felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

cmd/strelaysrv: Add optional auth token (fixes #3987) (#8561)

Browse Source 
* implement authentication via token for relaysrv

Make replaysrv check for a token before allowing clients to
join. The token can be set via the replay-uri.

* fix formatting

* key composite literal

* do not error out if auth material is provided but not needed

* remove unused method receiver

* clean up unused parameter in functions

* cleaner token handling, disable joining the pool if token is set.

* Keep backwards compatibility with older clients.

In prior versions of the protocol JoinRelayRequest did not have a
token field. Trying to unmarshal such a request will result in
an error. Return an empty JoinRelayRequest, that is a request
without token, instead.

Co-authored-by: entity0xfe <entity0xfe@my.domain>
This commit is contained in:
entity0xfe
2022-10-01 20:41:02 +01:00
committed by GitHub
co-authored by entity0xfe
parent 0935886045
commit ad986f372d
6 changed files with 88 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/strelaysrv/listener.go
+12 -3
View File
@@ -23,7 +23,7 @@ var (
numConnections int64
)
func listener(_, addr string, config *tls.Config) {
func listener(_, addr string, config *tls.Config, token string) {
tcpListener, err := net.Listen("tcp", addr)
if err != nil {
log.Fatalln(err)
@@ -49,7 +49,7 @@ func listener(_, addr string, config *tls.Config) {
}
if isTLS {
go protocolConnectionHandler(conn, config)
go protocolConnectionHandler(conn, config, token)
} else {
go sessionConnectionHandler(conn)
}
@@ -57,7 +57,7 @@ func listener(_, addr string, config *tls.Config) {
}
}
func protocolConnectionHandler(tcpConn net.Conn, config *tls.Config) {
func protocolConnectionHandler(tcpConn net.Conn, config *tls.Config, token string) {
conn := tls.Server(tcpConn, config)
if err := conn.SetDeadline(time.Now().Add(messageTimeout)); err != nil {
if debug {
@@ -119,6 +119,15 @@ func protocolConnectionHandler(tcpConn net.Conn, config *tls.Config) {
switch msg := message.(type) {
case protocol.JoinRelayRequest:
if token != "" && msg.Token != token {
if debug {
log.Printf("invalid token %s\n", msg.Token)
}
protocol.WriteMessage(conn, protocol.ResponseWrongToken)
conn.Close()
continue
}
if atomic.LoadInt32(&overLimit) > 0 {
protocol.WriteMessage(conn, protocol.RelayFull{})
if debug {
cmd/strelaysrv/main.go
+7 -1
View File
@@ -56,6 +56,7 @@ var (
networkBufferSize int
statusAddr string
token string
poolAddrs string
pools []string
providedBy string
@@ -89,6 +90,7 @@ func main() {
flag.IntVar(&globalLimitBps, "global-rate", globalLimitBps, "Global rate limit, in bytes/s")
flag.BoolVar(&debug, "debug", debug, "Enable debug output")
flag.StringVar(&statusAddr, "status-srv", ":22070", "Listen address for status service (blank to disable)")
flag.StringVar(&token, "token", "", "Token to restrict access to the relay (optional). Disables joining any pools.")
flag.StringVar(&poolAddrs, "pools", defaultPoolAddrs, "Comma separated list of relay pool addresses to join")
flag.StringVar(&providedBy, "provided-by", "", "An optional description about who provides the relay")
flag.StringVar(&extAddress, "ext-address", "", "An optional address to advertise as being available on.\n\tAllows listening on an unprivileged port with port forwarding from e.g. 443, and be connected to on port 443.")
@@ -256,6 +258,10 @@ func main() {
log.Println("URI:", uri.String())
if token != "" {
poolAddrs = ""
}
if poolAddrs == defaultPoolAddrs {
log.Println("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
log.Println("!! Joining default relay pools, this relay will be available for public use. !!")
@@ -271,7 +277,7 @@ func main() {
}
}
go listener(proto, listen, tlsCfg)
go listener(proto, listen, tlsCfg, token)
sigs := make(chan os.Signal, 1)
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)