Commit 797fa144 authored by ale's avatar ale

Use an in-process cache for u2f/otp when memcached is not configured

This makes it possible to run the auth-server more easily for smaller
projects.
parent 781feef1
Pipeline #1348 passed with stage
in 15 seconds
......@@ -395,13 +395,14 @@ func NewServer(config *Config) (*Server, error) {
config: config,
}
var cache cacheClient
if len(config.MemcacheServers) > 0 {
s.u2fShortTerm = newMemcacheU2FStorage(config.MemcacheServers)
s.otpShortTerm = newMemcacheOTPStorage(config.MemcacheServers)
cache = newMemcacheReplicatedClient(config.MemcacheServers)
} else {
s.u2fShortTerm = &nullU2FStorage{}
s.otpShortTerm = &nullOTPStorage{}
cache = newInprocessCache()
}
s.u2fShortTerm = newU2FStorage(cache)
s.otpShortTerm = newOTPStorage(cache)
for _, name := range config.EnabledBackends {
var b UserBackend
......
......@@ -149,6 +149,7 @@ func runAuthenticationTest(t *testing.T, client client.Client) {
{"2fauser", "bad_password", validOTP, auth.StatusError, auth.TFAMethodNone},
{"2fauser", "password", "", auth.StatusInsufficientCredentials, auth.TFAMethodOTP},
{"2fauser", "password", validOTP, auth.StatusOK, auth.TFAMethodNone},
{"2fauser", "password", validOTP, auth.StatusError, auth.TFAMethodNone}, // fails due to replay protection
{"2fauser", "password", "123456", auth.StatusError, auth.TFAMethodNone},
}
for _, td := range testdata2 {
......
......@@ -3,10 +3,25 @@ package server
import (
"errors"
"sync"
"time"
"github.com/bradfitz/gomemcache/memcache"
cache "github.com/patrickmn/go-cache"
)
// Client for a short-term cache.
//
// Data should only be consistent over a short period of time, and the
// worst case scenario (challenge can't be retrieved) will simply
// cause the user to retry, so even in a replicated setup we do not
// need a strong consistency strategy: we simply fan out all reads and
// writes to all memcache servers in parallel.
type cacheClient interface {
writeAll(string, []byte, int) error
readAny(string) ([]byte, bool)
}
// A cacheClient that uses one or more memcached servers.
type memcacheReplicatedClient struct {
caches []*memcache.Client
}
......@@ -85,3 +100,28 @@ func (m *memcacheReplicatedClient) readAny(key string) ([]byte, bool) {
}
return value, true
}
// A cacheClient that uses an in-process cache.
type inprocessCache struct {
cache *cache.Cache
}
func newInprocessCache() *inprocessCache {
return &inprocessCache{
cache: cache.New(5*time.Minute, 10*time.Minute),
}
}
func (c *inprocessCache) writeAll(key string, value []byte, ttl int) error {
// Force the value to string in order to make a copy.
c.cache.Set(key, string(value), time.Duration(ttl)*time.Second)
return nil
}
func (c *inprocessCache) readAny(key string) ([]byte, bool) {
value, ok := c.cache.Get(key)
if !ok {
return nil, false
}
return []byte(value.(string)), ok
}
......@@ -4,19 +4,19 @@ import "fmt"
const otpReplayProtectionTTL = 300
type memcacheOTPStorage struct {
*memcacheReplicatedClient
type otpStorage struct {
cacheClient
}
func newMemcacheOTPStorage(servers []string) *memcacheOTPStorage {
return &memcacheOTPStorage{newMemcacheReplicatedClient(servers)}
func newOTPStorage(cache cacheClient) *otpStorage {
return &otpStorage{cache}
}
func (m *memcacheOTPStorage) AddToken(username, token string) error {
func (m *otpStorage) AddToken(username, token string) error {
return m.writeAll(otpMemcacheKey(username, token), []byte{1}, otpReplayProtectionTTL)
}
func (m *memcacheOTPStorage) HasToken(username, token string) bool {
func (m *otpStorage) HasToken(username, token string) bool {
_, ok := m.readAny(otpMemcacheKey(username, token))
return ok
}
......@@ -24,8 +24,3 @@ func (m *memcacheOTPStorage) HasToken(username, token string) bool {
func otpMemcacheKey(username, token string) string {
return fmt.Sprintf("otp/%s/%s", username, token)
}
type nullOTPStorage struct{}
func (n *nullOTPStorage) AddToken(username, token string) error { return nil }
func (n *nullOTPStorage) HasToken(username, token string) bool { return false }
......@@ -18,24 +18,16 @@ func init() {
gob.Register(&u2f.Challenge{})
}
// A memcache-backed implementation of the short-term U2F challenge
// storage.
