Skip to content
This repository has been archived by the owner on Jun 23, 2022. It is now read-only.

feat(security): start negotiation when a rpc connection is established #575

Merged
merged 21 commits into from
Aug 4, 2020

Conversation

levy5307
Copy link
Contributor

@levy5307 levy5307 commented Jul 30, 2020

When a rpc connection is established, if the configuration of open_auth is true, we should start negotiation by creating a negotiation instance for both server rpc_session and client rpc_session.
Especially for client rpc_session, we should change the connect state to SS_NEGOTIATION, which means we are doing security authentication.

 negotiation process:

                                                client                   server
                                                     |---   SASL_LIST_MECHANISMS    -->|
                                                     |<-- SASL_LIST_MECHANISMS_RESP ---|
                                                     |---  SASL_SELECT_MECHANISMS  --->|
                                                     |<-- SASL_SELECT_MECHANISMS_OK ---|
                                                     |                                 |
                                                     |------    SASL_INITIATE   ------>|
                                                     |                                 |
                                                     |<----     SASL_CHALLENGE    -----|
                                                     |-----      SASL_RESPONSE    ---->|
                                                     |                                 |
                                                     |              .....              |
                                                     |                                 |
                                                     |<----     SASL_CHALLENGE    -----|
                                                     |-----      SASL_RESPONSE    ---->|
                                                     |                                 |        (authentication will succeed
                                                     |                                 |          if all chanllenges passed)
                                                     | <---        SASL_SUCC      -----|
    (client won't response                           |                                 |
          if servers says ok)                        |                                 |
                                                     | ----         RPC_CALL      ---> |
                                                     | <---         RPC_RESP       ----|

New configuration added

[security]
+ enable_auth = false

src/runtime/security/negotiation.cpp Outdated Show resolved Hide resolved
src/runtime/rpc/network.cpp Outdated Show resolved Hide resolved
include/dsn/tool-api/network.h Outdated Show resolved Hide resolved
src/runtime/security/server_negotiation.cpp Outdated Show resolved Hide resolved
acelyc111
acelyc111 previously approved these changes Aug 3, 2020
@hycdong
Copy link
Contributor

hycdong commented Aug 4, 2020

Could you please explain the negotiation process with its function or structure to me? For example, when open_auth is true, should create negotiation with both client and server rpc session, client will turn its state to SS_NEGOTIATION, then start to negotiation by function start_negotiate. How about server rpc session, when will server call function start_negotiate?
Besides, is the SS_NEGOTIATION only used for client session?

@levy5307
Copy link
Contributor Author

levy5307 commented Aug 4, 2020

Could you please explain the negotiation process with its function or structure to me? For example, when open_auth is true, should create negotiation with both client and server rpc session, client will turn its state to SS_NEGOTIATION, then start to negotiation by function start_negotiate. How about server rpc session, when will server call function start_negotiate?
Besides, is the SS_NEGOTIATION only used for client session?

  1. Server need to call start_negotiation to create server_negotiation and change it's state to SASL_LIST_MECHANISMS.
  2. All states in session_state is only used by client, including session_state, to do some state judgement.
  3. Here is the negotiation process, And I will add it in the next pull request:
 negotiation process:

                                                client                                                                          server
                                                     |    ---        SASL_LIST_MECHANISMS         -->  |
                                                     |   <--  SASL_LIST_MECHANISMS_RESP   ---  |
                                                     |   ---       SASL_SELECT_MECHANISMS     --->|
                                                     |  <--   SASL_SELECT_MECHANISMS_OK ---  |
                                                     |                                                                                       |
                                                     |  -----------        SASL_INITIATE       ------------> |
                                                     |                                                                                       |
                                                     |  <----------     SASL_CHALLENGE   ------------- |
                                                     | ------------       SASL_RESPONSE    -----------> |
                                                     |                                                                                       |
                                                     |                                        .....                                         |
                                                     |                                                                                       |
                                                     |  <----------     SASL_CHALLENGE   ------------- |
                                                     | ------------       SASL_RESPONSE    -----------> |
                                                     |                                                                                       |        (authentication will succeed
                                                     |                                                                                       |           if all chanllenges passed)
                                                     | <-----------            SASL_SUCC      --------------- |
    (client won't response   |                                                                                       |
          if servers says ok)       |                                                                                       |
                                                     | ------------               RPC_CALL        -------------> |
                                                     | <----------                RPC_RESP        -------------- |

include/dsn/tool-api/network.h Outdated Show resolved Hide resolved
src/runtime/security/negotiation.h Outdated Show resolved Hide resolved
@hycdong hycdong merged commit d8f593b into XiaoMi:master Aug 4, 2020
@levy5307 levy5307 deleted the start_negotiation branch August 4, 2020 06:13
@levy5307 levy5307 added the type/config-change PR that made modification on configs, which should be noted in release note. label Oct 30, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
component/security type/config-change PR that made modification on configs, which should be noted in release note.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants