[ARVADOS] created: 7c8bfeb8d19db4f27b5fb5fd78e0afa3b7d07a89

[git at public.curoverse.com]

        at  7c8bfeb8d19db4f27b5fb5fd78e0afa3b7d07a89 (commit)


commit 7c8bfeb8d19db4f27b5fb5fd78e0afa3b7d07a89
Author: Tim Pierce <twp at curoverse.com>
Date:   Mon May 5 17:31:47 2014 -0400

    Add --permissions-key flag.
    
    The --permissions-key flag initializes the PermissionSecret to the
    string of bytes in its argument. (refs #2328)

diff --git a/services/keep/src/keep/keep.go b/services/keep/src/keep/keep.go
index e621955..d98965c 100644
--- a/services/keep/src/keep/keep.go
+++ b/services/keep/src/keep/keep.go
@@ -49,13 +49,15 @@ type KeepError struct {
 }
 
 var (
-	CollisionError = &KeepError{400, "Collision"}
-	MD5Error       = &KeepError{401, "MD5 Failure"}
-	CorruptError   = &KeepError{402, "Corruption"}
-	NotFoundError  = &KeepError{404, "Not Found"}
-	GenericError   = &KeepError{500, "Fail"}
-	FullError      = &KeepError{503, "Full"}
-	TooLongError   = &KeepError{504, "Too Long"}
+	CollisionError  = &KeepError{400, "Collision"}
+	MD5Error        = &KeepError{401, "MD5 Failure"}
+	PermissionError = &KeepError{401, "Permission denied"}
+	CorruptError    = &KeepError{402, "Corruption"}
+	ExpiredError    = &KeepError{403, "Expired permission signature"}
+	NotFoundError   = &KeepError{404, "Not Found"}
+	GenericError    = &KeepError{500, "Fail"}
+	FullError       = &KeepError{503, "Full"}
+	TooLongError    = &KeepError{504, "Too Long"}
 )
 
 func (e *KeepError) Error() string {
@@ -86,14 +88,28 @@ func main() {
 	//    by looking at currently mounted filesystems for /keep top-level
 	//    directories.
 
-	var listen, volumearg string
+	var listen, permission_key, volumearg string
 	var serialize_io bool
-	flag.StringVar(&listen, "listen", DEFAULT_ADDR,
+	flag.StringVar(
+		&listen,
+		"listen",
+		DEFAULT_ADDR,
 		"interface on which to listen for requests, in the format ipaddr:port. e.g. -listen=10.0.1.24:8000. Use -listen=:port to listen on all network interfaces.")
-	flag.StringVar(&volumearg, "volumes", "",
-		"Comma-separated list of directories to use for Keep volumes, e.g. -volumes=/var/keep1,/var/keep2. If empty or not supplied, Keep will scan mounted filesystems for volumes with a /keep top-level directory.")
-	flag.BoolVar(&serialize_io, "serialize", false,
+	flag.StringVar(
+		&permission_key,
+		"permission-key",
+		"",
+		"Secret key to use for generating and verifying permission signatures.")
+	flag.BoolVar(
+		&serialize_io,
+		"serialize",
+		false,
 		"If set, all read and write operations on local Keep volumes will be serialized.")
+	flag.StringVar(
+		&volumearg,
+		"volumes",
+		"",
+		"Comma-separated list of directories to use for Keep volumes, e.g. -volumes=/var/keep1,/var/keep2. If empty or not supplied, Keep will scan mounted filesystems for volumes with a /keep top-level directory.")
 	flag.Parse()
 
 	// Look for local keep volumes.
@@ -123,6 +139,11 @@ func main() {
 		log.Fatal("could not find any keep volumes")
 	}
 
+	// Initialize permission key.
+	if permission_key != "" {
+		PermissionSecret = []byte(permission_key)
+	}
+
 	// Start a round-robin VolumeManager with the volumes we have found.
 	KeepVM = MakeRRVolumeManager(goodvols)
 
@@ -179,6 +200,13 @@ func FindKeepVolumes() []string {
 func GetBlockHandler(w http.ResponseWriter, req *http.Request) {
 	hash := mux.Vars(req)["hash"]
 
+	// Find an API token, if present.
+	var api_token string
+	if auth, ok := req.Header["Authorization"]; ok {
+		if strings.StartsWith(auth[0], "OAuth ") {
+			api_token = auth[0][6:]
+		}
+	}
 	block, err := GetBlock(hash)
 	if err != nil {
 		http.Error(w, err.Error(), 404)
@@ -314,6 +342,13 @@ func GetVolumeStatus(volume string) *VolumeStatus {
 }
 
 func GetBlock(hash string) ([]byte, error) {
+	// Check the permission signature of this request if necessary.
+	if PermissionSecret != nil {
+		if !VerifySignature(hash) {
+			return nil, PermissionError
+		}
+	}
+
 	// Attempt to read the requested hash from a keep volume.
 	for _, vol := range KeepVM.Volumes() {
 		if buf, err := vol.Get(hash); err != nil {
diff --git a/services/keep/src/keep/keep_test.go b/services/keep/src/keep/keep_test.go
index 30d103d..cfbb62e 100644
--- a/services/keep/src/keep/keep_test.go
+++ b/services/keep/src/keep/keep_test.go
@@ -104,6 +104,20 @@ func TestGetBlockCorrupt(t *testing.T) {
 	}
 }
 
+/*
+// TestGetBlockPermissionOK
+//     When enforce_permissions is set, GetBlock correctly
+//     handles a request with a valid permission signature.
+func TestGetBlockPermissionOK(t *testing.T) {
+	defer teardown()
+
+	enforce_permissions = true
+	PermissionSecret =
+	// Create two test Keep volumes and store a block.
+
+}
+*/
+
 // ========================================
 // PutBlock tests
 // ========================================
@@ -412,5 +426,6 @@ func MakeTestVolumeManager(num_volumes int) VolumeManager {
 //     Cleanup to perform after each test.
 //
 func teardown() {
+	PermissionSecret = nil
 	KeepVM = nil
 }

-----------------------------------------------------------------------


hooks/post-receive
--