diff --git a/etcdserver/api/v2http/client_auth.go b/etcdserver/api/v2http/client_auth.go index 0907c438a..286dd3209 100644 --- a/etcdserver/api/v2http/client_auth.go +++ b/etcdserver/api/v2http/client_auth.go @@ -56,6 +56,24 @@ func userFromBasicAuth(sec auth.Store, r *http.Request) *auth.User { return &user } +func userFromClientCertificate(sec auth.Store, r *http.Request) *auth.User { + if r.TLS == nil { + return nil + } + + for _, chains := range r.TLS.VerifiedChains { + for _, chain := range chains { + plog.Debugf("auth: found common name %s.\n", chain.Subject.CommonName) + user, err := sec.GetUser(chain.Subject.CommonName) + if err == nil { + plog.Debugf("auth: authenticated user %s by cert common name.", user.User) + return &user + } + } + } + return nil +} + func hasRootAccess(sec auth.Store, r *http.Request) bool { if sec == nil { // No store means no auth available, eg, tests. @@ -65,9 +83,17 @@ func hasRootAccess(sec auth.Store, r *http.Request) bool { return true } - rootUser := userFromBasicAuth(sec, r) - if rootUser == nil { - return false + var rootUser *auth.User + if r.Header.Get("Authorization") == "" { + rootUser = userFromClientCertificate(sec, r) + if rootUser == nil { + return false + } + } else { + rootUser = userFromBasicAuth(sec, r) + if rootUser == nil { + return false + } } for _, role := range rootUser.Roles { @@ -87,14 +113,19 @@ func hasKeyPrefixAccess(sec auth.Store, r *http.Request, key string, recursive b if !sec.AuthEnabled() { return true } - if r.Header.Get("Authorization") == "" { - plog.Warningf("auth: no authorization provided, checking guest access") - return hasGuestAccess(sec, r, key) - } - user := userFromBasicAuth(sec, r) - if user == nil { - return false + var user *auth.User + if r.Header.Get("Authorization") == "" { + user = userFromClientCertificate(sec, r) + if user == nil { + plog.Warningf("auth: no authorization provided, checking guest access") + return hasGuestAccess(sec, r, key) + } + } else { + user = userFromBasicAuth(sec, r) + if user == nil { + return false + } } writeAccess := r.Method != "GET" && r.Method != "HEAD" diff --git a/etcdserver/api/v2http/client_auth_test.go b/etcdserver/api/v2http/client_auth_test.go index 5afbd750b..8976148a9 100644 --- a/etcdserver/api/v2http/client_auth_test.go +++ b/etcdserver/api/v2http/client_auth_test.go @@ -15,9 +15,13 @@ package v2http import ( + "crypto/tls" + "crypto/x509" "encoding/json" + "encoding/pem" "errors" "fmt" + "io/ioutil" "net/http" "net/http/httptest" "net/url" @@ -448,6 +452,24 @@ func unauthedRequest(method string) *http.Request { return req } +func tlsAuthedRequest(req *http.Request, certname string) *http.Request { + bytes, err := ioutil.ReadFile(fmt.Sprintf("testdata/%s.pem", certname)) + if err != nil { + panic(err) + } + + block, _ := pem.Decode(bytes) + cert, err := x509.ParseCertificate(block.Bytes) + if err != nil { + panic(err) + } + + req.TLS = &tls.ConnectionState{ + VerifiedChains: [][]*x509.Certificate{{cert}}, + } + return req +} + func TestPrefixAccess(t *testing.T) { var table = []struct { key string @@ -710,6 +732,88 @@ func TestPrefixAccess(t *testing.T) { } } +func TestUserFromClientCertificate(t *testing.T) { + witherror := &mockAuthStore{ + users: map[string]*auth.User{ + "user": { + User: "user", + Roles: []string{"root"}, + Password: "password", + }, + "basicauth": { + User: "basicauth", + Roles: []string{"root"}, + Password: "password", + }, + }, + roles: map[string]*auth.Role{ + "root": { + Role: "root", + }, + }, + err: errors.New(""), + } + + noerror := &mockAuthStore{ + users: map[string]*auth.User{ + "user": { + User: "user", + Roles: []string{"root"}, + Password: "password", + }, + "basicauth": { + User: "basicauth", + Roles: []string{"root"}, + Password: "password", + }, + }, + roles: map[string]*auth.Role{ + "root": { + Role: "root", + }, + }, + } + + var table = []struct { + req *http.Request + userExists bool + store auth.Store + username string + }{ + { + // non tls request + req: unauthedRequest("GET"), + userExists: false, + store: witherror, + }, + { + // cert with cn of existing user + req: tlsAuthedRequest(unauthedRequest("GET"), "user"), + userExists: true, + username: "user", + store: noerror, + }, + { + // cert with cn of non-existing user + req: tlsAuthedRequest(unauthedRequest("GET"), "otheruser"), + userExists: false, + store: witherror, + }, + } + + for i, tt := range table { + user := userFromClientCertificate(tt.store, tt.req) + userExists := user != nil + + if tt.userExists != userExists { + t.Errorf("#%d: userFromClientCertificate doesn't match (expected %v)", i, tt.userExists) + } + if user != nil && (tt.username != user.User) { + t.Errorf("#%d: userFromClientCertificate username doesn't match (expected %s, got %s)", i, tt.username, user.User) + } + } +} + func TestUserFromBasicAuth(t *testing.T) { sec := &mockAuthStore{ users: map[string]*auth.User{ @@ -764,7 +868,9 @@ func TestUserFromBasicAuth(t *testing.T) { for i, tt := range table { user := userFromBasicAuth(sec, tt.req) - if tt.userExists == (user == nil) { + userExists := user != nil + + if tt.userExists != userExists { t.Errorf("#%d: userFromBasicAuth doesn't match (expected %v)", i, tt.userExists) } if user != nil && (tt.username != user.User) { diff --git a/etcdserver/etcdhttp/testdata/ca.pem b/etcdserver/etcdhttp/testdata/ca.pem new file mode 100644 index 000000000..60cbee3bb --- /dev/null +++ b/etcdserver/etcdhttp/testdata/ca.pem @@ -0,0 +1,19 @@ +-----BEGIN CERTIFICATE----- +MIIDEjCCAfqgAwIBAgIIYpX+8HgWGfkwDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE +AxMKZXRjZCB0ZXN0czAeFw0xNTExMjQwMzA1MDBaFw0yMDExMjIwMzA1MDBaMBUx +EzARBgNVBAMTCmV0Y2QgdGVzdHMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQDa9PkwEwiBD8mB+VIKz5r5gRHnNF4Icj6T6R/RsdatecQe6vU0EU4FXtKZ +drWnCGlATyrQooqHpb+rDc7CUt3mXrIxrNkcGTMaesF7P0GWxVkyOGSjJMxGBv3e +bAZknBe4eLMi68L1aT/uYmxcp/B3L2mfdFtc1Gd6mYJpNm1PgilRyIrO0mY5ysIX +4WHCa3yudAv8HrFbQcw7l7OyKA6uSWg6h07lE3d5jw5YOly+hz0iaRtzhb4tJrYD +Lm1tehb0nnoLuW6yYblRSoyBVDT50MFVlyvW40Po5WkOXw/wnsnyxWRR4yqU23wq +quQU0HXJEBLFnT+KbLOQ0EAE35vXAgMBAAGjZjBkMA4GA1UdDwEB/wQEAwIBBjAS +BgNVHRMBAf8ECDAGAQH/AgECMB0GA1UdDgQWBBSbUCGB95ochDrbEZlzGGYuA7xu +xjAfBgNVHSMEGDAWgBSbUCGB95ochDrbEZlzGGYuA7xuxjANBgkqhkiG9w0BAQsF +AAOCAQEAardO/SGCu7Snz3YRBUinzpZEUFTFend+FJtBkxBXCao1RvTXg8PBMkza +LUsaR4mLsGoXLIbNCoIinvVG0QULYCZe11N3l1L0G2g5uhEM4MfJ2rwrMD0o17i+ +nwNRRE3tfKAlWhYQg+4ye36kQVxASPniHjdQgjKYUFTNXdyG6DzuAclaVte9iVw6 +cWl61fB2CZya3+uMtih8t/Kgl2KbMO2PvNByfnDjKmW+v58qHbXyoJZqnpvDn14+ +p2Ox+AvvxYiEiUIvFdWy101QB7NJMCtdwq6oG6OvIOgXzLgitTFSq4kfWDfupQjW +iFoQ+vWmYhK5ld0nBaiz+JmHuemK7A== +-----END CERTIFICATE----- diff --git a/etcdserver/etcdhttp/testdata/otheruser.pem b/etcdserver/etcdhttp/testdata/otheruser.pem new file mode 100644 index 000000000..d0c74eb9f --- /dev/null +++ b/etcdserver/etcdhttp/testdata/otheruser.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDOTCCAiGgAwIBAgIINYpsso1f3SswDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE +AxMKZXRjZCB0ZXN0czAeFw0xNTExMjQwMzA4MDBaFw0xNjExMjMwMzA4MDBaMBQx +EjAQBgNVBAMTCW90aGVydXNlcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC +ggEBAPOAUa5GblwIjHTEnox2c/Am9jV1TMvzBuVXxnp2UnNHMNwstAooFrEs/Z+d +ft5AOsooP6zVuM3eBQa4i9huJbVNDfPU2H94yA89jYfJYUgo7C838V6NjGsCCptQ +WzkKPNlDbT9xA/7XpIUJ2WltuYDRrjWq8pXQONqTjcg5n4l0JO8xdHJHRUkFQ76F +1npXeLndgGaP11lqzpYlglEGi5URhzAT1xxQ0hLSe8WNmiCxxkq++C8Gx4sPg9mX +M94aoJDzZSnoaqDxckbP/7Q0ZKe/fVdCFkd5+jqT4Mt7hwmz9jTCHcVnAz4EKI+t +rbWgbCfMK6013GotXz7InStVe+MCAwEAAaOBjTCBijAOBgNVHQ8BAf8EBAMCBaAw +HQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYD +VR0OBBYEFFwMmf+pnaejmri6y1T+lfU+MBq/MB8GA1UdIwQYMBaAFJtQIYH3mhyE +OtsRmXMYZi4DvG7GMAsGA1UdEQQEMAKCADANBgkqhkiG9w0BAQsFAAOCAQEACOn6 +mec29MTMGPt/EPOmSyhvTKSwH+5YWjCbyUFeoB8puxrJlIphK4mvT+sXp2wzno89 +FVCliO/rJurdErKvyOjlK1QrVGPYIt7Wz9ssAfvlwCyBM8PqgEG8dJN9aAkf2h4r +Ye+hBh1y6Nnataf7lxe9mqAOvD/7wVIgzjCnMD1q5QSY2Mln3HwVQXtbZFbY363Z +X9Fk3PUpjJSX9jbEz9kIlT8AJAdxl6GB8Z9B8PrA8qf4Bhk15ICRHxb67EhDrGWV +8q7ArU2XBqs/+GWpUIMoGKNZv+K+/SksZK1KnzaUvApUCJzt+ac+p8HOgMdvDRgr +GfVVJqcZgyEmeczy0A== +-----END CERTIFICATE----- diff --git a/etcdserver/etcdhttp/testdata/user.pem b/etcdserver/etcdhttp/testdata/user.pem new file mode 100644 index 000000000..0fc210865 --- /dev/null +++ b/etcdserver/etcdhttp/testdata/user.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDNDCCAhygAwIBAgIIcQ0DAfgevocwDQYJKoZIhvcNAQELBQAwFTETMBEGA1UE +AxMKZXRjZCB0ZXN0czAeFw0xNTExMjQwMzA4MDBaFw0xNjExMjMwMzA4MDBaMA8x +DTALBgNVBAMTBHVzZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD0 ++3Lm1SmUJJLufaFTYz+e5qyQEshNRyeAhXIeZ1aw+yBjslXGZQ3/uGOwnOnGqUeA +Nidc9ty4NsK6RVppHlezUrBnpl4hws8vHWFKZpU2R6kKL8EYLmg+iVqEBj7XqfAp +8bJqqZI3KOqLXpRH55mA69KP7VEK9ngTVR/tERSrUPT8jcjwbvhSOqD8Qk07BUDR +6RpDr94Mnaf+fMGG36Sh7iUl+i4Oh6FFar+7+b0+5Bhs2/6uVsK4A1Z3jqqfSQH8 +q8Wf5h9Ka4aqGSw4ia5G3Uw7Jsl2aDgpJ7uwJo1k8SclbMYnYdhZuo+U+esY/Fai +YdbjG+AroZ+y9TB8bMlHAgMBAAGjgY0wgYowDgYDVR0PAQH/BAQDAgWgMB0GA1Ud +JQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQW +BBRuTt0lJIVKYaz76aSxl/MQOLRwfDAfBgNVHSMEGDAWgBSbUCGB95ochDrbEZlz +GGYuA7xuxjALBgNVHREEBDACggAwDQYJKoZIhvcNAQELBQADggEBABLRWZm+Lgjs +c5qDXbgOJW2pR630syY8ixR9c6HvzPVJim8mFioMX+xrlbOC6BmOUlOb9j83bTKn +aOg/0xlpxNbd8QYzgRxZmHZLULPdiNeeRvIzsrzrH88+inrmZhRXRVcHjdO6CG6t +hCdDdRiNU6GkF7dPna0xNcEOKe2wUfzd1ZtKOqzi1w+fKjSeMplZomeWgP4WRvkh +JJ/0ujlMMckgyTxRh8EEaJ35OnpXX7EdipoWhOMmiUnlPqye2icC8Y+CMdZsrod6 +nkoEQnXDCLf/Iv0qj7B9iKbxn7t3QDVxY4UILUReDuD8yrGULlGOl//aY/T3pkZ6 +R5trduZhI3o= +-----END CERTIFICATE-----