From 0ad9260186664a58614247e969d44855a7144822 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Fri, 2 Nov 2018 22:20:38 +0800 Subject: [PATCH 1/4] scheduler add ssl support --- cmd/scheduler/app/server.go | 8 +++++++- cmd/scheduler/options/options.go | 4 ++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/cmd/scheduler/app/server.go b/cmd/scheduler/app/server.go index 7a3ff45fc2..e9edb3d6c6 100644 --- a/cmd/scheduler/app/server.go +++ b/cmd/scheduler/app/server.go @@ -86,7 +86,13 @@ func startHTTP(s *SchedulerServer) error { } log.Infof("Start server on: %s:%d", s.Address, s.Port) - return server.ListenAndServe() + + if o.GetOptions().EnableSsl { + return server.ListenAndServeTLS(o.GetOptions().SslCertfile, + o.GetOptions().SslKeyfile) + } else { + return server.ListenAndServe() + } } func Execute() error { diff --git a/cmd/scheduler/options/options.go b/cmd/scheduler/options/options.go index 1eb42aa94e..6c243fc291 100644 --- a/cmd/scheduler/options/options.go +++ b/cmd/scheduler/options/options.go @@ -104,6 +104,10 @@ type Options struct { AdminPasswd string `help:"Admin password" default:"eBVVSNaMeyzDnD8F" alias:"admin-password"` AdminTenant string `help:"Admin tenant" default:"system" alias:"admin-tenant-name"` + EnableSsl bool `help:"Enable https"` + SslCertfile string `help:"ssl certification file"` + SslKeyfile string `help:"ssl certification key file"` + // scheduler options SchedulerOptions } From 5a6b4832ea90e2dee3aae70a68cc13d3cd9eaf99 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 3 Nov 2018 00:42:33 +0800 Subject: [PATCH 2/4] make webconsole ssl capable --- pkg/webconsole/service/service.go | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go index d5fbccae24..d86ef761c4 100644 --- a/pkg/webconsole/service/service.go +++ b/pkg/webconsole/service/service.go @@ -2,7 +2,6 @@ package service import ( "net" - "net/http" "net/url" "os" "strconv" @@ -11,6 +10,7 @@ import ( "yunion.io/x/log" + "net/http" "yunion.io/x/onecloud/pkg/cloudcommon" "yunion.io/x/onecloud/pkg/webconsole" o "yunion.io/x/onecloud/pkg/webconsole/options" @@ -62,8 +62,18 @@ func start() { addr := net.JoinHostPort(o.Options.Address, strconv.Itoa(o.Options.Port)) log.Infof("Start listen on %s", addr) - err := http.ListenAndServe(addr, root) - if err != nil { - log.Fatalf("%v", err) + if o.Options.EnableSsl { + err := http.ListenAndServeTLS(addr, + o.Options.SslCertfile, + o.Options.SslKeyfile, + root) + if err != nil && err != http.ErrServerClosed { + log.Fatalf("%v", err) + } + } else { + err := http.ListenAndServe(addr, root) + if err != nil { + log.Fatalf("%v", err) + } } } From 732243efba68651a4da9c3af32ffc48db24fdeab Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 3 Nov 2018 10:01:06 +0800 Subject: [PATCH 3/4] make reverse proxy insecure ssl (for influxdb) --- pkg/proxy/http.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/proxy/http.go b/pkg/proxy/http.go index a7157d4581..4b27030e0d 100644 --- a/pkg/proxy/http.go +++ b/pkg/proxy/http.go @@ -9,6 +9,7 @@ import ( "yunion.io/x/log" "yunion.io/x/onecloud/pkg/httperrors" + "crypto/tls" ) type EndpointGenerator func(context.Context, http.ResponseWriter, *http.Request) (string, error) @@ -48,6 +49,9 @@ func (p *SReverseProxy) ServeHTTP(ctx context.Context, w http.ResponseWriter, r } log.Debugf("Forwarding to servie: %q, url: %q", p.serviceName, remoteUrl.String()) proxy := httputil.NewSingleHostReverseProxy(remoteUrl) + proxy.Transport = &http.Transport{ + TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, + } r.Header.Del("Cookie") r.Header.Del("X-Auth-Token") proxy.ServeHTTP(w, r) From 7e463a4644fc774061305fcacfc82f3722947ce4 Mon Sep 17 00:00:00 2001 From: Qiu Jian Date: Sat, 3 Nov 2018 10:21:19 +0800 Subject: [PATCH 4/4] hack: scheduler ping/version escape auth --- pkg/proxy/http.go | 2 +- pkg/util/gin/middleware/keystone_auth.go | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/pkg/proxy/http.go b/pkg/proxy/http.go index 4b27030e0d..4d23731a0d 100644 --- a/pkg/proxy/http.go +++ b/pkg/proxy/http.go @@ -2,6 +2,7 @@ package proxy import ( "context" + "crypto/tls" "fmt" "net/http" "net/http/httputil" @@ -9,7 +10,6 @@ import ( "yunion.io/x/log" "yunion.io/x/onecloud/pkg/httperrors" - "crypto/tls" ) type EndpointGenerator func(context.Context, http.ResponseWriter, *http.Request) (string, error) diff --git a/pkg/util/gin/middleware/keystone_auth.go b/pkg/util/gin/middleware/keystone_auth.go index 53cf65db9d..39067df06d 100644 --- a/pkg/util/gin/middleware/keystone_auth.go +++ b/pkg/util/gin/middleware/keystone_auth.go @@ -3,6 +3,7 @@ package middleware import ( "fmt" "net/http" + "strings" "gopkg.in/gin-gonic/gin.v1" @@ -15,6 +16,15 @@ const ( func KeystoneTokenVerifyMiddleware() gin.HandlerFunc { return func(c *gin.Context) { + // hack + escapeAuth := []string{"ping", "version", "metrics"} + for _, s := range escapeAuth { + if strings.HasSuffix(c.Request.URL.Path, s) { + c.Next() + return + } + } + token := c.Request.Header.Get(XAuthTokenKey) if len(token) == 0 { c.AbortWithError(http.StatusBadRequest, fmt.Errorf("Not found %s in http header.", XAuthTokenKey))