From 16d6904d54e7409f95e9e893e131b6bf11f0e4c7 Mon Sep 17 00:00:00 2001

From: Mohammed Rafi KC <rkavunga@redhat.com>

Date: Mon, 2 Apr 2018 12:20:47 +0530

Subject: [PATCH 653/653] server/auth: add option for strict authentication

When this option is enabled, we will check for a matching

username and password, if not found then the connection will

be rejected. This also deos a checksum validation of volfile

Change-Id: I2ac4f0cfa5b59cc789cc5a265358389b04556b59

BUG: 1559331

Signed-off-by: Mohammed Rafi KC <rkavunga@redhat.com>

Reviewed-on: https://code.engineering.redhat.com/gerrit/134591

Reviewed-by: Pranith Kumar Karampuri <pkarampu@redhat.com>

Reviewed-by: Mohit Agrawal <moagrawa@redhat.com>

Reviewed-by: Atin Mukherjee <amukherj@redhat.com>

Tested-by: Atin Mukherjee <amukherj@redhat.com>

---

 xlators/mgmt/glusterd/src/glusterd-volgen.c    |  15 ++++

 xlators/protocol/auth/login/src/login.c        | 104 +++++++++++++++++--------

 xlators/protocol/server/src/authenticate.c     |  32 ++++++--

 xlators/protocol/server/src/authenticate.h     |   6 +-

 xlators/protocol/server/src/server-handshake.c |   4 +-

 xlators/protocol/server/src/server.c           |  20 ++++-

 xlators/protocol/server/src/server.h           |   4 +

 7 files changed, 136 insertions(+), 49 deletions(-)

diff --git a/xlators/mgmt/glusterd/src/glusterd-volgen.c b/xlators/mgmt/glusterd/src/glusterd-volgen.c

index fb7c91f..02e8393 100644

--- a/xlators/mgmt/glusterd/src/glusterd-volgen.c

+++ b/xlators/mgmt/glusterd/src/glusterd-volgen.c

@@ -2145,6 +2145,7 @@ brick_graph_add_server (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,

         char            key[1024] = {0};

         char            *ssl_user = NULL;

         char            *value = NULL;

+        char            *volname = NULL;

         char            *address_family_data = NULL;

         if (!graph || !volinfo || !set_dict || !brickinfo)

@@ -2220,6 +2221,20 @@ brick_graph_add_server (volgen_graph_t *graph, glusterd_volinfo_t *volinfo,

         if (ret)

                 return -1;

+        volname = volinfo->is_snap_volume ?

+                  volinfo->parent_volname : volinfo->volname;

+

+

+        if (volname && !strcmp (volname, GLUSTER_SHARED_STORAGE)) {

+

+                memset (key, 0, sizeof (key));

+                snprintf (key, sizeof (key), "strict-auth-accept");

+

+                ret = xlator_set_option (xl, key, "true");

+                if (ret)

+                        return -1;

+        }

+

         if (dict_get_str (volinfo->dict, "auth.ssl-allow", &ssl_user) == 0) {

                 memset (key, 0, sizeof (key));

                 snprintf (key, sizeof (key), "auth.login.%s.ssl-allow",

diff --git a/xlators/protocol/auth/login/src/login.c b/xlators/protocol/auth/login/src/login.c

index e799dd2..e918d38 100644

--- a/xlators/protocol/auth/login/src/login.c

+++ b/xlators/protocol/auth/login/src/login.c

@@ -11,45 +11,18 @@

 #include <fnmatch.h>

 #include "authenticate.h"

-auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

-{

+auth_result_t gf_authenticate_user (dict_t *input_params, dict_t *config_params,

+                                    char *username, char *password,

+                                    gf_boolean_t using_ssl) {

         auth_result_t  result  = AUTH_DONT_CARE;

         int             ret             = 0;

         data_t          *allow_user     = NULL;

-        data_t          *username_data  = NULL;

         data_t          *passwd_data    = NULL;

-        data_t          *password_data  = NULL;

-        char            *username       = NULL;

-        char            *password       = NULL;

         char            *brick_name     = NULL;

         char            *searchstr      = NULL;

         char            *username_str   = NULL;

         char            *tmp            = NULL;

         char            *username_cpy   = NULL;

-        gf_boolean_t    using_ssl       = _gf_false;

-

-        username_data = dict_get (input_params, "ssl-name");

-        if (username_data) {

-                gf_log ("auth/login", GF_LOG_INFO,

-                        "connecting user name: %s", username_data->data);

