Skip to content

Commit 6ed4f3a

Browse files
rolysrrolysr
authored
feat(tls): Secure master-admin with TLS layer (#748)
This change introduces a TLS layer to encrypt traffic between the master and the saunafs-admin binary, protecting data in transit and mitigating on-path attacks. For that goal, an optional TLS configuration file path option has been added on all commands for saunafs-admin. Also, this change allows the shadow metadata servers to start a TLS connection request, which is needed for some saunafs-admin binary to securely communicate to it. Signed-off-by: Rolando Sánchez Ramos <rolysr@leil.io>
1 parent 557b4cc commit 6ed4f3a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+566
-124
lines changed

‎src/admin/chunk_health_command.cc‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ SaunaFsAdminCommand::SupportedOptions ChunksHealthCommand::supportedOptions() co
4444
{kOptionAvailability, "Print report about availability of chunks."},
4545
{kOptionReplication, "Print report about about number of chunks that need replication."},
4646
{kOptionDeletion, "Print report about about number of chunks that need deletion."},
47+
{kTlsMode, kTlsModeDescription},
4748
};
4849
}
4950

@@ -76,7 +77,10 @@ void ChunksHealthCommand::run(const Options& options) const {
7677
throw WrongUsageException("Expected <master ip> and <master port> for " + name() + '\n');
7778
}
7879

79-
ServerConnection connection(options.argument(0), options.argument(1));
80+
auto tlsCfg =
81+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
82+
83+
ServerConnection connection(options.argument(0), options.argument(1), tlsCfg);
8084
bool regularOnly = false;
8185
auto request = cltoma::chunksHealth::build(regularOnly);
8286
auto response = connection.sendAndReceive(request, SAU_MATOCL_CHUNKS_HEALTH);

‎src/admin/delete_sessions_command.cc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,21 @@ void DeleteSessionsCommand::usage() const {
3131
std::cerr << " Deletes the specified session." << std::endl;
3232
}
3333

34+
SaunaFsAdminCommand::SupportedOptions DeleteSessionsCommand::supportedOptions() const {
35+
return {
36+
{kTlsMode, kTlsModeDescription},
37+
};
38+
}
39+
3440
void DeleteSessionsCommand::run(const Options& options) const {
3541
if (options.arguments().size() != 3) {
3642
throw WrongUsageException("Expected <master ip>, <master port>, and <session_id> for " + name());
3743
}
3844

39-
ServerConnection connection(options.argument(0), options.argument(1));
45+
auto tlsCfg =
46+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
47+
48+
ServerConnection connection(options.argument(0), options.argument(1), tlsCfg);
4049
uint64_t sessionId = std::stoull(options.argument(2));
4150

4251
auto request = cltoma::deleteSession::build(sessionId);

‎src/admin/delete_sessions_command.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,5 @@ class DeleteSessionsCommand : public SaunaFsAdminCommand {
2424
std::string name() const final;
2525
void usage() const final;
2626
void run(const Options& options) const final;
27+
virtual SupportedOptions supportedOptions() const;
2728
};

‎src/admin/dump_config_command.cc‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,9 @@ SaunaFsAdminCommand::SupportedOptions DumpConfigurationCommand::supportedOptions
4444
defaultsMode,
4545
"Return default values as well. This is informational and may "
4646
"not be correct in all cases."
47+
},
48+
{
49+
kTlsMode, kTlsModeDescription
4750
}
4851
};
4952
}
@@ -54,8 +57,10 @@ void DumpConfigurationCommand::run(const Options &options) const {
5457
"Expected <master ip> and <master port> for " + name());
5558
}
5659

57-
auto connection = RegisteredAdminConnection::create(options.argument(0),
58-
options.argument(1));
60+
auto tlsCfg =
61+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
62+
63+
auto connection = RegisteredAdminConnection::create(options.argument(0), options.argument(1), tlsCfg);
5964
auto adminResponse = connection->sendAndReceive(
6065
cltoma::adminDumpConfiguration::build(), SAU_MATOCL_ADMIN_DUMP_CONFIG);
6166

‎src/admin/info_command.cc‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ std::string InfoCommand::name() const {
3535
SaunaFsAdminCommand::SupportedOptions InfoCommand::supportedOptions() const {
3636
return {
3737
{kPorcelainMode, kPorcelainModeDescription},
38+
{kTlsMode, kTlsModeDescription},
3839
};
3940
}
4041

@@ -48,7 +49,11 @@ void InfoCommand::run(const Options& options) const {
4849
throw WrongUsageException("Expected <master ip> and <master port> for " + name());
4950
}
5051

51-
ServerConnection connection(options.argument(0), options.argument(1));
52+
const std::string host = options.argument(0);
53+
const std::string port = options.argument(1);
54+
auto tlsCfg =
55+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
56+
ServerConnection connection(host, port, tlsCfg);
5257
std::vector<uint8_t> request, response;
5358
serializeLegacyPacket(request, CLTOMA_INFO);
5459
response = connection.sendAndReceive(request, MATOCL_INFO);

‎src/admin/io_limits_status_command.cc‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,18 @@ void IoLimitsStatusCommand::usage() const {
3737
}
3838

3939
SaunaFsAdminCommand::SupportedOptions IoLimitsStatusCommand::supportedOptions() const {
40-
return { {kPorcelainMode, kPorcelainModeDescription} };
40+
return {{kPorcelainMode, kPorcelainModeDescription}, {kTlsMode, kTlsModeDescription}};
4141
}
4242

