首页 > 数据库技术 > 详细

mongodb认证源码分析——使用策略模式，网络不传输密码

时间：2015-01-27 02:21:41      阅读：858      评论：0      收藏：0      [点我收藏+]

最近研究了一下mongodb的用户认证全过程，也根据产品需求对mongodb的认证做了相关的修改。现在将mongodb分片过程中mongos的认证过程全解如下。首先从整体上把握认证的全过程，以下面简单的序列图来表示，第一步：调用者调用认证接口之后，从mongos获取随机码，用随机码+用户名+密码生成digest，并且发送用户名，随机码和Digest给mongos认。第二步： Mongos收到认证消息之后，取用户名。取随机码和digest. 第三步：mongos先从其缓存中获取用户信息，获取不到，到mongod去获取保存在数据库中的用户信息。第四步：按照Driver的方式生成一个Digest 即computed。第五步：比较digest 和Computed.返回结果。

bubuko.com,布布扣

 

Driver的代码很简单，不想多说，现在我们来看看mongos收到上面的消息之后，是怎样认证的，现将整个认证过程中重要的步骤的架构图勾画如下：

  bubuko.com,布布扣

我这里不想去解析mongodb的通信过程代码，那部分代码，各位感兴趣的话，可以去研读。Mongo驱动与mongos或者mongod建立连接之后，会通过MessagingServer::accepted而accept是一个虚函数，就会调用PortMessageServer::accepted函数创建一个线程，而其入口正是接收所有消息的PortMessageServer:: handleIncomingMsg函数，看看其收到消息之后的关键代码：


点击(此处)折叠或打开

  1. static void* handleIncomingMsg(void* arg) {
  2.             TicketHolderReleaser connTicketReleaser( &Listener::globalTicketHolder );

  4.             invariant(arg);
  5.             scoped_ptr<MessagingPortWithHandler> portWithHandler(
  6.                 static_cast<MessagingPortWithHandler*>(arg));
  7.             MessageHandler* const handler = portWithHandler->getHandler();
  8.             .............
  9.             Message m;
  10.             int64_t lastIdle = Listener::getElapsedTimeMillis();
  11.             int64_t avgMillisBetweenIdle = 0;
  12.             try {
  13.                 LastError * le = new LastError();
  14.                 lastError.reset( le ); // lastError now has ownership

  16.                 handler->connected(portWithHandler.get());

  18.                 while ( ! inShutdown() ) {
  19.                     m.reset();
  20.                     portWithHandler->psock->clearCounters();

  22.                     if (!portWithHandler->recv(m)) {
  23.                         if (!serverGlobalParams.quiet) {
  24.                             int conns = Listener::globalTicketHolder.used()-1;
  25.                             const char* word = (conns == 1 ? " connection" : " connections");
  26.                             log() << "end connection " << portWithHandler->psock->remoteString()
  27.                                   << " (" << conns << word << " now open)" << endl;
  28.                         }
  29.                         portWithHandler->shutdown();
  30.                         break;
  31.                     }

  33.                     handler->process(m, portWithHandler.get(), le);
  34.                     networkCounter.hit(portWithHandler->psock->getBytesIn(),
  35.                                        portWithHandler->psock->getBytesOut());

  37.                     // Connections that don‘t run at a high rate should mark an idle point
  38.                     // between operations to allow cleanup of the thread-local malloc cache.
  39.                     // Just before a receive is a reasonable point, as we may overlap with
  40.                     // the processing of a command response. Avoid doing this in very active
  41.                     // threads as they are actively using their memory and not experiencing
  42.                     // resource starvation. Use the course clock with averaging for efficiency.

  44.                     const int64_t now = Listener::getElapsedTimeMillis();
  45.                     const int64_t millisSinceIdle = now - lastIdle;
  46.                     avgMillisBetweenIdle = (7 * avgMillisBetweenIdle + millisSinceIdle) / 8;
  47.                     if (avgMillisBetweenIdle >= 10) {
  48.                         markThreadIdle();
  49.                     }
  50.                     lastIdle = now;
  51.                 }
  52.             }
  53.             catch ( AssertionException& e ) {
  54.                 log() << "AssertionException handling request, closing client connection: " << e << endl;
  55.                 portWithHandler->shutdown();
  56.             }
  57.             catch ( SocketException& e ) {
  58.                 log() << "SocketException handling request, closing client connection: " << e << endl;
  59.                 portWithHandler->shutdown();
  60.             }
  61.             catch ( const DBException& e ) { // must be right above std::exception to avoid catching subclasses
  62.                 log() << "DBException handling request, closing client connection: " << e << endl;
  63.                 portWithHandler->shutdown();
  64.             }
  65.             catch ( std::exception &e ) {
  66.                 error() << "Uncaught std::exception: " << e.what() << ", terminating" << endl;
  67.                 dbexit( EXIT_UNCAUGHT );
  68.             }

