Add rpc layer authentication.

cmd/storage-rpc-server.go

@@ -17,10 +17,13 @@
 package main
 
 import (
+	"errors"
+	"fmt"
 	"net/rpc"
 	"path"
 	"strings"
 
+	jwtgo "github.com/dgrijalva/jwt-go"
 	router "github.com/gorilla/mux"
 )
 
@@ -31,15 +34,62 @@ type storageServer struct {
 	path    string
 }
 
+// Validates if incoming token is valid.
+func isRPCTokenValid(tokenStr string) bool {
+	jwt, err := newJWT(defaultWebTokenExpiry) // Expiry set to 24Hrs.
+	if err != nil {
+		errorIf(err, "Unable to initialize JWT")
+		return false
+	}
+	token, err := jwtgo.Parse(tokenStr, func(token *jwtgo.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwtgo.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("Unexpected signing method: %v", token.Header["alg"])
+		}
+		return []byte(jwt.SecretAccessKey), nil
+	})
+	if err != nil {
+		errorIf(err, "Unable to parse JWT token string")
+		return false
+	}
+	// Return if token is valid.
+	return token.Valid
+}
+
+/// Auth operations
+
+// Login - login handler.
+func (s *storageServer) LoginHandler(args *RPCLoginArgs, reply *RPCLoginReply) error {
+	jwt, err := newJWT(defaultTokenExpiry)
+	if err != nil {
+		return err
+	}
+	if err = jwt.Authenticate(args.Username, args.Password); err != nil {
+		return err
+	}
+	token, err := jwt.GenerateToken(args.Username)
+	if err != nil {
+		return err
+	}
+	reply.Token = token
+	reply.ServerVersion = minioVersion
+	return nil
+}
+
 /// Volume operations handlers
 
 // MakeVolHandler - make vol handler is rpc wrapper for MakeVol operation.
-func (s *storageServer) MakeVolHandler(arg *string, reply *GenericReply) error {
-	return s.storage.MakeVol(*arg)
+func (s *storageServer) MakeVolHandler(args *GenericVolArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	return s.storage.MakeVol(args.Vol)
 }
 
 // ListVolsHandler - list vols handler is rpc wrapper for ListVols operation.
-func (s *storageServer) ListVolsHandler(arg *string, reply *ListVolsReply) error {
+func (s *storageServer) ListVolsHandler(token *string, reply *ListVolsReply) error {
+	if !isRPCTokenValid(*token) {
+		return errors.New("Invalid token")
+	}
 	vols, err := s.storage.ListVols()
 	if err != nil {
 		return err
@@ -49,8 +99,11 @@ func (s *storageServer) ListVolsHandler(arg *string, reply *ListVolsReply) error
 }
 
 // StatVolHandler - stat vol handler is a rpc wrapper for StatVol operation.
-func (s *storageServer) StatVolHandler(arg *string, reply *VolInfo) error {
-	volInfo, err := s.storage.StatVol(*arg)
+func (s *storageServer) StatVolHandler(args *GenericVolArgs, reply *VolInfo) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	volInfo, err := s.storage.StatVol(args.Vol)
 	if err != nil {
 		return err
 	}
@@ -60,15 +113,21 @@ func (s *storageServer) StatVolHandler(arg *string, reply *VolInfo) error {
 
 // DeleteVolHandler - delete vol handler is a rpc wrapper for
 // DeleteVol operation.
-func (s *storageServer) DeleteVolHandler(arg *string, reply *GenericReply) error {
-	return s.storage.DeleteVol(*arg)
+func (s *storageServer) DeleteVolHandler(args *GenericVolArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	return s.storage.DeleteVol(args.Vol)
 }
 