4343
void IoLimitsStatusCommand::run(const Options& options) const {
4444
if (options.arguments().size() != 2) {
4545
throw WrongUsageException("Expected <master ip> and <master port> for " + name());
4646
}
4747

48-
ServerConnection connection(options.argument(0), options.argument(1));
48+
auto tlsCfg =
49+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
50+
51+
ServerConnection connection(options.argument(0), options.argument(1), tlsCfg);
4952
auto request = cltoma::iolimitsStatus::build(1);
5053
auto response = connection.sendAndReceive(request, SAU_MATOCL_IOLIMITS_STATUS);
5154

‎src/admin/list_chunkservers_command.cc‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ std::string ListChunkserversCommand::name() const {
3737
SaunaFsAdminCommand::SupportedOptions ListChunkserversCommand::supportedOptions() const {
3838
return {
3939
{kPorcelainMode, kPorcelainModeDescription},
40+
{kTlsMode, kTlsModeDescription},
4041
};
4142
}
4243

@@ -49,7 +50,11 @@ void ListChunkserversCommand::run(const Options& options) const {
4950
if (options.arguments().size() != 2) {
5051
throw WrongUsageException("Expected <master ip> and <master port> for " + name());
5152
}
52-
for (const auto& cs : getChunkserversList(options.argument(0), options.argument(1))) {
53+
54+
auto tlsCfg =
55+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
56+
57+
for (const auto& cs : getChunkserversList(options.argument(0), options.argument(1), tlsCfg)) {
5358
auto address = NetworkAddress(cs.servip, cs.servport);
5459
if (cs.version == kDisconnectedChunkserverVersion) {
5560
if (options.isSet(kPorcelainMode)) {
@@ -89,8 +94,8 @@ void ListChunkserversCommand::run(const Options& options) const {
8994
}
9095

9196
std::vector<ChunkserverListEntry> ListChunkserversCommand::getChunkserversList (
92-
const std::string& masterHost, const std::string& masterPort) {
93-
ServerConnection connection(masterHost, masterPort);
97+
const std::string& masterHost, const std::string& masterPort, const std::string& tlsCfg) {
98+
ServerConnection connection(masterHost, masterPort, tlsCfg);
9499
auto request = cltoma::cservList::build(true);
95100
auto response = connection.sendAndReceive(request, SAU_MATOCL_CSERV_LIST);
96101
std::vector<ChunkserverListEntry> result;

‎src/admin/list_chunkservers_command.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ class ListChunkserversCommand : public SaunaFsAdminCommand {
3535
virtual void usage() const;
3636
virtual void run(const Options& options) const;
3737

38-
static std::vector<ChunkserverListEntry> getChunkserversList (
39-
const std::string& masterHost, const std::string& masterPort);
38+
static std::vector<ChunkserverListEntry> getChunkserversList(const std::string &masterHost,
39+
const std::string &masterPort,
40+
const std::string &tlsCfg);
4041
};

‎src/admin/list_defective_files_command.cc‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ void ListDefectiveFilesCommand::usage() const {
4848
SaunaFsAdminCommand::SupportedOptions ListDefectiveFilesCommand::supportedOptions() const {
4949
return {
5050
{kPorcelainMode, kPorcelainModeDescription},
51+
{kTlsMode, kTlsModeDescription},
5152
{"--unavailable", "Print unavailable files"},
5253
{"--undergoal", "Print files with undergoal chunks"},
5354
{"--structure-error", "Print files/directories with structure error"},
@@ -80,7 +81,10 @@ void ListDefectiveFilesCommand::run(const Options &options) const {
8081
throw WrongUsageException("Expected <master ip> and <master port> for " + name());
8182
}
8283

83-
ServerConnection connection(options.argument(0), options.argument(1));
84+
auto tlsCfg =
85+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
86+
87+
ServerConnection connection(options.argument(0), options.argument(1), tlsCfg);
8488
uint8_t flags_set = 0;
8589
if (options.isSet("--unavailable")) {
8690
flags_set |= kChunkUnavailable;

‎src/admin/list_disk_groups_command.cc‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@
2929

3030
std::string ListDiskGroupsCommand::name() const { return "list-disk-groups"; }
3131

32+
SaunaFsAdminCommand::SupportedOptions ListDiskGroupsCommand::supportedOptions() const {
33+
return {
34+
{kTlsMode, kTlsModeDescription},
35+
};
36+
}
37+
3238
void ListDiskGroupsCommand::usage() const {
3339
std::cerr << name() << " <master ip> <master port>\n";
3440
std::cerr << " Prints disk groups configuration in chunkservers.\n";
@@ -40,8 +46,11 @@ void ListDiskGroupsCommand::run(const Options &options) const {
4046
"Expected <master ip> and <master port> for " + name());
4147
}
4248

49+
auto tlsCfg =
50+
options.getValue<std::string>("--tlsconfigfile", std::string(TlsSession::kNoFile));
51+
4352
auto chunkservers = ListChunkserversCommand::getChunkserversList(
44-
options.argument(0), options.argument(1));
53+
options.argument(0), options.argument(1), tlsCfg);
4554

4655
YAML::Emitter yaml;
4756
yaml << YAML::BeginMap; // start root map

0 commit comments

Comments
 (0)