aboutsummaryrefslogtreecommitdiff
path: root/go/weed
diff options
context:
space:
mode:
Diffstat (limited to 'go/weed')
-rw-r--r--go/weed/master.go4
-rw-r--r--go/weed/server.go8
-rw-r--r--go/weed/volume.go4
-rw-r--r--go/weed/weed_server/common.go20
-rw-r--r--go/weed/weed_server/master_server.go32
-rw-r--r--go/weed/weed_server/volume_server.go31
-rw-r--r--go/weed/weed_server/volume_server_handlers.go6
7 files changed, 48 insertions, 57 deletions
diff --git a/go/weed/master.go b/go/weed/master.go
index f88964b6d..de4b5cb4b 100644
--- a/go/weed/master.go
+++ b/go/weed/master.go
@@ -42,6 +42,7 @@ var (
mMaxCpu = cmdMaster.Flag.Int("maxCpu", 0, "maximum number of CPUs. 0 means all available CPUs")
garbageThreshold = cmdMaster.Flag.String("garbageThreshold", "0.3", "threshold to vacuum and reclaim spaces")
masterWhiteListOption = cmdMaster.Flag.String("whiteList", "", "comma separated Ip addresses having write permission. No limit if empty.")
+ masterSecureKey = cmdMaster.Flag.String("secure.key", "", "secret key to check permission")
masterWhiteList []string
)
@@ -60,7 +61,8 @@ func runMaster(cmd *Command, args []string) bool {
r := mux.NewRouter()
ms := weed_server.NewMasterServer(r, *mport, *metaFolder,
- *volumeSizeLimitMB, *mpulse, *confFile, *defaultReplicaPlacement, *garbageThreshold, masterWhiteList,
+ *volumeSizeLimitMB, *mpulse, *confFile, *defaultReplicaPlacement, *garbageThreshold,
+ masterWhiteList, *masterSecureKey,
)
listeningAddress := *masterBindIp + ":" + strconv.Itoa(*mport)
diff --git a/go/weed/server.go b/go/weed/server.go
index 67bbdb370..2db251944 100644
--- a/go/weed/server.go
+++ b/go/weed/server.go
@@ -56,6 +56,7 @@ var (
serverRack = cmdServer.Flag.String("rack", "", "current volume server's rack name")
serverWhiteListOption = cmdServer.Flag.String("whiteList", "", "comma separated Ip addresses having write permission. No limit if empty.")
serverPeers = cmdServer.Flag.String("master.peers", "", "other master nodes in comma separated ip:masterPort list")
+ serverSecureKey = cmdServer.Flag.String("secure.key", "", "secret key to ensure authenticated access")
serverGarbageThreshold = cmdServer.Flag.String("garbageThreshold", "0.3", "threshold to vacuum and reclaim spaces")
masterPort = cmdServer.Flag.Int("master.port", 9333, "master server http listen port")
masterMetaFolder = cmdServer.Flag.String("master.dir", "", "data directory to store meta data, default to same as -dir specified")
@@ -185,7 +186,8 @@ func runServer(cmd *Command, args []string) bool {
go func() {
r := mux.NewRouter()
ms := weed_server.NewMasterServer(r, *masterPort, *masterMetaFolder,
- *masterVolumeSizeLimitMB, *volumePulse, *masterConfFile, *masterDefaultReplicaPlacement, *serverGarbageThreshold, serverWhiteList,
+ *masterVolumeSizeLimitMB, *volumePulse, *masterConfFile, *masterDefaultReplicaPlacement, *serverGarbageThreshold,
+ serverWhiteList, *serverSecureKey,
)
glog.V(0).Infoln("Start Seaweed Master", util.VERSION, "at", *serverIp+":"+strconv.Itoa(*masterPort))
@@ -217,8 +219,8 @@ func runServer(cmd *Command, args []string) bool {
time.Sleep(100 * time.Millisecond)
r := http.NewServeMux()
volumeServer := weed_server.NewVolumeServer(r, *serverIp, *volumePort, *serverPublicIp, folders, maxCounts,
- *serverIp+":"+strconv.Itoa(*masterPort), *volumePulse, *serverDataCenter, *serverRack, serverWhiteList,
- *volumeFixJpgOrientation,
+ *serverIp+":"+strconv.Itoa(*masterPort), *volumePulse, *serverDataCenter, *serverRack,
+ serverWhiteList, *volumeFixJpgOrientation,
)
glog.V(0).Infoln("Start Seaweed volume server", util.VERSION, "at", *serverIp+":"+strconv.Itoa(*volumePort))
diff --git a/go/weed/volume.go b/go/weed/volume.go
index 212cb4b33..22b50cd34 100644
--- a/go/weed/volume.go
+++ b/go/weed/volume.go
@@ -27,6 +27,7 @@ var cmdVolume = &Command{
var (
vport = cmdVolume.Flag.Int("port", 8080, "http listen port")
+ volumeSecurePort = cmdVolume.Flag.Int("port.secure", 8443, "https listen port, active when SSL certs are specified. Not ready yet.")
volumeFolders = cmdVolume.Flag.String("dir", os.TempDir(), "directories to store data files. dir[,dir]...")
maxVolumeCounts = cmdVolume.Flag.String("max", "7", "maximum numbers of volumes, count[,count]...")
ip = cmdVolume.Flag.String("ip", "", "ip or server name")
@@ -82,7 +83,8 @@ func runVolume(cmd *Command, args []string) bool {
r := http.NewServeMux()
volumeServer := weed_server.NewVolumeServer(r, *ip, *vport, *publicIp, folders, maxCounts,
- *masterNode, *vpulse, *dataCenter, *rack, volumeWhiteList,
+ *masterNode, *vpulse, *dataCenter, *rack,
+ volumeWhiteList,
*fixJpgOrientation,
)
diff --git a/go/weed/weed_server/common.go b/go/weed/weed_server/common.go
index 39b0830e3..5c782c091 100644
--- a/go/weed/weed_server/common.go
+++ b/go/weed/weed_server/common.go
@@ -4,7 +4,6 @@ import (
"bytes"
"encoding/json"
"fmt"
- "net"
"net/http"
"path/filepath"
"strconv"
@@ -72,25 +71,6 @@ func debug(params ...interface{}) {
glog.V(4).Infoln(params)
}
-func secure(whiteList []string, f func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
- return func(w http.ResponseWriter, r *http.Request) {
- if len(whiteList) == 0 {
- f(w, r)
- return
- }
- host, _, err := net.SplitHostPort(r.RemoteAddr)
- if err == nil {
- for _, ip := range whiteList {
- if ip == host {
- f(w, r)
- return
- }
- }
- }
- writeJsonQuiet(w, r, map[string]interface{}{"error": "No write permisson from " + host})
- }
-}
-
func submitForClientHandler(w http.ResponseWriter, r *http.Request, masterUrl string) {
m := make(map[string]interface{})
if r.Method != "POST" {
diff --git a/go/weed/weed_server/master_server.go b/go/weed/weed_server/master_server.go
index d000cb610..0a4ca5d5e 100644
--- a/go/weed/weed_server/master_server.go
+++ b/go/weed/weed_server/master_server.go
@@ -7,6 +7,7 @@ import (
"sync"
"github.com/chrislusf/weed-fs/go/glog"
+ "github.com/chrislusf/weed-fs/go/security"
"github.com/chrislusf/weed-fs/go/sequence"
"github.com/chrislusf/weed-fs/go/topology"
"github.com/chrislusf/weed-fs/go/util"
@@ -21,7 +22,6 @@ type MasterServer struct {
pulseSeconds int
defaultReplicaPlacement string
garbageThreshold string
- whiteList []string
Topo *topology.Topology
vg *topology.VolumeGrowth
@@ -37,6 +37,7 @@ func NewMasterServer(r *mux.Router, port int, metaFolder string,
defaultReplicaPlacement string,
garbageThreshold string,
whiteList []string,
+ secureKey string,
) *MasterServer {
ms := &MasterServer{
port: port,
@@ -44,7 +45,6 @@ func NewMasterServer(r *mux.Router, port int, metaFolder string,
pulseSeconds: pulseSeconds,
defaultReplicaPlacement: defaultReplicaPlacement,
garbageThreshold: garbageThreshold,
- whiteList: whiteList,
}
ms.bounedLeaderChan = make(chan int, 16)
seq := sequence.NewMemorySequencer()
@@ -56,20 +56,22 @@ func NewMasterServer(r *mux.Router, port int, metaFolder string,
ms.vg = topology.NewDefaultVolumeGrowth()
glog.V(0).Infoln("Volume Size Limit is", volumeSizeLimitMB, "MB")
- r.HandleFunc("/dir/assign", ms.proxyToLeader(secure(ms.whiteList, ms.dirAssignHandler)))