//
// Data should only be consistent over a short period of time, and the
// worst case scenario (challenge can't be retrieved) will simply
// cause the user to retry, so we do not need a strong consistency
// strategy: we simply fan out all reads and writes to all memcache
// servers in parallel.
//
type memcacheU2FStorage struct {
*memcacheReplicatedClient
// Short-term U2F challenge storage.
type u2fStorage struct {
cacheClient
}
func newMemcacheU2FStorage(servers []string) *memcacheU2FStorage {
return &memcacheU2FStorage{newMemcacheReplicatedClient(servers)}
func newU2FStorage(cache cacheClient) *u2fStorage {
return &u2fStorage{cache}
}
func (m *memcacheU2FStorage) SetUserChallenge(user string, chal *u2f.Challenge) error {
func (m *u2fStorage) SetUserChallenge(user string, chal *u2f.Challenge) error {
data, err := serializeU2FChallenge(chal)
if err != nil {
return err
......@@ -43,12 +35,15 @@ func (m *memcacheU2FStorage) SetUserChallenge(user string, chal *u2f.Challenge)
return m.writeAll(u2fChallengeKey(user), data, u2fCacheExpirationSeconds)
}
func (m *memcacheU2FStorage) GetUserChallenge(user string) (*u2f.Challenge, bool) {
func (m *u2fStorage) GetUserChallenge(user string) (*u2f.Challenge, bool) {
value, ok := m.readAny(u2fChallengeKey(user))
if !ok {
return nil, false
}
chal, _ := deserializeU2FChallenge(value)
chal, err := deserializeU2FChallenge(value)
if err != nil {
return nil, false
}
return chal, true
}
......@@ -71,8 +66,3 @@ func deserializeU2FChallenge(data []byte) (*u2f.Challenge, error) {
}
return &chal, nil
}
type nullU2FStorage struct{}
func (s *nullU2FStorage) SetUserChallenge(user string, chal *u2f.Challenge) error { return nil }
func (s *nullU2FStorage) GetUserChallenge(user string) (*u2f.Challenge, bool) { return nil, false }
This is a list of people who have contributed code to go-cache. They, or their
employers, are the copyright holders of the contributed code. Contributed code
is subject to the license restrictions listed in LICENSE (as they were when the
code was contributed.)
Dustin Sallings <dustin@spy.net>
Jason Mooberry <jasonmoo@me.com>
Sergey Shepelev <temotor@gmail.com>
Alex Edwards <ajmedwards@gmail.com>
Copyright (c) 2012-2018 Patrick Mylund Nielsen and the go-cache contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
# go-cache
go-cache is an in-memory key:value store/cache similar to memcached that is
suitable for applications running on a single machine. Its major advantage is
that, being essentially a thread-safe `map[string]interface{}` with expiration
times, it doesn't need to serialize or transmit its contents over the network.
Any object can be stored, for a given duration or forever, and the cache can be
safely used by multiple goroutines.
Although go-cache isn't meant to be used as a persistent datastore, the entire
cache can be saved to and loaded from a file (using `c.Items()` to retrieve the
items map to serialize, and `NewFrom()` to create a cache from a deserialized
one) to recover from downtime quickly. (See the docs for `NewFrom()` for caveats.)
### Installation
`go get github.com/patrickmn/go-cache`
### Usage
```go
import (
"fmt"
"github.com/patrickmn/go-cache"
"time"
)
func main() {
// Create a cache with a default expiration time of 5 minutes, and which
// purges expired items every 10 minutes
c := cache.New(5*time.Minute, 10*time.Minute)
// Set the value of the key "foo" to "bar", with the default expiration time
c.Set("foo", "bar", cache.DefaultExpiration)
// Set the value of the key "baz" to 42, with no expiration time
// (the item won't be removed until it is re-set, or removed using
// c.Delete("baz")
c.Set("baz", 42, cache.NoExpiration)
// Get the string associated with the key "foo" from the cache
foo, found := c.Get("foo")
if found {
fmt.Println(foo)
}
// Since Go is statically typed, and cache values can be anything, type
// assertion is needed when values are being passed to functions that don't
// take arbitrary types, (i.e. interface{}). The simplest way to do this for
// values which will only be used once--e.g. for passing to another
// function--is:
foo, found := c.Get("foo")
if found {
MyFunction(foo.(string))
}
// This gets tedious if the value is used several times in the same function.
// You might do either of the following instead:
if x, found := c.Get("foo"); found {
foo := x.(string)
// ...
}
// or
var foo string
if x, found := c.Get("foo"); found {
foo = x.(string)
}
// ...
// foo can then be passed around freely as a string
// Want performance? Store pointers!
c.Set("foo", &MyStruct, cache.DefaultExpiration)
if x, found := c.Get("foo"); found {
foo := x.(*MyStruct)
// ...
}
}
```
### Reference
`godoc` or [http://godoc.org/github.com/patrickmn/go-cache](http://godoc.org/github.com/patrickmn/go-cache)
This diff is collapsed.
package cache
import (
"crypto/rand"
"math"
"math/big"
insecurerand "math/rand"
"os"
"runtime"
"time"
)
// This is an experimental and unexported (for now) attempt at making a cache
// with better algorithmic complexity than the standard one, namely by
// preventing write locks of the entire cache when an item is added. As of the
// time of writing, the overhead of selecting buckets results in cache
// operations being about twice as slow as for the standard cache with small
// total cache sizes, and faster for larger ones.
//
// See cache_test.go for a few benchmarks.
type unexportedShardedCache struct {
*shardedCache
}
type shardedCache struct {
seed uint32
m uint32
cs []*cache
janitor *shardedJanitor
}
// djb2 with better shuffling. 5x faster than FNV with the hash.Hash overhead.
func djb33(seed uint32, k string) uint32 {
var (
l = uint32(len(k))
d = 5381 + seed + l
i = uint32(0)
)
// Why is all this 5x faster than a for loop?
if l >= 4 {
for i < l-4 {
d = (d * 33) ^ uint32(k[i])
d = (d * 33) ^ uint32(k[i+1])
d = (d * 33) ^ uint32(k[i+2])
d = (d * 33) ^ uint32(k[i+3])
i += 4
}
}
switch l - i {
case 1:
case 2:
d = (d * 33) ^ uint32(k[i])
case 3:
d = (d * 33) ^ uint32(k[i])
d = (d * 33) ^ uint32(k[i+1])
case 4:
d = (d * 33) ^ uint32(k[i])
d = (d * 33) ^ uint32(k[i+1])
d = (d * 33) ^ uint32(k[i+2])
}
return d ^ (d >> 16)
}
func (sc *shardedCache) bucket(k string) *cache {
return sc.cs[djb33(sc.seed, k)%sc.m]
}
func (sc *shardedCache) Set(k string, x interface{}, d time.Duration) {
sc.bucket(k).Set(k, x, d)
}
func (sc *shardedCache) Add(k string, x interface{}, d time.Duration) error {
return sc.bucket(k).Add(k, x, d)
}
func (sc *shardedCache) Replace(k string, x interface{}, d time.Duration) error {
return sc.bucket(k).Replace(k, x, d)
}
func (sc *shardedCache) Get(k string) (interface{}, bool) {
return sc.bucket(k).Get(k)
}
func (sc *shardedCache) Increment(k string, n int64) error {
return sc.bucket(k).Increment(k, n)
}
func (sc *shardedCache) IncrementFloat(k string, n float64) error {
return sc.bucket(k).IncrementFloat(k, n)
}
func (sc *shardedCache) Decrement(k string, n int64) error {
return sc.bucket(k).Decrement(k, n)
}
func (sc *shardedCache) Delete(k string) {
sc.bucket(k).Delete(k)
}
func (sc *shardedCache) DeleteExpired() {
for _, v := range sc.cs {
v.DeleteExpired()
}
}
// Returns the items in the cache. This may include items that have expired,
// but have not yet been cleaned up. If this is significant, the Expiration
// fields of the items should be checked. Note that explicit synchronization
// is needed to use a cache and its corresponding Items() return values at
// the same time, as the maps are shared.
func (sc *shardedCache) Items() []map[string]Item {
res := make([]map[string]Item, len(sc.cs))
for i, v := range sc.cs {
res[i] = v.Items()
}
return res
}
func (sc *shardedCache) Flush() {
for _, v := range sc.cs {
v.Flush()
}
}
type shardedJanitor struct {
Interval time.Duration
stop chan bool
}
func (j *shardedJanitor) Run(sc *shardedCache) {
j.stop = make(chan bool)
tick := time.Tick(j.Interval)
for {
select {
case <-tick:
sc.DeleteExpired()
case <-j.stop:
return
}
}
}
func stopShardedJanitor(sc *unexportedShardedCache) {
sc.janitor.stop <- true
}
func runShardedJanitor(sc *shardedCache, ci time.Duration) {
j := &shardedJanitor{
Interval: ci,
}
sc.janitor = j
go j.Run(sc)
}
func newShardedCache(n int, de time.Duration) *shardedCache {
max := big.NewInt(0).SetUint64(uint64(math.MaxUint32))
rnd, err := rand.Int(rand.Reader, max)
var seed uint32
if err != nil {
os.Stderr.Write([]byte("WARNING: go-cache's newShardedCache failed to read from the system CSPRNG (/dev/urandom or equivalent.) Your system's security may be compromised. Continuing with an insecure seed.\n"))
seed = insecurerand.Uint32()
} else {
seed = uint32(rnd.Uint64())
}
sc := &shardedCache{
seed: seed,
m: uint32(n),
cs: make([]*cache, n),
}
for i := 0; i < n; i++ {
c := &cache{
defaultExpiration: de,
items: map[string]Item{},
}
sc.cs[i] = c
}
return sc
}
func unexportedNewSharded(defaultExpiration, cleanupInterval time.Duration, shards int) *unexportedShardedCache {
if defaultExpiration == 0 {
defaultExpiration = -1
}
sc := newShardedCache(shards, defaultExpiration)
SC := &unexportedShardedCache{sc}
if cleanupInterval > 0 {
runShardedJanitor(sc, cleanupInterval)
runtime.SetFinalizer(SC, stopShardedJanitor)
}
return SC
}
......@@ -111,6 +111,12 @@
"revision": "c12348ce28de40eed0136aa2b644d0ee0650e56c",
"revisionTime": "2016-04-24T11:30:07Z"
},
{
"checksumSHA1": "W8mzTLRjnooGtHwWaxSX8eq8hlY=",
"path": "github.com/patrickmn/go-cache",
"revision": "5633e0862627c011927fa39556acae8b1f1df58a",
"revisionTime": "2018-08-15T05:31:27Z"
},
{
"checksumSHA1": "L3iXlt9SyaGtInA6xl2Uh5UA26s=",
"path": "github.com/pquerna/otp",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment