Chris Lu
10 years ago
9 changed files with 230 additions and 57 deletions
-
146go/security/guard.go
-
4go/weed/master.go
-
8go/weed/server.go
-
4go/weed/volume.go
-
20go/weed/weed_server/common.go
-
32go/weed/weed_server/master_server.go
-
31go/weed/weed_server/volume_server.go
-
6go/weed/weed_server/volume_server_handlers.go
-
36note/security.txt
@ -0,0 +1,146 @@ |
|||||
|
package security |
||||
|
|
||||
|
import ( |
||||
|
"errors" |
||||
|
"fmt" |
||||
|
"net" |
||||
|
"net/http" |
||||
|
"strings" |
||||
|
"time" |
||||
|
|
||||
|
"github.com/chrislusf/weed-fs/go/glog" |
||||
|
"github.com/dgrijalva/jwt-go" |
||||
|
) |
||||
|
|
||||
|
var ( |
||||
|
ErrUnauthorized = errors.New("unauthorized token") |
||||
|
) |
||||
|
|
||||
|
/* |
||||
|
Guard is to ensure data access security. |
||||
|
There are 2 ways to check access: |
||||
|
1. white list. It's checking request ip address. |
||||
|
2. JSON Web Token(JWT) generated from secretKey. |
||||
|
The jwt can come from: |
||||
|
1. url parameter jwt=... |
||||
|
2. request header "Authorization" |
||||
|
3. cookie with the name "jwt" |
||||
|
|
||||
|
The white list is checked first because it is easy. |
||||
|
Then the JWT is checked. |
||||
|
|
||||
|
The Guard will also check these claims if provided: |
||||
|
1. "exp" Expiration Time |
||||
|
2. "nbf" Not Before |
||||
|
|
||||
|
Generating JWT: |
||||
|
1. use HS256 to sign |
||||
|
2. optionally set "exp", "nbf" fields, in Unix time, |
||||
|
the number of seconds elapsed since January 1, 1970 UTC. |
||||
|
|
||||
|
Referenced: |
||||
|
https://github.com/pkieltyka/jwtauth/blob/master/jwtauth.go
|
||||
|
|
||||
|
*/ |
||||
|
type Guard struct { |
||||
|
whiteList []string |
||||
|
secretKey string |
||||
|
|
||||
|
isActive bool |
||||
|
} |
||||
|
|
||||
|
func NewGuard(whiteList []string, secretKey string) *Guard { |
||||
|
g := &Guard{whiteList: whiteList, secretKey: secretKey} |
||||
|
g.isActive = len(g.whiteList) != 0 || len(g.secretKey) != 0 |
||||
|
return g |
||||
|
} |
||||
|
|
||||
|
func (g *Guard) Secure(f func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) { |
||||
|
if !g.isActive { |
||||
|
//if no security needed, just skip all checkings
|
||||
|
return f |
||||
|
} |
||||
|
return func(w http.ResponseWriter, r *http.Request) { |
||||
|
if err := g.doCheck(w, r); err != nil { |
||||
|
w.WriteHeader(http.StatusUnauthorized) |
||||
|
return |
||||
|
} |
||||
|
f(w, r) |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
func (g *Guard) NewToken() (tokenString string, err error) { |
||||
|
m := make(map[string]interface{}) |
||||
|
m["exp"] = time.Now().Unix() + 10 |
||||
|
return g.Encode(m) |
||||
|
} |
||||
|
|
||||
|
func (g *Guard) Encode(claims map[string]interface{}) (tokenString string, err error) { |
||||
|
if !g.isActive { |
||||
|
return "", nil |
||||
|
} |
||||
|
|
||||
|
t := jwt.New(jwt.GetSigningMethod("HS256")) |
||||
|
t.Claims = claims |
||||
|
return t.SignedString(g.secretKey) |
||||
|
} |
||||
|
|
||||
|
func (g *Guard) Decode(tokenString string) (token *jwt.Token, err error) { |
||||
|
return jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) { |
||||
|
return g.secretKey, nil |
||||
|
}) |
||||
|
} |
||||
|
|
||||
|
