feat(security): implement start negotiation (#134)

XiaoMi · Sep 18, 2020 · a79ea8c · a79ea8c
1 parent 4cf307c
commit a79ea8c
Show file tree

Hide file tree

Showing 11 changed files with 2,238 additions and 6 deletions.
diff --git a/idl/recompile_thrift.sh b/idl/recompile_thrift.sh
@@ -24,6 +24,7 @@ rm -rf $TMP_DIR
 mkdir -p $TMP_DIR
 $thrift --gen java rrdb.thrift
 $thrift --gen java replication.thrift 
+$thrift --gen java security.thrift 
 
 for gen_file in `find $TMP_DIR -name "*.java"`; do
     cat apache-licence-template $gen_file > $gen_file.tmp

diff --git a/idl/security.thrift b/idl/security.thrift
@@ -0,0 +1,61 @@
+include "base.thrift"
+
+namespace cpp dsn.apps
+namespace java com.xiaomi.infra.pegasus.apps
+namespace py pypegasus.rrdb
+
+// negotiation process:
+//
+//                       client                              server
+//                          | ---    SASL_LIST_MECHANISMS     --> |
+//                          | <--  SASL_LIST_MECHANISMS_RESP  --- |
+//                          | --     SASL_SELECT_MECHANISMS   --> |
+//                          | <-- SASL_SELECT_MECHANISMS_RESP --- |
+//                          |                                     |
+//                          | ---       SASL_INITIATE         --> |
+//                          |                                     |
+//                          | <--       SASL_CHALLENGE        --- |
+//                          | ---     SASL_CHALLENGE_RESP     --> |
+//                          |                                     |
+//                          |               .....                 |
+//                          |                                     |
+//                          | <--       SASL_CHALLENGE        --- |
+//                          | ---     SASL_CHALLENGE_RESP     --> |
+//                          |                                     | (authentication will succeed
+//                          |                                     |  if all challenges passed)
+//                          | <--         SASL_SUCC           --- |
+// (client won't response   |                                     |
+// if servers says ok)      |                                     |
+//                          | ---         RPC_CALL           ---> |
+//                          | <--         RPC_RESP           ---- |
+
+enum negotiation_status {
+    INVALID
+    SASL_LIST_MECHANISMS
+    SASL_LIST_MECHANISMS_RESP
+    SASL_SELECT_MECHANISMS
+    SASL_SELECT_MECHANISMS_RESP
+    SASL_INITIATE
+    SASL_CHALLENGE
+    SASL_CHALLENGE_RESP
+    SASL_SUCC
+    SASL_AUTH_DISABLE
+    SASL_AUTH_FAIL
+}
+
+struct negotiation_request
+{
+    1: negotiation_status status;
+    2: base.blob msg;
+}
+
+struct negotiation_response
+{
+    1: negotiation_status status;
+    2: base.blob msg;
+}
+
+service security
+{
+    negotiation_response negotiate(1:negotiation_request request);
+}