kelvin/warewulf
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Initial commit of asset key tag security check

Browse Source
This commit is contained in:
Gregory Kurtzer
2022-01-24 00:32:02 +00:00
parent b038a8817b
commit d9c13c3f36
21 changed files with 320 additions and 212 deletions
Download Patch File Download Diff File Expand all files Collapse all files

76
internal/pkg/warewulfd/runtime.go
View File

@@ -2,16 +2,35 @@ package warewulfd
import (
"net/http"
"strconv"
"strings"
"github.com/hpcng/warewulf/internal/pkg/node"
nodepkg "github.com/hpcng/warewulf/internal/pkg/node"
"github.com/hpcng/warewulf/internal/pkg/overlay"
"github.com/hpcng/warewulf/internal/pkg/util"
"github.com/hpcng/warewulf/internal/pkg/warewulfconf"
)
func RuntimeOverlaySend(w http.ResponseWriter, req *http.Request) {
rinfo, err := parseReq(req)
if err != nil {
w.WriteHeader(404)
daemonLogf("ERROR: %s\n", err)
return
}
node, err := GetNode(rinfo.hwaddr)
if err != nil {
w.WriteHeader(403)
daemonLogf("ERROR(%s): %s\n", rinfo.hwaddr, err)
return
}
if node.AssetKey.Defined() && node.AssetKey.Get() != rinfo.assetkey {
w.WriteHeader(404)
daemonLogf("ERROR: Incorrect asset key for node: %s\n", node.Id.Get())
updateStatus(node.Id.Get(), "RUNTIME_OVERLAY", "BAD_ASSET", rinfo.ipaddr)
return
}
conf, err := warewulfconf.New()
if err != nil {
daemonLogf("ERROR: Could not read Warewulf configuration file: %s\n", err)
@@ -19,68 +38,33 @@ func RuntimeOverlaySend(w http.ResponseWriter, req *http.Request) {
return
}
nodes, err := node.New()
if err != nil {
daemonLogf("ERROR: Could not read node configuration file: %s\n", err)
w.WriteHeader(503)
return
}
remote := strings.Split(req.RemoteAddr, ":")
port, err := strconv.Atoi(remote[1])
if err != nil {
daemonLogf("ERROR: Could not convert port to integer: %s\n", remote[1])
w.WriteHeader(503)
return
}
if err != nil {
daemonLogf("ERROR: Could not load configuration file: %s\n", err)
return
}
if conf.Warewulf.Secure {
if port >= 1024 {
if rinfo.remoteport >= 1024 {
daemonLogf("DENIED: Connection coming from non-privledged port: %s\n", req.RemoteAddr)
w.WriteHeader(401)
return
}
}
n, err := nodes.FindByIpaddr(remote[0])
if err != nil {
daemonLogf("WARNING: Could not find node by IP address: %s\n", remote[0])
w.WriteHeader(404)
return
}
if !n.Id.Defined() {
daemonLogf("REQ: %15s: %s (unknown/unconfigured node)\n", n.Id.Get(), req.URL.Path)
w.WriteHeader(404)
return
} else {
daemonLogf("REQ: %15s: %s\n", n.Id.Get(), req.URL.Path)
}
if n.RuntimeOverlay.Defined() {
fileName := overlay.OverlayImage(n.Id.Get(), n.RuntimeOverlay.Get())
if node.RuntimeOverlay.Defined() {
fileName := overlay.OverlayImage(node.Id.Get(), node.RuntimeOverlay.Get())
if conf.Warewulf.AutobuildOverlays {
if !util.IsFile(fileName) || util.PathIsNewer(fileName, node.ConfigFile) || util.PathIsNewer(fileName, overlay.OverlaySourceDir(n.RuntimeOverlay.Get())) {
daemonLogf("BUILD: %15s: Runtime Overlay\n", n.Id.Get())
_ = overlay.BuildOverlay(n, n.RuntimeOverlay.Get())
if !util.IsFile(fileName) || util.PathIsNewer(fileName, nodepkg.ConfigFile) || util.PathIsNewer(fileName, overlay.OverlaySourceDir(node.RuntimeOverlay.Get())) {
daemonLogf("BUILD: %15s: Runtime Overlay\n", node.Id.Get())
_ = overlay.BuildOverlay(node, node.RuntimeOverlay.Get())
}
}
err := sendFile(w, fileName, n.Id.Get())
err := sendFile(w, fileName, node.Id.Get())
if err != nil {
daemonLogf("ERROR: %s\n", err)
}
updateStatus(n.Id.Get(), "RUNTIME_OVERLAY", n.RuntimeOverlay.Get()+".img", strings.Split(req.RemoteAddr, ":")[0])
updateStatus(node.Id.Get(), "RUNTIME_OVERLAY", node.RuntimeOverlay.Get()+".img", strings.Split(req.RemoteAddr, ":")[0])
} else {
w.WriteHeader(503)
daemonLogf("WARNING: No 'runtime system-overlay' set for node %s\n", n.Id.Get())
daemonLogf("WARNING: No 'runtime overlay' set for node %s\n", node.Id.Get())
}
}