func (g *Guard) doCheck(w http.ResponseWriter, r *http.Request) error { |
||||
|
if len(g.whiteList) != 0 { |
||||
|
host, _, err := net.SplitHostPort(r.RemoteAddr) |
||||
|
if err == nil { |
||||
|
for _, ip := range g.whiteList { |
||||
|
if ip == host { |
||||
|
return nil |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if len(g.secretKey) != 0 { |
||||
|
|
||||
|
// Get token from query params
|
||||
|
tokenStr := r.URL.Query().Get("jwt") |
||||
|
|
||||
|
// Get token from authorization header
|
||||
|
if tokenStr == "" { |
||||
|
bearer := r.Header.Get("Authorization") |
||||
|
if len(bearer) > 7 && strings.ToUpper(bearer[0:6]) == "BEARER" { |
||||
|
tokenStr = bearer[7:] |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
// Get token from cookie
|
||||
|
if tokenStr == "" { |
||||
|
cookie, err := r.Cookie("jwt") |
||||
|
if err == nil { |
||||
|
tokenStr = cookie.Value |
||||
|
} |
||||
|
} |
||||
|
|
||||
|
if tokenStr == "" { |
||||
|
return ErrUnauthorized |
||||
|
} |
||||
|
|
||||
|
// Verify the token
|
||||
|
token, err := g.Decode(tokenStr) |
||||
|
if err != nil { |
||||
|
glog.V(1).Infof("Token verification error from %s: %v", r.RemoteAddr, err) |
||||
|
return ErrUnauthorized |
||||
|
} |
||||
|
if !token.Valid { |
||||
|
glog.V(1).Infof("Token invliad from %s: %v", r.RemoteAddr, tokenStr) |
||||
|
return ErrUnauthorized |
||||
|
} |
||||
|
|
||||
|
} |
||||
|
|
||||
|
glog.V(1).Infof("No permission from %s", r.RemoteAddr) |
||||
|
return fmt.Errorf("No write permisson from %s", r.RemoteAddr) |
||||
|
} |
||||
@ -0,0 +1,36 @@ |
|||||
|
Design for Seaweed-FS security |
||||
|
|
||||
|
Design Objectives |
||||
|
Security can mean many different things. The original vision is that: if you have one machine lying around |
||||
|
somewhere with some disk space, it should be able to join your file system to contribute some disk space and |
||||
|
network bandwidth. |
||||
|
|
||||
|
To achieve this purpose, the security should be able to: |
||||
|
1. Secure the inter-server communication. Only real cluster servers can join and communicate. |
||||
|
2. allow clients to securely write to volume servers |
||||
|
|
||||
|
Non Objective |
||||
|
Multi-tenant support. Avoid filers or clients cross-updating files. |
||||
|
User specific access control. |
||||
|
|
||||
|
Design Architect |
||||
|
master, and volume servers all talk securely via 2-way SSL for admin. |
||||
|
upon joining, master gives its secret key to volume servers. |
||||
|
filer or clients talk to master to get secret key, and use the key to generate JWT to write on volume server. |
||||
|
A side benefit: |
||||
|
a time limited read feature? |
||||
|
4. volume server needs to expose https ports |
||||
|
|
||||
|
HTTP Connections |
||||
|
clear http |
||||
|
filer~>master, need to get a JWT from master |
||||
|
filer~>volume |
||||
|
2-way https |
||||
|
master~ssl~>volume |
||||
|
volume~ssl~>master |
||||
|
|
||||
|
file uploading: |
||||
|
when volume server starts, it asks master for the secret key to decode JWT |
||||
|
when filer/clients wants to upload, master generate a JWT |
||||
|
filer~>volume(public port) |
||||
|
master~>volume(public port) |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue