|
@@ -17,13 +17,13 @@ package security
|
|
|
import (
|
|
import (
|
|
|
"encoding/json"
|
|
"encoding/json"
|
|
|
"fmt"
|
|
"fmt"
|
|
|
- "log"
|
|
|
|
|
"path"
|
|
"path"
|
|
|
"reflect"
|
|
"reflect"
|
|
|
"sort"
|
|
"sort"
|
|
|
"strings"
|
|
"strings"
|
|
|
"time"
|
|
"time"
|
|
|
|
|
|
|
|
|
|
+ "github.com/coreos/etcd/Godeps/_workspace/src/github.com/coreos/pkg/capnslog"
|
|
|
"github.com/coreos/etcd/Godeps/_workspace/src/golang.org/x/crypto/bcrypt"
|
|
"github.com/coreos/etcd/Godeps/_workspace/src/golang.org/x/crypto/bcrypt"
|
|
|
"github.com/coreos/etcd/Godeps/_workspace/src/golang.org/x/net/context"
|
|
"github.com/coreos/etcd/Godeps/_workspace/src/golang.org/x/net/context"
|
|
|
etcderr "github.com/coreos/etcd/error"
|
|
etcderr "github.com/coreos/etcd/error"
|
|
@@ -43,6 +43,10 @@ const (
|
|
|
GuestRoleName = "guest"
|
|
GuestRoleName = "guest"
|
|
|
)
|
|
)
|
|
|
|
|
|
|
|
|
|
+var (
|
|
|
|
|
+ plog = capnslog.NewPackageLogger("github.com/coreos/etcd/etcdserver", "security")
|
|
|
|
|
+)
|
|
|
|
|
+
|
|
|
var rootRole = Role{
|
|
var rootRole = Role{
|
|
|
Role: RootRoleName,
|
|
Role: RootRoleName,
|
|
|
Permissions: Permissions{
|
|
Permissions: Permissions{
|
|
@@ -186,7 +190,7 @@ func (s *Store) CreateOrUpdateUser(user User) (out User, created bool, err error
|
|
|
func (s *Store) CreateUser(user User) (User, error) {
|
|
func (s *Store) CreateUser(user User) (User, error) {
|
|
|
u, err := s.createUserInternal(user)
|
|
u, err := s.createUserInternal(user)
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: created user %s", user.User)
|
|
|
|
|
|
|
+ plog.Noticef("created user %s", user.User)
|
|
|
}
|
|
}
|
|
|
return u, err
|
|
return u, err
|
|
|
}
|
|
}
|
|
@@ -225,7 +229,7 @@ func (s *Store) DeleteUser(name string) error {
|
|
|
}
|
|
}
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
|
- log.Printf("security: deleted user %s", name)
|
|
|
|
|
|
|
+ plog.Noticef("deleted user %s", name)
|
|
|
return nil
|
|
return nil
|
|
|
}
|
|
}
|
|
|
|
|
|
|
@@ -251,7 +255,7 @@ func (s *Store) UpdateUser(user User) (User, error) {
|
|
|
}
|
|
}
|
|
|
_, err = s.updateResource("/users/"+user.User, newUser)
|
|
_, err = s.updateResource("/users/"+user.User, newUser)
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: updated user %s", user.User)
|
|
|
|
|
|
|
+ plog.Noticef("updated user %s", user.User)
|
|
|
}
|
|
}
|
|
|
return newUser, err
|
|
return newUser, err
|
|
|
}
|
|
}
|
|
@@ -320,7 +324,7 @@ func (s *Store) CreateRole(role Role) error {
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: created new role %s", role.Role)
|
|
|
|
|
|
|
+ plog.Noticef("created new role %s", role.Role)
|
|
|
}
|
|
}
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
@@ -338,7 +342,7 @@ func (s *Store) DeleteRole(name string) error {
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: deleted role %s", name)
|
|
|
|
|
|
|
+ plog.Noticef("deleted role %s", name)
|
|
|
}
|
|
}
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
@@ -365,7 +369,7 @@ func (s *Store) UpdateRole(role Role) (Role, error) {
|
|
|
}
|
|
}
|
|
|
_, err = s.updateResource("/roles/"+role.Role, newRole)
|
|
_, err = s.updateResource("/roles/"+role.Role, newRole)
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: updated role %s", role.Role)
|
|
|
|
|
|
|
+ plog.Noticef("updated role %s", role.Role)
|
|
|
}
|
|
}
|
|
|
return newRole, err
|
|
return newRole, err
|
|
|
}
|
|
}
|
|
@@ -384,18 +388,18 @@ func (s *Store) EnableSecurity() error {
|
|
|
}
|
|
}
|
|
|
_, err = s.GetRole(GuestRoleName)
|
|
_, err = s.GetRole(GuestRoleName)
|
|
|
if err != nil {
|
|
if err != nil {
|
|
|
- log.Printf("security: no guest role access found, creating default")
|
|
|
|
|
|
|
+ plog.Printf("no guest role access found, creating default")
|
|
|
err := s.CreateRole(guestRole)
|
|
err := s.CreateRole(guestRole)
|
|
|
if err != nil {
|
|
if err != nil {
|
|
|
- log.Printf("security: error creating guest role. aborting security enable.")
|
|
|
|
|
|
|
+ plog.Errorf("error creating guest role. aborting security enable.")
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
err = s.enableSecurity()
|
|
err = s.enableSecurity()
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: enabled security")
|
|
|
|
|
|
|
+ plog.Noticef("security: enabled security")
|
|
|
} else {
|
|
} else {
|
|
|
- log.Printf("error enabling security: %v", err)
|
|
|
|
|
|
|
+ plog.Errorf("error enabling security (%v)", err)
|
|
|
}
|
|
}
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
@@ -406,9 +410,9 @@ func (s *Store) DisableSecurity() error {
|
|
|
}
|
|
}
|
|
|
err := s.disableSecurity()
|
|
err := s.disableSecurity()
|
|
|
if err == nil {
|
|
if err == nil {
|
|
|
- log.Printf("security: disabled security")
|
|
|
|
|
|
|
+ plog.Noticef("security: disabled security")
|
|
|
} else {
|
|
} else {
|
|
|
- log.Printf("error disabling security: %v", err)
|
|
|
|
|
|
|
+ plog.Errorf("error disabling security (%v)", err)
|
|
|
}
|
|
}
|
|
|
return err
|
|
return err
|
|
|
}
|
|
}
|
|
@@ -435,14 +439,14 @@ func (u User) Merge(n User) (User, error) {
|
|
|
currentRoles := types.NewUnsafeSet(u.Roles...)
|
|
currentRoles := types.NewUnsafeSet(u.Roles...)
|
|
|
for _, g := range n.Grant {
|
|
for _, g := range n.Grant {
|
|
|
if currentRoles.Contains(g) {
|
|
if currentRoles.Contains(g) {
|
|
|
- log.Printf("Granting duplicate role %s for user %s", g, n.User)
|
|
|
|
|
|
|
+ plog.Noticef("granting duplicate role %s for user %s", g, n.User)
|
|
|
continue
|
|
continue
|
|
|
}
|
|
}
|
|
|
currentRoles.Add(g)
|
|
currentRoles.Add(g)
|
|
|
}
|
|
}
|
|
|
for _, r := range n.Revoke {
|
|
for _, r := range n.Revoke {
|
|
|
if !currentRoles.Contains(r) {
|
|
if !currentRoles.Contains(r) {
|
|
|
- log.Printf("Revoking ungranted role %s for user %s", r, n.User)
|
|
|
|
|
|
|
+ plog.Noticef("revoking ungranted role %s for user %s", r, n.User)
|
|
|
continue
|
|
continue
|
|
|
}
|
|
}
|
|
|
currentRoles.Remove(r)
|
|
currentRoles.Remove(r)
|
|
@@ -544,7 +548,7 @@ func (rw rwPermission) Revoke(n rwPermission) (rwPermission, error) {
|
|
|
currentRead := types.NewUnsafeSet(rw.Read...)
|
|
currentRead := types.NewUnsafeSet(rw.Read...)
|
|
|
for _, r := range n.Read {
|
|
for _, r := range n.Read {
|
|
|
if !currentRead.Contains(r) {
|
|
if !currentRead.Contains(r) {
|
|
|
- log.Printf("Revoking ungranted read permission %s", r)
|
|
|
|
|
|
|
+ plog.Noticef("revoking ungranted read permission %s", r)
|
|
|
continue
|
|
continue
|
|
|
}
|
|
}
|
|
|
currentRead.Remove(r)
|
|
currentRead.Remove(r)
|
|
@@ -552,7 +556,7 @@ func (rw rwPermission) Revoke(n rwPermission) (rwPermission, error) {
|
|
|
currentWrite := types.NewUnsafeSet(rw.Write...)
|
|
currentWrite := types.NewUnsafeSet(rw.Write...)
|
|
|
for _, w := range n.Write {
|
|
for _, w := range n.Write {
|
|
|
if !currentWrite.Contains(w) {
|
|
if !currentWrite.Contains(w) {
|
|
|
- log.Printf("Revoking ungranted write permission %s", w)
|
|
|
|
|
|
|
+ plog.Noticef("revoking ungranted write permission %s", w)
|
|
|
continue
|
|
continue
|
|
|
}
|
|
}
|
|
|
currentWrite.Remove(w)
|
|
currentWrite.Remove(w)
|