  70.             // Normal disconnect path.
  71. #ifdef MONGO_SSL
  72.             SSLManagerInterface* manager = getSSLManager();
  73.             if (manager)
  74.                 manager->cleanupThreadLocals();
  75. #endif
  76.             handler->disconnected(portWithHandler.get());

  78.             return NULL;
  79.         }

9行定义了一个Message的变量m,用来接收驱动发送过来的数据，7行获取到了最终消息需要处理的一个Handler指针，22-32行，就是网络中接收数据，并对网络异常做出判断和处理。最关键的不过是handler->process(m, portWithHandler.get(), le);将收到的消息放入到handler中去处理。其实mongos已启动初始化的时候就已向MessagingPortWithHandler注册了一个ShardedMessageHandler，而从框架图中则可以看出，process函数是一个虚函数，直接调用ShardedMessageHandler::process函数中处理。此函数我们只看前面关键部分：

点击(此处)折叠或打开

  1. virtual void process( Message& m , AbstractMessagingPort* p , LastError * le) {
  2.      verify( p );
  3.      Request r( m , p );
  4.     
  5.      verify( le );
  6.      lastError.startRequest( m , le );
  7.     
  8.      try {
  9.      r.init();
  10.      r.process();
  11.      }
  12.      ......
  13.     }

首先3行创建了一个用收到的消息创建了Request对象，并在9行对r进行初始化，初始化完成之后，就在Request::process中进行处理。

点击(此处)折叠或打开

  1. void Request::process( int attempt ) {
  2.           init();
  3.           int op = _m.operation();
  4.           verify( op > dbMsg );
  5.   
  6.           int msgId = (int)(_m.header().getId());
  7.   
  8.           Timer t;
  9.           LOG(3) << "Request::process begin ns: " << getns()
  10.                  << " msg id: " << msgId
  11.                  << " op: " << op
  12.                 << " attempt: " << attempt
  13.                  << endl;
  14.  
  15.           _d.markSet();
  16.   
  17.           bool iscmd = false;
  18.           if ( op == dbKillCursors ) {
  19.               cursorCache.gotKillCursors( _m );
  20.               globalOpCounters.gotOp( op , iscmd );
  21.           }
  22.           else if ( op == dbQuery ) {
  23.               NamespaceString nss(getns());
  24.               iscmd = nss.isCommand() || nss.isSpecialCommand();
  25.   
  26.               if (iscmd) {
  27.                   int n = _d.getQueryNToReturn();
  28.                   uassert( 16978, str::stream() << "bad numberToReturn (" << n
  29.                                                 << ") for $cmd type ns - can only be 1 or -1",
  30.                           n == 1 || n == -1 );
  31.  
  32.                  STRATEGY->clientCommandOp(*this);
  33.              }
  34.               else {
  35.                   STRATEGY->queryOp( *this );
  36.               }
  37.   
  38.               globalOpCounters.gotOp( op , iscmd )
  39.           }
  40.       ...........
  41.  }

2-15行获取消息操作类型和消息ID，认证消息其实是一个查询的BSON，其操作类型为查询。所以if语句走等于opQuery分支，24行为判断其消息是否含有“$cmd”或者“$cmd.sys”,显然，此处得到iscmd为true, 那么执行  STRATEGY->clientCommandOp(*this);对于Strategy在这里作用，不就是策略模式中的”环境类”的作用，没错，这确实是一个策略模式，command定义了一组相关算法——命令执行，而CmdAuthenticate是认证命令的具体实现着， 其独立于使用它的Strategy类而变化，这就是策略模式的要义。从图可看出所有命令执行的算法都是通过run函数执行，而mongodb开发团队没有直接使用Strategy类调用run，而是通过Command:: runAgainstRegistered和Command:: execCommandClientBasic函数来调用，使得某些读者认为这不是一个策略模式。既然这里懂了那我们直接跳到CmdAuthenticate::run去看看怎么去实现认证喽。

点击(此处)折叠或打开

  1. bool CmdAuthenticate::run(OperationContext* txn, const string& dbname,
  2.                               BSONObj& cmdObj,
  3.                               int,
  4.                               string& errmsg,
  5.                               BSONObjBuilder& result,
  6.                               bool fromRepl) {

  8.         if (!serverGlobalParams.quiet) {
  9.             mutablebson::Document cmdToLog(cmdObj, mutablebson::Document::kInPlaceDisabled);
  10.             redactForLogging(&cmdToLog);
  11.             log() << " authenticate db: " << dbname << " " << cmdToLog;
  12.         }