- r.HandleFunc("/dir/lookup", ms.proxyToLeader(secure(ms.whiteList, ms.dirLookupHandler)))
- r.HandleFunc("/dir/join", ms.proxyToLeader(secure(ms.whiteList, ms.dirJoinHandler)))
- r.HandleFunc("/dir/status", ms.proxyToLeader(secure(ms.whiteList, ms.dirStatusHandler)))
- r.HandleFunc("/col/delete", ms.proxyToLeader(secure(ms.whiteList, ms.collectionDeleteHandler)))
- r.HandleFunc("/vol/lookup", ms.proxyToLeader(secure(ms.whiteList, ms.volumeLookupHandler)))
- r.HandleFunc("/vol/grow", ms.proxyToLeader(secure(ms.whiteList, ms.volumeGrowHandler)))
- r.HandleFunc("/vol/status", ms.proxyToLeader(secure(ms.whiteList, ms.volumeStatusHandler)))
- r.HandleFunc("/vol/vacuum", ms.proxyToLeader(secure(ms.whiteList, ms.volumeVacuumHandler)))
- r.HandleFunc("/submit", secure(ms.whiteList, ms.submitFromMasterServerHandler))
- r.HandleFunc("/delete", secure(ms.whiteList, ms.deleteFromMasterServerHandler))
+ guard := security.NewGuard(whiteList, secureKey)
+
+ r.HandleFunc("/dir/assign", ms.proxyToLeader(guard.Secure(ms.dirAssignHandler)))
+ r.HandleFunc("/dir/lookup", ms.proxyToLeader(guard.Secure(ms.dirLookupHandler)))
+ r.HandleFunc("/dir/join", ms.proxyToLeader(guard.Secure(ms.dirJoinHandler)))
+ r.HandleFunc("/dir/status", ms.proxyToLeader(guard.Secure(ms.dirStatusHandler)))
+ r.HandleFunc("/col/delete", ms.proxyToLeader(guard.Secure(ms.collectionDeleteHandler)))
+ r.HandleFunc("/vol/lookup", ms.proxyToLeader(guard.Secure(ms.volumeLookupHandler)))
+ r.HandleFunc("/vol/grow", ms.proxyToLeader(guard.Secure(ms.volumeGrowHandler)))
+ r.HandleFunc("/vol/status", ms.proxyToLeader(guard.Secure(ms.volumeStatusHandler)))
+ r.HandleFunc("/vol/vacuum", ms.proxyToLeader(guard.Secure(ms.volumeVacuumHandler)))
+ r.HandleFunc("/submit", guard.Secure(ms.submitFromMasterServerHandler))
+ r.HandleFunc("/delete", guard.Secure(ms.deleteFromMasterServerHandler))
r.HandleFunc("/{fileId}", ms.redirectHandler)
- r.HandleFunc("/stats/counter", secure(ms.whiteList, statsCounterHandler))
- r.HandleFunc("/stats/memory", secure(ms.whiteList, statsMemoryHandler))
+ r.HandleFunc("/stats/counter", guard.Secure(statsCounterHandler))
+ r.HandleFunc("/stats/memory", guard.Secure(statsMemoryHandler))
ms.Topo.StartRefreshWritableVolumes(garbageThreshold)
diff --git a/go/weed/weed_server/volume_server.go b/go/weed/weed_server/volume_server.go
index 0a65fd2f6..9ceeb0149 100644
--- a/go/weed/weed_server/volume_server.go
+++ b/go/weed/weed_server/volume_server.go
@@ -7,6 +7,7 @@ import (
"time"
"github.com/chrislusf/weed-fs/go/glog"
+ "github.com/chrislusf/weed-fs/go/security"
"github.com/chrislusf/weed-fs/go/storage"
)
@@ -15,8 +16,8 @@ type VolumeServer struct {
pulseSeconds int
dataCenter string
rack string
- whiteList []string
store *storage.Store
+ guard *security.Guard
FixJpgOrientation bool
}
@@ -24,29 +25,31 @@ type VolumeServer struct {
func NewVolumeServer(r *http.ServeMux, ip string, port int, publicIp string, folders []string, maxCounts []int,
masterNode string, pulseSeconds int,
dataCenter string, rack string,
- whiteList []string, fixJpgOrientation bool) *VolumeServer {
+ whiteList []string,
+ fixJpgOrientation bool) *VolumeServer {
publicUrl := publicIp + ":" + strconv.Itoa(port)
vs := &VolumeServer{
masterNode: masterNode,
pulseSeconds: pulseSeconds,
dataCenter: dataCenter,
rack: rack,
- whiteList: whiteList,
FixJpgOrientation: fixJpgOrientation,
}
vs.store = storage.NewStore(port, ip, publicUrl, folders, maxCounts)
- r.HandleFunc("/status", secure(vs.whiteList, vs.statusHandler))
- r.HandleFunc("/admin/assign_volume", secure(vs.whiteList, vs.assignVolumeHandler))
- r.HandleFunc("/admin/vacuum_volume_check", secure(vs.whiteList, vs.vacuumVolumeCheckHandler))
- r.HandleFunc("/admin/vacuum_volume_compact", secure(vs.whiteList, vs.vacuumVolumeCompactHandler))
- r.HandleFunc("/admin/vacuum_volume_commit", secure(vs.whiteList, vs.vacuumVolumeCommitHandler))
- r.HandleFunc("/admin/freeze_volume", secure(vs.whiteList, vs.freezeVolumeHandler))
- r.HandleFunc("/admin/delete_collection", secure(vs.whiteList, vs.deleteCollectionHandler))
- r.HandleFunc("/stats/counter", secure(vs.whiteList, statsCounterHandler))
- r.HandleFunc("/stats/memory", secure(vs.whiteList, statsMemoryHandler))
- r.HandleFunc("/stats/disk", secure(vs.whiteList, vs.statsDiskHandler))
- r.HandleFunc("/delete", secure(vs.whiteList, vs.batchDeleteHandler))
+ vs.guard = security.NewGuard(whiteList, "")
+
+ r.HandleFunc("/status", vs.guard.Secure(vs.statusHandler))
+ r.HandleFunc("/admin/assign_volume", vs.guard.Secure(vs.assignVolumeHandler))
+ r.HandleFunc("/admin/vacuum_volume_check", vs.guard.Secure(vs.vacuumVolumeCheckHandler))
+ r.HandleFunc("/admin/vacuum_volume_compact", vs.guard.Secure(vs.vacuumVolumeCompactHandler))
+ r.HandleFunc("/admin/vacuum_volume_commit", vs.guard.Secure(vs.vacuumVolumeCommitHandler))
+ r.HandleFunc("/admin/freeze_volume", vs.guard.Secure(vs.freezeVolumeHandler))
+ r.HandleFunc("/admin/delete_collection", vs.guard.Secure(vs.deleteCollectionHandler))
+ r.HandleFunc("/stats/counter", vs.guard.Secure(statsCounterHandler))
+ r.HandleFunc("/stats/memory", vs.guard.Secure(statsMemoryHandler))
+ r.HandleFunc("/stats/disk", vs.guard.Secure(vs.statsDiskHandler))
+ r.HandleFunc("/delete", vs.guard.Secure(vs.batchDeleteHandler))
r.HandleFunc("/", vs.storeHandler)
go func() {
diff --git a/go/weed/weed_server/volume_server_handlers.go b/go/weed/weed_server/volume_server_handlers.go
index 83f614941..3abfe96b5 100644
--- a/go/weed/weed_server/volume_server_handlers.go
+++ b/go/weed/weed_server/volume_server_handlers.go
@@ -29,13 +29,13 @@ func (vs *VolumeServer) storeHandler(w http.ResponseWriter, r *http.Request) {
vs.GetOrHeadHandler(w, r)
case "DELETE":
stats.DeleteRequest()
- secure(vs.whiteList, vs.DeleteHandler)(w, r)
+ vs.guard.Secure(vs.DeleteHandler)(w, r)
case "PUT":
stats.WriteRequest()
- secure(vs.whiteList, vs.PostHandler)(w, r)
+ vs.guard.Secure(vs.PostHandler)(w, r)
case "POST":
stats.WriteRequest()
- secure(vs.whiteList, vs.PostHandler)(w, r)
+ vs.guard.Secure(vs.PostHandler)(w, r)
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2025-12-24 22:47:22 +0000