
+    volumes:
+      - ./tls:/etc/seaweedfs/tls
+    env_file:
+      - ${ENV_FILE:-dev.env}
   filer:
     image: chrislusf/seaweedfs:local
     ports:
       - 8888:8888
       - 18888:18888
-    command: 'filer -master="master:9333"'
+    command: '-v=1 filer -master="master:9333"'
     depends_on:
       - master
       - volume
+    volumes:
+      - ./tls:/etc/seaweedfs/tls
+    env_file:
+      - ${ENV_FILE:-dev.env}
   s3:
     image: chrislusf/seaweedfs:local
     ports:
       - 8333:8333
-    command: 's3 -filer="filer:8888"'
+    command: '-v=1 s3 -filer="filer:8888"'
     depends_on:
       - master
       - volume
       - filer
+    volumes:
+      - ./tls:/etc/seaweedfs/tls
+    env_file:
+      - ${ENV_FILE:-dev.env}
   mount:
     image: chrislusf/seaweedfs:local
     privileged: true
@@ -40,6 +56,10 @@ services:
       - SYS_ADMIN
     mem_limit: 4096m
     command: '-v=4 mount -filer="filer:8888" -dirAutoCreate -dir=/mnt/seaweedfs -cacheCapacityMB=100 -concurrentWriters=128'
+    volumes:
+      - ./tls:/etc/seaweedfs/tls
+    env_file:
+      - ${ENV_FILE:-dev.env}
     depends_on:
       - master
       - volume

docker/compose/tls.env

@@ -0,0 +1,13 @@
+WEED_GRPC_CA=/etc/seaweedfs/tls/SeaweedFS_CA.crt
+WEED_GRPC_MASTER_CERT=/etc/seaweedfs/tls/master01.crt
+WEED_GRPC_MASTER_KEY=/etc/seaweedfs/tls/master01.key
+WEED_GRPC_VOLUME_CERT=/etc/seaweedfs/tls/volume01.crt
+WEED_GRPC_VOLUME_KEY=/etc/seaweedfs/tls/volume01.key
+WEED_GRPC_FILER_CERT=/etc/seaweedfs/tls/filer01.crt
+WEED_GRPC_FILER_KEY=/etc/seaweedfs/tls/filer01.key
+WEED_GRPC_CLIENT_CERT=/etc/seaweedfs/tls/client01.crt
+WEED_GRPC_CLIENT_KEY=/etc/seaweedfs/tls/client01.key
+WEED_GRPC_MASTER_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01"
+WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01"
+WEED_GRPC_FILER_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01"
+WEED_GRPC_CLIENT_ALLOWED_COMMONNAMES="volume01 master01 filer01 client01"

weed/command/scaffold.go

@@ -444,18 +444,22 @@ ca = ""
 [grpc.volume]
 cert = ""
 key  = ""
+allowed_commonNames = ""
 
 [grpc.master]
 cert = ""
 key  = ""
+allowed_commonNames = ""
 
 [grpc.filer]
 cert = ""
 key  = ""
+allowed_commonNames = ""
 
 [grpc.msg_broker]
 cert = ""
 key  = ""
+allowed_commonNames = ""
 
 # use this for any place needs a grpc client
 # i.e., "weed backup|benchmark|filer.copy|filer.replicate|mount|s3|upload"
@@ -463,7 +467,6 @@ key  = ""
 cert = ""
 key  = ""
 
-
 # volume server https options
 # Note: work in progress!
 #     this does not work with other clients, e.g., "weed filer|mount" etc, yet.

weed/security/tls.go

@@ -29,12 +29,15 @@ func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption
 	// load cert/key, ca cert
 	cert, err := tls.LoadX509KeyPair(config.GetString(component+".cert"), config.GetString(component+".key"))
 	if err != nil {
-		glog.V(1).Infof("load cert/key error: %v", err)
+		glog.V(1).Infof("load cert: %s / key: %s error: %v",
+			config.GetString(component+".cert"),
+			config.GetString(component+".key"),
+			err)
 		return nil, nil
 	}
 	caCert, err := ioutil.ReadFile(config.GetString("grpc.ca"))
 	if err != nil {
-		glog.V(1).Infof("read ca cert file error: %v", err)
+		glog.V(1).Infof("read ca cert file %s error: %v", config.GetString("grpc.ca"), err)
 		return nil, nil
 	}
 	caCertPool := x509.NewCertPool()
@@ -44,11 +47,11 @@ func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption
 		ClientCAs:    caCertPool,
 		ClientAuth:   tls.RequireAndVerifyClientCert,
 	})
-	permitCommonNames := config.GetStringSlice(component + "permitCommonNames")
 
+	permitCommonNames := config.GetStringSlice(component + ".allowed_commonNames")
 	if len(permitCommonNames) > 0 {
 		permitCommonNamesMap := make(map[string]bool)
-		for _, s := range util.GetViper().GetStringSlice(component + "permitCommonNames") {
+		for _, s := range permitCommonNames {
 			permitCommonNamesMap[s] = true
 		}
 		auther := Authenticator{