  14.         UserName user(cmdObj.getStringField("user"), dbname);
  15.         if (Command::testCommandsEnabled &&
  16.                 user.getDB() == "admin" &&
  17.                 user.getUser() == internalSecurity.user->getName().getUser()) {
  18.             // Allows authenticating as the internal user against the admin database. This is to
  19.             // support the auth passthrough test framework on mongos (since you can‘t use the local
  20.             // database on a mongos, so you can‘t auth as the internal user without this).
  21.             user = internalSecurity.user->getName();
  22.         }

  24.         std::string mechanism = cmdObj.getStringField("mechanism");
  25.         if (mechanism.empty()) {
  26.             mechanism = "MONGODB-CR";
  27.         }
  28.         Status status = _authenticate(txn, mechanism, user, cmdObj);
  29.         audit::logAuthentication(ClientBasic::getCurrent(),
  30.                                  mechanism,
  31.                                  user,
  32.                                  status.code());
  33.        ...........
  34. }

第14行到23为获取用户名，24-25行获取认证机制，有两种一种是MONGODB-CR，还有一种是SSL，我们只看MONGODB-CR这种，然后调用CmdAuthenticate::_authenticate，而CmdAuthenticate::_authenticate转手就交给了CmdAuthenticate::_authenticateCR。

点击(此处)折叠或打开

  1. Status CmdAuthenticate::_authenticateCR(
  2.                 OperationContext* txn, const UserName& user, const BSONObj& cmdObj) {

  4.        .............

  6.         string key = cmdObj.getStringField("key");
  7.         string received_nonce = cmdObj.getStringField("nonce");

  9.         if( user.getUser().empty() || key.empty() || received_nonce.empty() ) {
  10.             sleepmillis(10);
  11.             return Status(ErrorCodes::ProtocolError,
  12.                           "field missing/wrong type in received authenticate command");
  13.         }
  14.        
  15.         ............
  16.         User* userObj;
  17.         Status status = getGlobalAuthorizationManager()->acquireUser(txn, user, &userObj);
  18.         if (!status.isOK()) {
  19.             // Failure to find the privilege document indicates no-such-user, a fact that we do not
  20.             // wish to reveal to the client. So, we return AuthenticationFailed rather than passing
  21.             // through the returned status.
  22.             return Status(ErrorCodes::AuthenticationFailed, status.toString());
  23.         }
  24.         string pwd = userObj->getCredentials().password;
  25.         getGlobalAuthorizationManager()->releaseUser(userObj);

  27.         if (pwd.empty()) {
  28.             return Status(ErrorCodes::AuthenticationFailed,
  29.                           "MONGODB-CR credentials missing in the user document");
  30.         }

  32.         md5digest d;
  33.         {
  34.             digestBuilder << user.getUser() << pwd;
  35.             string done = digestBuilder.str();

  37.             md5_state_t st;
  38.             md5_init(&st);
  39.             md5_append(&st, (const md5_byte_t *) done.c_str(), done.size());
  40.             md5_finish(&st, d);
  41.         }

  43.         string computed = digestToString( d );

  45.         if ( key != computed ) {
  46.             return Status(ErrorCodes::AuthenticationFailed, "key mismatch");
  47.         }

  49.         AuthorizationSession* authorizationSession =
  50.             ClientBasic::getCurrent()->getAuthorizationSession();
  51.         status = authorizationSession->addAndAuthorizeUser(txn, user);
  52.         if (!status.isOK()) {
  53.             return status;
  54.         }

  56.         return Status::OK();
  57.     }

6-16行，获取驱动生成的key和服务端发送给驱动的随机码，并对他们做简单的是否为空判断，第18行获取mongodb中users表中存放的用户信息，后面会详细解析此函数，得到此信息之后，25-26为获取服务器中的保存的密码信息，并且以客户端相同的方式生成digest（这里忽略了将随机码输入到digestBuilder中的代码），然后比较驱动发送过来的key和生成的computed是否相等， 相等就是认证通过，不相等说明密码错误，这就是互联网中经常用的不在网络中传输密码的认证过程。

    到这里好像还有一个问题没有解开，那就是，mongos是怎样从mongodb中获取到用户信息的，看看如下函数：

点击(此处)折叠或打开

  1. Status AuthorizationManager::acquireUser(
  2.                 OperationContext* txn, const UserName& userName, User** acquiredUser) {
  3.         .........

