From ff69868922c2694406cc368a06d59e0a4c86c81e Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Fri, 19 Dec 2014 23:19:28 +0000 Subject: [PATCH 1/2] allow password to be set through WEAVE_PASSWORD env var so that passwords can be supplied w/o them showing up in 'ps' --- weaver/main.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/weaver/main.go b/weaver/main.go index 48ab2626..674875b4 100644 --- a/weaver/main.go +++ b/weaver/main.go @@ -73,6 +73,15 @@ func main() { log.Fatal(err) } + if password == "" { + password = os.Getenv("WEAVE_PASSWORD") + } + if password == "" { + log.Println("Communication between peers is unencrypted.") + } else { + log.Println("Communication between peers is encrypted.") + } + var logFrame func(string, []byte, *layers.Ethernet) if debug { logFrame = func(prefix string, frame []byte, eth *layers.Ethernet) { From e2ec460752668b7ce53e3289d5d0a7e9b784afbf Mon Sep 17 00:00:00 2001 From: Matthias Radestock Date: Sat, 20 Dec 2014 01:22:59 +0000 Subject: [PATCH 2/2] feed password to weave via env var, possibly via a file The latter is the most secure route since it keeps the password completely out of any command lines, and the permissions on the file can be very restrictive, e.g. 0400. It would be somewhat nicer if the password file contained just rather than WEAVE_PASSWORD= but then we'd have to transit the password via a temporary file with 0600 permissions. --- site/features.md | 12 ++++++++++-- site/how-it-works.md | 28 ++++++++++++++-------------- weave | 13 +++++++++++-- 3 files changed, 35 insertions(+), 18 deletions(-) diff --git a/site/features.md b/site/features.md index 14d2690d..e27b9b45 100644 --- a/site/features.md +++ b/site/features.md @@ -129,11 +129,19 @@ sharing it between applications: ### Security In order to connect containers across untrusted networks, weave peers -can be told to encrypt traffic by supplying a `-password` option when -launching weave, e.g. +can be told to encrypt traffic by supplying a `-password` or +`-passwordfile` option when launching weave, e.g. host1# weave launch -password wEaVe +or + + host1# weave launch -passwordfile /path/to/file + +where the file must contain a single line like this: + + WEAVE_PASSWORD=wEaVe + The same password must be specified for all weave peers; it is a component in the creation of ephemeral session keys for connections between peers. See the diff --git a/site/how-it-works.md b/site/how-it-works.md index 835ac533..0e195ea1 100644 --- a/site/how-it-works.md +++ b/site/how-it-works.md @@ -117,27 +117,27 @@ poorly documented, and easily used wrongly. For every connection between peers, a fresh public/private key pair is created at both ends, using NaCl's `GenerateKey` function. The public key portion is sent to the other end as part of the initial handshake -performed over TCP. Peers that were started with `-password` do not +performed over TCP. Peers that were started with a password do not continue with connection establishment unless they receive a public key from the remote peer. Thus either all peers in a weave network -must be started with `-password`, or none of them. +must be supplied with a password, or none. When a peer has received a public key from the remote peer, it uses this to form the ephemeral session key for this connection. The public key from the remote peer is combined with the private key for the local peer in the usual Diffie-Hellman way, resulting in both peers -arriving at the same shared key. To this is appended the password from -the command line `-password` option, and the result is hashed through -SHA256, to form the final ephemeral session key. Thus the supplied -password is never exchanged directly, and is thoroughly mixed into the -shared secret. The shared key formed by Diffie-Hellman is 256 bits -long, appending the password to this obviously makes it longer by an -unknown amount, and the use of SHA256 reduces this back to 256 bits, -to form the final ephemeral session key. This late combination with -the password eliminates "Man In The Middle" attacks: sniffing the -public key exchange between the two peers and faking their responses -will not grant an attacker knowledge of the password, and so an -attacker would not be able to form valid ephemeral session keys. +arriving at the same shared key. To this is appended the supplied +password, and the result is hashed through SHA256, to form the final +ephemeral session key. Thus the supplied password is never exchanged +directly, and is thoroughly mixed into the shared secret. The shared +key formed by Diffie-Hellman is 256 bits long, appending the password +to this obviously makes it longer by an unknown amount, and the use of +SHA256 reduces this back to 256 bits, to form the final ephemeral +session key. This late combination with the password eliminates "Man +In The Middle" attacks: sniffing the public key exchange between the +two peers and faking their responses will not grant an attacker +knowledge of the password, and so an attacker would not be able to +form valid ephemeral session keys. The same ephemeral session key is used for both TCP and UDP traffic between two peers. diff --git a/weave b/weave index 1d3be358..1d041ceb 100755 --- a/weave +++ b/weave @@ -3,7 +3,7 @@ set -e usage() { echo "Usage:" - echo "weave launch [-password ] ..." + echo "weave launch [-password | -passwordfile ] ..." echo "weave launch-dns " echo "weave connect " echo "weave run [--with-dns] ..." @@ -421,10 +421,19 @@ case "$COMMAND" in echo "WARNING: $1 parameter ignored; 'weave launch' no longer takes a CIDR as the first parameter" >&2 shift 1 fi + if [ "$1" = "-password" ] ; then + [ $# -gt 1 ] || usage + PASSWORD=$2 + shift 2 + elif [ "$1" = "-passwordfile" ] ; then + [ $# -gt 1 ] || usage + PASSWORDFILE=$2 + shift 2 + fi # Set WEAVE_DOCKER_ARGS in the environment in order to supply # additional parameters, such as resource limits, to docker # when launching the weave container. - CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@") + CONTAINER=$(docker run --privileged -d --name=$CONTAINER_NAME -p $PORT:$PORT/tcp -p $PORT:$PORT/udp ${PASSWORD:+-e WEAVE_PASSWORD="$PASSWORD"} ${PASSWORDFILE:+--env-file="$PASSWORDFILE"} $WEAVE_DOCKER_ARGS $IMAGE -name $MACADDR "$@") with_container_netns $CONTAINER launch >/dev/null echo $CONTAINER ;;