From: Remi Gacogne Date: Wed, 25 Jan 2023 15:29:51 +0000 (+0100) Subject: dnsdist: Add an option for unauthenticated access to the dashboard X-Git-Tag: dnsdist-1.8.0-rc1~79^2~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4bbed5cff48017a2328f6823c0fec5587774d1e8;p=thirdparty%2Fpdns.git dnsdist: Add an option for unauthenticated access to the dashboard --- diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc index c7d65cbb4d..2df956334d 100644 --- a/pdns/dnsdist-lua.cc +++ b/pdns/dnsdist-lua.cc @@ -1190,6 +1190,10 @@ static void setupLuaConfig(LuaContext& luaCtx, bool client, bool configCheck) setWebserverAPIRequiresAuthentication(boost::get(vars->at("apiRequiresAuthentication"))); } + if (vars->count("dashboardRequiresAuthentication")) { + setWebserverDashboardRequiresAuthentication(boost::get(vars->at("dashboardRequiresAuthentication"))); + } + if (vars->count("maxConcurrentConnections")) { setWebserverMaxConcurrentConnections(std::stoi(boost::get(vars->at("maxConcurrentConnections")))); } diff --git a/pdns/dnsdist-web.cc b/pdns/dnsdist-web.cc index c85a52a8ee..91ec2ba0a7 100644 --- a/pdns/dnsdist-web.cc +++ b/pdns/dnsdist-web.cc @@ -53,6 +53,7 @@ struct WebserverConfig std::unique_ptr apiKey; boost::optional > customHeaders; bool apiRequiresAuthentication{true}; + bool dashboardRequiresAuthentication{true}; bool statsRequireAuthentication{true}; }; @@ -81,6 +82,7 @@ std::string getWebserverConfig() out << "None" << endl; } out << "API requires authentication: " << (config->apiRequiresAuthentication ? "yes" : "no") << endl; + out << "Dashboard requires authentication: " << (config->dashboardRequiresAuthentication ? "yes" : "no") << endl; out << "Statistics require authentication: " << (config->statsRequireAuthentication ? "yes" : "no") << endl; out << "Password: " << (config->password ? "set" : "unset") << endl; out << "API key: " << (config->apiKey ? "set" : "unset") << endl; @@ -275,8 +277,12 @@ static bool checkAPIKey(const YaHTTP::Request& req, const std::unique_ptr& password) +static bool checkWebPassword(const YaHTTP::Request& req, const std::unique_ptr& password, bool dashboardRequiresAuthentication) { + if (!dashboardRequiresAuthentication) { + return true; + } + static const char basicStr[] = "basic "; const auto header = req.headers.find("authorization"); @@ -323,7 +329,7 @@ static bool handleAuthorization(const YaHTTP::Request& req) if (isAStatsRequest(req)) { if (config->statsRequireAuthentication) { /* Access to the stats is allowed for both API and Web users */ - return checkAPIKey(req, config->apiKey) || checkWebPassword(req, config->password); + return checkAPIKey(req, config->apiKey) || checkWebPassword(req, config->password, config->dashboardRequiresAuthentication); } return true; } @@ -334,10 +340,10 @@ static bool handleAuthorization(const YaHTTP::Request& req) return true; } - return isAnAPIRequestAllowedWithWebAuth(req) && checkWebPassword(req, config->password); + return isAnAPIRequestAllowedWithWebAuth(req) && checkWebPassword(req, config->password, config->dashboardRequiresAuthentication); } - return checkWebPassword(req, config->password); + return checkWebPassword(req, config->password, config->dashboardRequiresAuthentication); } static bool isMethodAllowed(const YaHTTP::Request& req) @@ -1586,7 +1592,7 @@ static void connectionThread(WebClientConnection&& conn) else if (!handleAuthorization(req)) { YaHTTP::strstr_map_t::iterator header = req.headers.find("authorization"); if (header != req.headers.end()) { - errlog("HTTP Request \"%s\" from %s: Web Authentication failed", req.url.path, conn.getClient().toStringWithPort()); + vinfolog("HTTP Request \"%s\" from %s: Web Authentication failed", req.url.path, conn.getClient().toStringWithPort()); } resp.status = 401; resp.body = "

Unauthorized

"; @@ -1660,6 +1666,11 @@ void setWebserverAPIRequiresAuthentication(bool require) g_webserverConfig.lock()->apiRequiresAuthentication = require; } +void setWebserverDashboardRequiresAuthentication(bool require) +{ + g_webserverConfig.lock()->dashboardRequiresAuthentication = require; +} + void setWebserverMaxConcurrentConnections(size_t max) { s_connManager.setMaxConcurrentConnections(max); @@ -1668,13 +1679,16 @@ void setWebserverMaxConcurrentConnections(size_t max) void dnsdistWebserverThread(int sock, const ComboAddress& local) { setThreadName("dnsdist/webserv"); - warnlog("Webserver launched on %s", local.toStringWithPort()); + infolog("Webserver launched on %s", local.toStringWithPort()); - if (!g_webserverConfig.lock()->password) { - warnlog("Webserver launched on %s without a password set!", local.toStringWithPort()); + { + auto config = g_webserverConfig.lock(); + if (!config->password && config->dashboardRequiresAuthentication) { + warnlog("Webserver launched on %s without a password set!", local.toStringWithPort()); + } } - for(;;) { + for (;;) { try { ComboAddress remote(local); int fd = SAccept(sock, remote); diff --git a/pdns/dnsdistdist/dnsdist-web.hh b/pdns/dnsdistdist/dnsdist-web.hh index fde00de6c9..0a8a0bcab9 100644 --- a/pdns/dnsdistdist/dnsdist-web.hh +++ b/pdns/dnsdistdist/dnsdist-web.hh @@ -7,6 +7,7 @@ void setWebserverPassword(std::unique_ptr&& password); void setWebserverACL(const std::string& acl); void setWebserverCustomHeaders(const boost::optional > customHeaders); void setWebserverAPIRequiresAuthentication(bool); +void setWebserverDashboardRequiresAuthentication(bool); void setWebserverStatsRequireAuthentication(bool); void setWebserverMaxConcurrentConnections(size_t); diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst index 65ca67cedd..506b7663d6 100644 --- a/pdns/dnsdistdist/docs/reference/config.rst +++ b/pdns/dnsdistdist/docs/reference/config.rst @@ -365,8 +365,8 @@ Webserver configuration The optional ``password`` and ``apiKey`` parameters now accept hashed passwords. The optional ``hashPlaintextCredentials`` parameter has been added. - .. versionchanged:: 1.6.0 - ``apiRequiresAuthentication`` optional parameters added. + .. versionchanged:: 1.8.0 + ``apiRequiresAuthentication``, ``dashboardRequiresAuthentication`` optional parameters added. Setup webserver configuration. See :func:`webserver`. @@ -379,6 +379,7 @@ Webserver configuration * ``customHeaders={[str]=str,...}``: map of string - Allows setting custom headers and removing the defaults. * ``acl=newACL``: string - List of IP addresses, as a string, that are allowed to open a connection to the web server. Defaults to "127.0.0.1, ::1". * ``apiRequiresAuthentication``: bool - Whether access to the API (/api endpoints) require a valid API key. Defaults to true. + * ``dashbpardRequiresAuthentication``: bool - Whether access to the internal dashboard requires a valid password. Defaults to true. * ``statsRequireAuthentication``: bool - Whether access to the statistics (/metrics and /jsonstat endpoints) require a valid password or API key. Defaults to true. * ``maxConcurrentConnections``: int - The maximum number of concurrent web connections, or 0 which means an unlimited number. Defaults to 100. * ``hashPlaintextCredentials``: bool - Whether passwords and API keys provided in plaintext should be hashed during startup, to prevent the plaintext versions from staying in memory. Doing so increases significantly the cost of verifying credentials. Defaults to false. diff --git a/regression-tests.dnsdist/test_API.py b/regression-tests.dnsdist/test_API.py index 68526a7cb1..bf8684183b 100644 --- a/regression-tests.dnsdist/test_API.py +++ b/regression-tests.dnsdist/test_API.py @@ -677,6 +677,30 @@ class TestAPIWithoutAuthentication(APITestsBase): self.assertTrue(r) self.assertEqual(r.status_code, 200) +class TestDashboardWithoutAuthentication(APITestsBase): + __test__ = True + _basicPath = '/' + _config_params = ['_testServerPort', '_webServerPort'] + _config_template = """ + setACL({"127.0.0.1/32", "::1/128"}) + newServer({address="127.0.0.1:%d"}) + webserver("127.0.0.1:%d") + setWebserverConfig({ dashboardRequiresAuthentication=false }) + """ + _verboseMode=True + + def testDashboard(self): + """ + API: Dashboard do not require authentication + """ + + for path in [self._basicPath]: + url = 'http://127.0.0.1:' + str(self._webServerPort) + path + + r = requests.get(url, timeout=self._webTimeout) + self.assertTrue(r) + self.assertEqual(r.status_code, 200) + class TestCustomLuaEndpoint(APITestsBase): __test__ = True _config_template = """