  5.         unordered_map<UserName, User*>::iterator it;

  7.         CacheGuard guard(this, CacheGuard::fetchSynchronizationManual);
  8.         while ((_userCache.end() == (it = _userCache.find(userName))) &&
  9.                guard.otherUpdateInFetchPhase()) {

  11.             guard.wait();
  12.         }

  14.         if (it != _userCache.end()) {
  15.             fassert(16914, it->second);
  16.             fassert(17003, it->second->isValid());
  17.             fassert(17008, it->second->getRefCount() > 0);
  18.             it->second->incrementRefCount();
  19.             *acquiredUser = it->second;
  20.             return Status::OK();
  21.         }

  23.         std::auto_ptr<User> user;

  25.         int authzVersion = _version;
  26.         guard.beginFetchPhase();

  28.         // Number of times to retry a user document that fetches due to transient
  29.         // AuthSchemaIncompatible errors. These errors should only ever occur during and shortly
  30.         // after schema upgrades.
  31.         static const int maxAcquireRetries = 2;
  32.         Status status = Status::OK();
  33.         for (int i = 0; i < maxAcquireRetries; ++i) {
  34.             if (authzVersion == schemaVersionInvalid) {
  35.                 Status status = _externalState->getStoredAuthorizationVersion(txn, &authzVersion);
  36.                 if (!status.isOK())
  37.                     return status;
  38.             }

  40.             switch (authzVersion) {
  41.             default:
  42.                 status = Status(ErrorCodes::BadValue, mongoutils::str::stream() <<
  43.                                 "Illegal value for authorization data schema version, " <<
  44.                                 authzVersion);
  45.                 break;
  46.             case schemaVersion28SCRAM:
  47.             case schemaVersion26Final:
  48.             case schemaVersion26Upgrade:
  49.                 status = _fetchUserV2(txn, userName, &user);
  50.                 break;
  51.             case schemaVersion24:
  52.                 status = Status(ErrorCodes::AuthSchemaIncompatible, mongoutils::str::stream() <<
  53.                                 "Authorization data schema version " << schemaVersion24 <<
  54.                                 " not supported after MongoDB version 2.6.");
  55.                 break;
  56.             }
  57.             if (status.isOK())
  58.                 break;
  59.             if (status != ErrorCodes::AuthSchemaIncompatible)
  60.                 return status;

  62.             authzVersion = schemaVersionInvalid;
  63.         }
  64.         if (!status.isOK())
  65.             return status;

  67.         guard.endFetchPhase();

  69.         user->incrementRefCount();
  70.         // NOTE: It is not safe to throw an exception from here to the end of the method.
  71.         if (guard.isSameCacheGeneration()) {
  72.             _userCache.insert(std::make_pair(userName, user.get()));
  73.             if (_version == schemaVersionInvalid)
  74.                 _version = authzVersion;
  75.         }
  76.         else {
  77.             // If the cache generation changed while this thread was in fetch mode, the data
  78.             // associated with the user may now be invalid, so we must mark it as such. The caller
  79.             // may still opt to use the information for a short while, but not indefinitely.
  80.             user->invalidate();
  81.         }
  82.         *acquiredUser = user.release();

  84.         return Status::OK();
  85.     }

第7-12行，首先定一个护卫类CacheGuard，其作用是进入此区域后，只能是单线程操作，并手工加载用户数据，首先从本地缓存中查找是否包含有此用户的数据，如果没有，就调用AuthzManagerExternalStateMongos::getStoredAuthorizationVersion函数获取所有的用户信息，不要被函数名欺骗，是获取该用户存在磁盘上的所有用户信息，并加入缓存，此过程不成功会重复2次，最后通过_fetchUserV2解析获取到的用户信息，我所用的代码是2.8版本，不支持2.4以前的解析过程，只支持2.6版本后的。到此认证过程全部解析完毕。
注意：其实此过程还使用到了一个命令模式，就是在收到消息之后，到消息到Command的处理过程，请读者自行体会。








mongodb认证源码分析——使用策略模式，网络不传输密码

原文：http://blog.chinaunix.net/uid-26904464-id-4781857.html
踩
(0)
赞
(0)
   
举报
评论 一句话评论（0）
分享档案
更多>
2021年09月23日 (328)
2021年09月24日 (313)
2021年09月17日 (191)
2021年09月15日 (369)
2021年09月16日 (411)
2021年09月13日 (439)
2021年09月11日 (398)
2021年09月12日 (393)
2021年09月10日 (160)
2021年09月08日 (222)
最新文章
更多>
教程昨日排行
更多>
友情链接
汇智网   PHP教程   插件网  
关于我们 - 联系我们 - 留言反馈 - 联系我们:wmxa8@hotmail.com
© 2014 bubuko.com 版权所有
打开技术之扣，分享程序人生！