 /// File operations
 
 // StatFileHandler - stat file handler is rpc wrapper to stat file.
-func (s *storageServer) StatFileHandler(arg *StatFileArgs, reply *FileInfo) error {
-	fileInfo, err := s.storage.StatFile(arg.Vol, arg.Path)
+func (s *storageServer) StatFileHandler(args *StatFileArgs, reply *FileInfo) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	fileInfo, err := s.storage.StatFile(args.Vol, args.Path)
 	if err != nil {
 		return err
 	}
@@ -77,8 +136,11 @@ func (s *storageServer) StatFileHandler(arg *StatFileArgs, reply *FileInfo) erro
 }
 
 // ListDirHandler - list directory handler is rpc wrapper to list dir.
-func (s *storageServer) ListDirHandler(arg *ListDirArgs, reply *[]string) error {
-	entries, err := s.storage.ListDir(arg.Vol, arg.Path)
+func (s *storageServer) ListDirHandler(args *ListDirArgs, reply *[]string) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	entries, err := s.storage.ListDir(args.Vol, args.Path)
 	if err != nil {
 		return err
 	}
@@ -87,8 +149,11 @@ func (s *storageServer) ListDirHandler(arg *ListDirArgs, reply *[]string) error
 }
 
 // ReadAllHandler - read all handler is rpc wrapper to read all storage API.
-func (s *storageServer) ReadAllHandler(arg *ReadFileArgs, reply *[]byte) error {
-	buf, err := s.storage.ReadAll(arg.Vol, arg.Path)
+func (s *storageServer) ReadAllHandler(args *ReadFileArgs, reply *[]byte) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	buf, err := s.storage.ReadAll(args.Vol, args.Path)
 	if err != nil {
 		return err
 	}
@@ -97,8 +162,11 @@ func (s *storageServer) ReadAllHandler(arg *ReadFileArgs, reply *[]byte) error {
 }
 
 // ReadFileHandler - read file handler is rpc wrapper to read file.
-func (s *storageServer) ReadFileHandler(arg *ReadFileArgs, reply *int64) error {
-	n, err := s.storage.ReadFile(arg.Vol, arg.Path, arg.Offset, arg.Buffer)
+func (s *storageServer) ReadFileHandler(args *ReadFileArgs, reply *int64) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	n, err := s.storage.ReadFile(args.Vol, args.Path, args.Offset, args.Buffer)
 	if err != nil {
 		return err
 	}
@@ -107,18 +175,27 @@ func (s *storageServer) ReadFileHandler(arg *ReadFileArgs, reply *int64) error {
 }
 
 // AppendFileHandler - append file handler is rpc wrapper to append file.
-func (s *storageServer) AppendFileHandler(arg *AppendFileArgs, reply *GenericReply) error {
-	return s.storage.AppendFile(arg.Vol, arg.Path, arg.Buffer)
+func (s *storageServer) AppendFileHandler(args *AppendFileArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	return s.storage.AppendFile(args.Vol, args.Path, args.Buffer)
 }
 
 // DeleteFileHandler - delete file handler is rpc wrapper to delete file.
-func (s *storageServer) DeleteFileHandler(arg *DeleteFileArgs, reply *GenericReply) error {
-	return s.storage.DeleteFile(arg.Vol, arg.Path)
+func (s *storageServer) DeleteFileHandler(args *DeleteFileArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	return s.storage.DeleteFile(args.Vol, args.Path)
 }
 
 // RenameFileHandler - rename file handler is rpc wrapper to rename file.
-func (s *storageServer) RenameFileHandler(arg *RenameFileArgs, reply *GenericReply) error {
-	return s.storage.RenameFile(arg.SrcVol, arg.SrcPath, arg.DstVol, arg.DstPath)
+func (s *storageServer) RenameFileHandler(args *RenameFileArgs, reply *GenericReply) error {
+	if !isRPCTokenValid(args.Token) {
+		return errors.New("Invalid token")
+	}
+	return s.storage.RenameFile(args.SrcVol, args.SrcPath, args.DstVol, args.DstPath)
 }
 
 // Initialize new storage rpc.