Merge pull request #284 from rade/276_alternative_password_supply

LGTM.  Closes #276

site/features.md

@@ -129,11 +129,19 @@ sharing it between applications:
 ### <a name="security"></a>Security
 
 In order to connect containers across untrusted networks, weave peers
-can be told to encrypt traffic by supplying a `-password` option when
-launching weave, e.g.
+can be told to encrypt traffic by supplying a `-password` or
+`-passwordfile` option when launching weave, e.g.
 
     host1# weave launch -password wEaVe
 
+or
+
+    host1# weave launch -passwordfile /path/to/file
+
+where the file must contain a single line like this:
+
+    WEAVE_PASSWORD=wEaVe
+
 The same password must be specified for all weave peers; it is a
 component in the creation of ephemeral session keys for connections
 between peers. See the

site/how-it-works.md

@@ -117,27 +117,27 @@ poorly documented, and easily used wrongly.
 For every connection between peers, a fresh public/private key pair is
 created at both ends, using NaCl's `GenerateKey` function. The public
 key portion is sent to the other end as part of the initial handshake
-performed over TCP. Peers that were started with `-password` do not
+performed over TCP. Peers that were started with a password do not
 continue with connection establishment unless they receive a public
 key from the remote peer. Thus either all peers in a weave network
-must be started with `-password`, or none of them.
+must be supplied with a password, or none.
 
 When a peer has received a public key from the remote peer, it uses
 this to form the ephemeral session key for this connection. The public
 key from the remote peer is combined with the private key for the
 local peer in the usual Diffie-Hellman way, resulting in both peers
-arriving at the same shared key. To this is appended the password from
-the command line `-password` option, and the result is hashed through
-SHA256, to form the final ephemeral session key. Thus the supplied
-password is never exchanged directly, and is thoroughly mixed into the
-shared secret. The shared key formed by Diffie-Hellman is 256 bits
-long, appending the password to this obviously makes it longer by an
-unknown amount, and the use of SHA256 reduces this back to 256 bits,
-to form the final ephemeral session key. This late combination with
-the password eliminates "Man In The Middle" attacks: sniffing the
-public key exchange between the two peers and faking their responses
-will not grant an attacker knowledge of the password, and so an
-attacker would not be able to form valid ephemeral session keys.
+arriving at the same shared key. To this is appended the supplied
+password, and the result is hashed through SHA256, to form the final
+ephemeral session key. Thus the supplied password is never exchanged
+directly, and is thoroughly mixed into the shared secret. The shared
+key formed by Diffie-Hellman is 256 bits long, appending the password
+to this obviously makes it longer by an unknown amount, and the use of
+SHA256 reduces this back to 256 bits, to form the final ephemeral
+session key. This late combination with the password eliminates "Man
+In The Middle" attacks: sniffing the public key exchange between the
+two peers and faking their responses will not grant an attacker
+knowledge of the password, and so an attacker would not be able to
+form valid ephemeral session keys.
 
 The same ephemeral session key is used for both TCP and UDP traffic
 between two peers.

weave

@@ -3,7 +3,7 @@ set -e
 
 usage() {
     echo "Usage:"
-    echo "weave launch     [-password <password>] <peer> ..."
+    echo "weave launch     [-password <password> | -passwordfile <path>] <peer> ..."
     echo "weave launch-dns <cidr>"
     echo "weave connect    <peer>"
     echo "weave run        [--with-dns] <cidr> <docker run args> ..."
@@ -427,10 +427,19 @@ case "$COMMAND" in
             echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2
             shift 1
         fi
+        if [ "$1" = "-password" ] ; then
+            [ $# -gt 1 ] || usage
+            PASSWORD=$2
+            shift 2
+        elif [ "$1" = "-passwordfile" ] ; then
+            [ $# -gt 1 ] || usage
+            PASSWORDFILE=$2
+            shift 2
+        fi
         # Set WEAVE_DOCKER_ARGS in the environment in order to supply
         # additional parameters, such as resource limits, to docker
         # when launching the weave container.
-        CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@")
+        CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp ${PASSWORD:+-e WEAVE_PASSWORD="$PASSWORD"} ${PASSWORDFILE:+--env-file="$PASSWORDFILE"} $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@")
         with_container_netns $CONTAINER launch >/dev/null
         echo $CONTAINER
         ;;

weaver/main.go

@@ -73,6 +73,15 @@ func main() {
 		log.Fatal(err)
 	}
 
+	if password == "" {
+		password = os.Getenv("WEAVE_PASSWORD")
+	}
+	if password == "" {
+		log.Println("Communication between peers is unencrypted.")
+	} else {
+		log.Println("Communication between peers is encrypted.")
+	}
+
 	var logFrame func(string, []byte, *layers.Ethernet)
 	if debug {
 		logFrame = func(prefix string, frame []byte, eth *layers.Ethernet) {