gitlab-com-seaweedfs/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2024-01-19 02:48:24 +00:00
Code Issues Projects Releases Wiki Activity

allowed wildcard domain

Browse source
This commit is contained in:
Konstantin Lebedev 2021-03-10 14:02:13 +05:00
parent 4bf93d6e63
commit 831953c55c
4 changed files with 35 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
docker/Makefile
View file

@ -48,11 +48,11 @@ clean:
certstrap: certstrap:
go get github.com/square/certstrap go get github.com/square/certstrap
certstrap --depot-path compose/tls init --passphrase "" --common-name "SeaweedFS CA" || true certstrap --depot-path compose/tls init --passphrase "" --common-name "SeaweedFS CA" || true
certstrap --depot-path compose/tls request-cert --passphrase "" --common-name volume01 || true certstrap --depot-path compose/tls request-cert --passphrase "" --common-name volume01.dev || true
certstrap --depot-path compose/tls request-cert --passphrase "" --common-name master01 || true certstrap --depot-path compose/tls request-cert --passphrase "" --common-name master01.dev || true
certstrap --depot-path compose/tls request-cert --passphrase "" --common-name filer01 || true certstrap --depot-path compose/tls request-cert --passphrase "" --common-name filer01.dev || true
certstrap --depot-path compose/tls request-cert --passphrase "" --common-name client01 || true certstrap --depot-path compose/tls request-cert --passphrase "" --common-name client01.dev || true
certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" volume01 || true certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" volume01.dev || true
certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" master01 || true certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" master01.dev || true
certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" filer01 || true certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" filer01.dev || true
certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" client01 || true certstrap --depot-path compose/tls sign --CA "SeaweedFS CA" client01.dev || true

21
docker/compose/tls.env
View file

@ -1,13 +1,10 @@
WEED_GRPC_CA=/etc/seaweedfs/tls/SeaweedFS_CA.crt WEED_GRPC_CA=/etc/seaweedfs/tls/SeaweedFS_CA.crt
WEED_GRPC_MASTER_CERT=/etc/seaweedfs/tls/master01.crt WEED_GRPC_ALLOWED_WILDCARD_DOMAIN=".dev"
WEED_GRPC_MASTER_KEY=/etc/seaweedfs/tls/master01.key WEED_GRPC_MASTER_CERT=/etc/seaweedfs/tls/master01.dev.crt
WEED_GRPC_VOLUME_CERT=/etc/seaweedfs/tls/volume01.crt WEED_GRPC_MASTER_KEY=/etc/seaweedfs/tls/master01.dev.key
WEED_GRPC_VOLUME_KEY=/etc/seaweedfs/tls/volume01.key WEED_GRPC_VOLUME_CERT=/etc/seaweedfs/tls/volume01.dev.crt
WEED_GRPC_FILER_CERT=/etc/seaweedfs/tls/filer01.crt WEED_GRPC_VOLUME_KEY=/etc/seaweedfs/tls/volume01.dev.key
WEED_GRPC_FILER_KEY=/etc/seaweedfs/tls/filer01.key WEED_GRPC_FILER_CERT=/etc/seaweedfs/tls/filer01.dev.crt
WEED_GRPC_CLIENT_CERT=/etc/seaweedfs/tls/client01.crt WEED_GRPC_FILER_KEY=/etc/seaweedfs/tls/filer01.dev.key
WEED_GRPC_CLIENT_KEY=/etc/seaweedfs/tls/client01.key WEED_GRPC_CLIENT_CERT=/etc/seaweedfs/tls/client01.dev.crt
WEED_GRPC_MASTER_ALLOWED_COMMONNAMES="volume01,master01,filer01,client01" WEED_GRPC_CLIENT_KEY=/etc/seaweedfs/tls/client01.dev.key
WEED_GRPC_VOLUME_ALLOWED_COMMONNAMES="volume01,master01,filer01,client01"
WEED_GRPC_FILER_ALLOWED_COMMONNAMES="volume01,master01,filer01,client01"
WEED_GRPC_CLIENT_ALLOWED_COMMONNAMES="volume01,master01,filer01,client01"

1
weed/command/scaffold.go
View file

@ -440,6 +440,7 @@ expires_after_seconds = 10 # seconds
# the host name is not checked, so the PERM files can be shared. # the host name is not checked, so the PERM files can be shared.
[grpc] [grpc]
ca = "" ca = ""
allowed_wildcard_domain = "" # .mycompany.com
[grpc.volume] [grpc.volume]
cert = "" cert = ""

28
weed/security/tls.go
View file

@ -19,7 +19,8 @@ import (
) )
type Authenticator struct { type Authenticator struct {
PermitCommonNames map[string]bool AllowedWildcardDomain string
AllowedCommonNames map[string]bool
} }
func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption, grpc.ServerOption) { func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption, grpc.ServerOption) {
@ -49,14 +50,16 @@ func LoadServerTLS(config *util.ViperProxy, component string) (grpc.ServerOption
ClientAuth: tls.RequireAndVerifyClientCert, ClientAuth: tls.RequireAndVerifyClientCert,
}) })
permitCommonNames := strings.Split(config.GetString(component+".allowed_commonNames"), ",") allowedCommonNames := strings.Split(config.GetString(component+".allowed_commonNames"), ",")
if len(permitCommonNames) > 0 { allowedWildcardDomain := config.GetString("grpc.allowed_wildcard_domain")
permitCommonNamesMap := make(map[string]bool) if len(allowedCommonNames) > 0 || allowedWildcardDomain != "" {
for _, s := range permitCommonNames { allowedCommonNamesMap := make(map[string]bool)
permitCommonNamesMap[s] = true for _, s := range allowedCommonNames {
allowedCommonNamesMap[s] = true
} }
auther := Authenticator{ auther := Authenticator{
PermitCommonNames: permitCommonNamesMap, AllowedCommonNames: allowedCommonNamesMap,
AllowedWildcardDomain: allowedWildcardDomain,
} }
return grpc.Creds(ta), grpc.UnaryInterceptor(grpc_auth.UnaryServerInterceptor(auther.Authenticate)) return grpc.Creds(ta), grpc.UnaryInterceptor(grpc_auth.UnaryServerInterceptor(auther.Authenticate))
} }
@ -109,9 +112,12 @@ func (a Authenticator) Authenticate(ctx context.Context) (newCtx context.Context
if len(tlsAuth.State.VerifiedChains) == 0 || len(tlsAuth.State.VerifiedChains[0]) == 0 { if len(tlsAuth.State.VerifiedChains) == 0 || len(tlsAuth.State.VerifiedChains[0]) == 0 {
return ctx, status.Error(codes.Unauthenticated, "could not verify peer certificate") return ctx, status.Error(codes.Unauthenticated, "could not verify peer certificate")
} }
commonName := tlsAuth.State.VerifiedChains[0][0].Subject.CommonName
if _, ok := a.PermitCommonNames[tlsAuth.State.VerifiedChains[0][0].Subject.CommonName]; !ok { if a.AllowedWildcardDomain != "" && strings.HasSuffix(commonName, a.AllowedWildcardDomain) {
return ctx, status.Error(codes.Unauthenticated, "invalid subject common name") return ctx, nil
} }
return ctx, nil if _, ok := a.AllowedCommonNames[commonName]; ok {
return ctx, nil
}
return ctx, status.Error(codes.Unauthenticated, "invalid subject common name")
} }