-                using_ssl = _gf_true;

-        }

-        else {

-                username_data = dict_get (input_params, "username");

-                if (!username_data) {

-                        gf_log ("auth/login", GF_LOG_DEBUG,

-                                "username not found, returning DONT-CARE");

-                        goto out;

-                }

-                password_data = dict_get (input_params, "password");

-                if (!password_data) {

-                        gf_log ("auth/login", GF_LOG_WARNING,

-                                "password not found, returning DONT-CARE");

-                        goto out;

-                }

-                password = data_to_str (password_data);

-        }

-        username = data_to_str (username_data);

         brick_name = data_to_str (dict_get (input_params, "remote-subvolume"));

         if (!brick_name) {

@@ -64,7 +37,8 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

         if (-1 == ret) {

                 gf_log ("auth/login", GF_LOG_WARNING,

                         "asprintf failed while setting search string, "

-                        "returning DONT-CARE");

+                        "returning AUTH_STRICT_ACCEPT");

+                result = AUTH_STRICT_ACCEPT;

                 goto out;

         }

@@ -84,7 +58,7 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

                  * who do provide a valid username and password (in fact that's

                  * pretty much the only thing we use non-SSL login auth for),

                  * but they are allowed to connect.  It's wrong, but it's not

-                 * worth changing elsewhere.  Therefore, we do the sane thing

+                 * worth changing elsewhere.  Therefore, we do the same thing

                  * only for SSL here.

                  *

                  * For SSL, if there's a list *you must be on it*.  Note that

@@ -92,13 +66,20 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

                  * ssl-allow=* case as well) authorization is effectively

                  * disabled, though authentication and encryption are still

                  * active.

+                 *

+                 * If option strict-auth-accept is enabled, connection

+                 * will be rejected if you don't have any matching

+                 * username and password (password is only for non-ssl users).

                  */

                 if (using_ssl) {

                         result = AUTH_REJECT;

                 }

                 username_cpy = gf_strdup (allow_user->data);

-                if (!username_cpy)

+                if (!username_cpy) {

+                        if (!using_ssl)

+                                result = AUTH_STRICT_ACCEPT;

                         goto out;

+                }

                 username_str = strtok_r (username_cpy, " ,", &tmp);

@@ -120,6 +101,7 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

                                 if (-1 == ret) {

                                         gf_log ("auth/login", GF_LOG_WARNING,

                                                 "asprintf failed while setting search string");

+                                        result = AUTH_STRICT_ACCEPT;

                                         goto out;

                                 }

                                 passwd_data = dict_get (config_params, searchstr);

@@ -145,11 +127,65 @@ auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

                         }

                         username_str = strtok_r (NULL, " ,", &tmp);

                 }

+        } else {

+                result = AUTH_STRICT_ACCEPT;

         }

-

 out:

         GF_FREE (username_cpy);

+        return result;

+}

+auth_result_t gf_auth (dict_t *input_params, dict_t *config_params)

+{

+        auth_result_t   result           = AUTH_DONT_CARE;

+        auth_result_t   ssl_result       = AUTH_DONT_CARE;

+        data_t          *username_data  = NULL;

+        data_t          *password_data  = NULL;

+        char            *username       = NULL;

+        char            *password       = NULL;

+        gf_boolean_t    using_ssl       = _gf_false;

+

+        username_data = dict_get (input_params, "username");

+        if (!username_data) {

+                gf_log ("auth/login", GF_LOG_DEBUG,

+                        "username not found, returning AUTH_STRICT_ACCEPT");

+                result = AUTH_STRICT_ACCEPT;

+                goto out;

+        }

+        password_data = dict_get (input_params, "password");

+        if (!password_data) {

+                gf_log ("auth/login", GF_LOG_WARNING,

+                        "password not found, returning AUTH_STRICT_ACCEPT");

+                result = AUTH_STRICT_ACCEPT;

+                goto out;

+        }

+        password = data_to_str (password_data);

+        username = data_to_str (username_data);

+

+        result = gf_authenticate_user (input_params, config_params,

+                                                username, password, using_ssl);

+

+        username_data = dict_get (input_params, "ssl-name");

+        if (username_data) {

+                gf_log ("auth/login", GF_LOG_INFO,

+                        "connecting user name: %s", username_data->data);

+                username = data_to_str (username_data);

+                using_ssl = _gf_true;

+                ssl_result = gf_authenticate_user (input_params, config_params,

+                                                   username, NULL, using_ssl);

+                if (ssl_result == AUTH_ACCEPT && result != AUTH_ACCEPT) {

+                        /*

+                         * Here, ssl authentication returns true, but non-ssl

+                         * authentication returns differnt result. We are

+                         * calling for a strict auth check in this case.

+                         */

+                        result = AUTH_STRICT_ACCEPT;

+                } else {

+                        result = ssl_result;

+                }

+        }

+

+out:

         return result;

 }

diff --git a/xlators/protocol/server/src/authenticate.c b/xlators/protocol/server/src/authenticate.c

index c000776..977ed75 100644

--- a/xlators/protocol/server/src/authenticate.c

+++ b/xlators/protocol/server/src/authenticate.c

@@ -18,7 +18,9 @@

 #include <dlfcn.h>

 #include <errno.h>

 #include "authenticate.h"

+#include "authenticate.h"

 #include "server-messages.h"

+#include "server.h"

 static int

 init (dict_t *this, char *key, data_t *value, void *data)

@@ -173,6 +175,7 @@ gf_auth_one_method (dict_t *this, char *key, data_t *value, void *data)

 {

         gf_auth_args_t  *args   = data;

         auth_handle_t   *handle = NULL;

+        int64_t          result;

         if (!value) {

                 return 0;

@@ -183,10 +186,13 @@ gf_auth_one_method (dict_t *this, char *key, data_t *value, void *data)

                 return 0;

         }

-        switch (handle->authenticate (args->iparams, args->cparams)) {

+        result = handle->authenticate (args->iparams, args->cparams);

+        switch (result) {

         case AUTH_ACCEPT:

-                if (args->result != AUTH_REJECT) {

-                        args->result = AUTH_ACCEPT;

+        case AUTH_STRICT_ACCEPT:

+                if (args->result != AUTH_REJECT &&

+                    args->result != AUTH_STRICT_ACCEPT) {

+                        args->result = result;

                 }

                 /* FALLTHROUGH */

         default:

@@ -198,9 +204,8 @@ gf_auth_one_method (dict_t *this, char *key, data_t *value, void *data)

 }

 auth_result_t

-gf_authenticate (dict_t *input_params,

-                 dict_t *config_params,

-                 dict_t *auth_modules)

+gf_authenticate (server_conf_t *conf, dict_t *input_params,

+                 dict_t *config_params, dict_t *auth_modules)

 {

         char *name = NULL;

         data_t *peerinfo_data = NULL;

@@ -210,9 +215,19 @@ gf_authenticate (dict_t *input_params,

         args.cparams = config_params;

         args.result = AUTH_DONT_CARE;

+        GF_VALIDATE_OR_GOTO ("authentication", conf, out);

         dict_foreach (auth_modules, gf_auth_one_method, &args);

-        if (AUTH_DONT_CARE == args.result) {

+        switch (args.result) {

+        case AUTH_STRICT_ACCEPT:

+                if (!conf->strict_auth_enabled) {

+                        args.result = AUTH_ACCEPT;

+                        break;

+                }

+                gf_msg ("auth", GF_LOG_ERROR, 0, PS_MSG_REMOTE_CLIENT_REFUSED,

+                        "Authentication is failed due to the strict options.");

+                /* Fallthrough */

+        case AUTH_DONT_CARE:

                 peerinfo_data = dict_get (input_params, "peer-info-name");

                 if (peerinfo_data) {

@@ -223,8 +238,9 @@ gf_authenticate (dict_t *input_params,

                         "no authentication module is interested in "

                         "accepting remote-client %s", name);

                 args.result = AUTH_REJECT;

+                /* Fallthrough */

         }

-

+out:

         return args.result;

 }

diff --git a/xlators/protocol/server/src/authenticate.h b/xlators/protocol/server/src/authenticate.h

index 3f80231..d5971d3 100644

--- a/xlators/protocol/server/src/authenticate.h

+++ b/xlators/protocol/server/src/authenticate.h

@@ -25,7 +25,8 @@

 typedef enum {

         AUTH_ACCEPT,

         AUTH_REJECT,

-        AUTH_DONT_CARE

+        AUTH_DONT_CARE,

+        AUTH_STRICT_ACCEPT

 } auth_result_t;

 typedef auth_result_t (*auth_fn_t) (dict_t *input_params,

@@ -37,9 +38,6 @@ typedef struct {

         volume_opt_list_t *vol_opt;

 } auth_handle_t;

-auth_result_t gf_authenticate (dict_t *input_params,

-                               dict_t *config_params,

-                               dict_t *auth_modules);

 int32_t gf_auth_init (xlator_t *xl, dict_t *auth_modules);

 void gf_auth_fini (dict_t *auth_modules);

diff --git a/xlators/protocol/server/src/server-handshake.c b/xlators/protocol/server/src/server-handshake.c

index ba5b11a..b67ed47 100644

--- a/xlators/protocol/server/src/server-handshake.c

+++ b/xlators/protocol/server/src/server-handshake.c

@@ -709,7 +709,7 @@ server_setvolume (rpcsvc_request_t *req)

                         ret = dict_get_str (params, "volfile-key",

                                             &volfile_key);

                         if (ret)

-                                gf_msg_debug (this->name, 0, "failed to set "

+                                gf_msg_debug (this->name, 0, "failed to get "

                                               "'volfile-key'");

                         ret = _validate_volfile_checksum (this, volfile_key,

@@ -765,7 +765,7 @@ server_setvolume (rpcsvc_request_t *req)

                         PS_MSG_CLIENT_VERSION_NOT_SET,

                         "client-version not set, may be of older version");

-        ret = gf_authenticate (params, config_params,

+        ret = gf_authenticate (conf, params, config_params,

                                conf->auth_modules);

         if (ret == AUTH_ACCEPT) {

diff --git a/xlators/protocol/server/src/server.c b/xlators/protocol/server/src/server.c

index 96aa012..f89e743 100644

--- a/xlators/protocol/server/src/server.c

+++ b/xlators/protocol/server/src/server.c

@@ -866,6 +866,10 @@ do_rpc:

                 goto out;

         }

+        GF_OPTION_RECONF ("strict-auth-accept", conf->strict_auth_enabled,

+                          options, bool, out);

+

+

         GF_OPTION_RECONF ("dynamic-auth", conf->dync_auth, options,

                         bool, out);

@@ -906,7 +910,7 @@ do_rpc:

                                 if (strcmp (xprt_path, auth_path) != 0) {

                                         continue;

                                 }

-                                ret = gf_authenticate (xprt->clnt_options,

+                                ret = gf_authenticate (conf, xprt->clnt_options,

                                                        options,

                                                        conf->auth_modules);

                                 if (ret == AUTH_ACCEPT) {

@@ -1098,6 +1102,14 @@ init (xlator_t *this)

                         "Failed to initialize group cache.");

                 goto out;

         }

+

+        ret = dict_get_str_boolean (this->options, "strict-auth-accept",

+                        _gf_false);

+        if (ret == -1)

+                conf->strict_auth_enabled = _gf_false;

+        else

+                conf->strict_auth_enabled = ret;

+

         ret = dict_get_str_boolean (this->options, "dynamic-auth",

                         _gf_true);

         if (ret == -1)

@@ -1738,5 +1750,11 @@ struct volume_options options[] = {

                            "transport connection immediately in response to "

                            "*.allow | *.reject volume set options."

         },

+        { .key   = {"strict-auth-accept"},

+          .type  = GF_OPTION_TYPE_BOOL,

+          .default_value = "off",

+          .description   = "strict-auth-accept reject connection with out"

+                           "a valid username and password."

+        },

         { .key   = {NULL} },

 };

diff --git a/xlators/protocol/server/src/server.h b/xlators/protocol/server/src/server.h

index 1be9a38..4c35aaa 100644

--- a/xlators/protocol/server/src/server.h

+++ b/xlators/protocol/server/src/server.h

@@ -24,6 +24,7 @@

 #include "client_t.h"

 #include "gidcache.h"

 #include "defaults.h"

+#include "authenticate.h"

 #define DEFAULT_BLOCK_SIZE         4194304   /* 4MB */

 #define DEFAULT_VOLUME_FILE_PATH   CONFDIR "/glusterfs.vol"

@@ -111,6 +112,7 @@ struct server_conf {

         struct _child_status    *child_status;

         gf_lock_t               itable_lock;

+        gf_boolean_t            strict_auth_enabled;

 };

 typedef struct server_conf server_conf_t;

@@ -243,6 +245,8 @@ serialize_rsp_dirent (gf_dirent_t *entries, gfs3_readdir_rsp *rsp);

 int

 serialize_rsp_direntp (gf_dirent_t *entries, gfs3_readdirp_rsp *rsp);

+auth_result_t gf_authenticate (server_conf_t *conf, dict_t *input_params,

+                               dict_t *config_params, dict_t *auth_modules);

 server_ctx_t*

 server_ctx_get (client_t *client, xlator_t *xlator);

-- 

1.8.3.1