Strict control of streaming API keys and MACHINE GUIDs in stream.conf (#14063)
do not allow machine guids to be used as API keys
Costa Tsaousis committed
Nov 29, 2022 at 17:28 UTC
811028aea2f146cc0ac2bc403f7d692add400d63
2 files changed
+34
-6
streaming/rrdpush.c
+24
-6
@@ -766,21 +766,30 @@ int rrdpush_receiver_thread_spawn(struct web_client *w, char *url) {
766
767
if(regenerate_guid(key, buf) == -1) {
768
rrdhost_system_info_free(system_info);
769
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname)?hostname:"-", "ACCESS DENIED - INVALID KEY");
769
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - INVALID KEY");
770
error("STREAM [receive from [%s]:%s]: API key '%s' is not valid GUID (use the command uuidgen to generate one). Forbidding access.", w->client_ip, w->client_port, key);
771
return rrdpush_receiver_permission_denied(w);
772
}
773
774
if(regenerate_guid(machine_guid, buf) == -1) {
775
rrdhost_system_info_free(system_info);
776
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname)?hostname:"-", "ACCESS DENIED - INVALID MACHINE GUID");
776
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - INVALID MACHINE GUID");
777
error("STREAM [receive from [%s]:%s]: machine GUID '%s' is not GUID. Forbidding access.", w->client_ip, w->client_port, machine_guid);
778
return rrdpush_receiver_permission_denied(w);
779
}
780
781
+ const char *api_key_type = appconfig_get(&stream_config, key, "type", "api");
782
+ if(!api_key_type || !*api_key_type) api_key_type = "unknown";
783
+ if(strcmp(api_key_type, "api") != 0) {
784
+ rrdhost_system_info_free(system_info);
785
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - API KEY GIVEN IS NOT API KEY");
786
+ error("STREAM [receive from [%s]:%s]: API key '%s' is a %s GUID. Forbidding access.", w->client_ip, w->client_port, key, api_key_type);
787
+ return rrdpush_receiver_permission_denied(w);
788
+ }
789
+
790
if(!appconfig_get_boolean(&stream_config, key, "enabled", 0)) {
791
rrdhost_system_info_free(system_info);
783
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname)?hostname:"-", "ACCESS DENIED - KEY NOT ENABLED");
792
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - KEY NOT ENABLED");
793
error("STREAM [receive from [%s]:%s]: API key '%s' is not allowed. Forbidding access.", w->client_ip, w->client_port, key);
794
return rrdpush_receiver_permission_denied(w);
795
}
@@ -791,7 +800,7 @@ int rrdpush_receiver_thread_spawn(struct web_client *w, char *url) {
800
if(!simple_pattern_matches(key_allow_from, w->client_ip)) {
801
simple_pattern_free(key_allow_from);
802
rrdhost_system_info_free(system_info);
794
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname) ? hostname : "-", "ACCESS DENIED - KEY NOT ALLOWED FROM THIS IP");
803
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - KEY NOT ALLOWED FROM THIS IP");
804
error("STREAM [receive from [%s]:%s]: API key '%s' is not permitted from this IP. Forbidding access.", w->client_ip, w->client_port, key);
805
return rrdpush_receiver_permission_denied(w);
806
}
@@ -799,9 +808,18 @@ int rrdpush_receiver_thread_spawn(struct web_client *w, char *url) {
808
}
809
}
810
811
+ const char *machine_guid_type = appconfig_get(&stream_config, machine_guid, "type", "machine");
812
+ if(!machine_guid_type || !*machine_guid_type) machine_guid_type = "unknown";
813
+ if(strcmp(machine_guid_type, "machine") != 0) {
814
+ rrdhost_system_info_free(system_info);
815
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - MACHINE GUID GIVEN IS NOT A MACHINE GUID");
816
+ error("STREAM [receive from [%s]:%s]: machine GUID '%s' is a %s GUID. Forbidding access.", w->client_ip, w->client_port, machine_guid, machine_guid_type);
817
+ return rrdpush_receiver_permission_denied(w);
818
+ }
819
+
820
if(!appconfig_get_boolean(&stream_config, machine_guid, "enabled", 1)) {
821
rrdhost_system_info_free(system_info);
804
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname)?hostname:"-", "ACCESS DENIED - MACHINE GUID NOT ENABLED");
822
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - MACHINE GUID NOT ENABLED");
823
error("STREAM [receive from [%s]:%s]: machine GUID '%s' is not allowed. Forbidding access.", w->client_ip, w->client_port, machine_guid);
824
return rrdpush_receiver_permission_denied(w);
825
}
@@ -812,7 +830,7 @@ int rrdpush_receiver_thread_spawn(struct web_client *w, char *url) {
830
if(!simple_pattern_matches(machine_allow_from, w->client_ip)) {
831
simple_pattern_free(machine_allow_from);
832
rrdhost_system_info_free(system_info);
815
- log_stream_connection(w->client_ip, w->client_port, (key && *key)?key:"-", (machine_guid && *machine_guid)?machine_guid:"-", (hostname && *hostname) ? hostname : "-", "ACCESS DENIED - MACHINE GUID NOT ALLOWED FROM THIS IP");
833
+ log_stream_connection(w->client_ip, w->client_port, key, machine_guid, hostname, "ACCESS DENIED - MACHINE GUID NOT ALLOWED FROM THIS IP");
834
error("STREAM [receive from [%s]:%s]: Machine GUID '%s' is not permitted from this IP. Forbidding access.", w->client_ip, w->client_port, machine_guid);
835
return rrdpush_receiver_permission_denied(w);
836
}
streaming/stream.conf
+10
@@ -111,6 +111,11 @@
111
[API_KEY]
112
# Default settings for this API key
113
114
+ # This GUID is to be used as an API key from remote agents connecting
115
+ # to this machine. Failure to match such a key, denies access.
116
+ # YOU MUST SET THIS FIELD ON ALL API KEYS.
117
+ type = api
118
+
119
# You can disable the API key, by setting this to: no
120
# The default (for unknown API keys) is: no
121
enabled = no
@@ -187,6 +192,11 @@
192
# you can give settings for each sending host here.
193
194
[MACHINE_GUID]
195
+ # This GUID is to be used as a MACHINE GUID from remote agents connecting
196
+ # to this machine, not an API key.
197
+ # YOU MUST SET THIS FIELD ON ALL MACHINE GUIDs.
198
+ type = machine
199
+
200
# enable this host: yes | no
201
# When disabled, the parent will not receive metrics for this host.
202
# THIS IS NOT A SECURITY MECHANISM - AN ATTACKER CAN SET ANY OTHER GUID.