feat: secure internal gRPC with JWT

go.mod

@@ -26,6 +26,7 @@ require (
 	github.com/go-gorm/caches/v4 v4.0.5
 	github.com/go-http-utils/headers v0.0.0-20181008091004-fed159eddc2a
 	github.com/go-playground/validator/v10 v10.30.3
+	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/go-redis/cache/v9 v9.0.0
 	github.com/go-redis/redis_rate/v10 v10.0.1
 	github.com/go-redis/redismock/v9 v9.2.0
@@ -126,7 +127,6 @@ require (
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/goccy/go-json v0.10.6 // indirect
 	github.com/goccy/go-yaml v1.19.2 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
 	github.com/golang-sql/sqlexp v0.1.0 // indirect
 	github.com/golang/mock v1.6.0 // indirect

manager/config/config.go

@@ -26,6 +26,7 @@ import (
 
 	"d7y.io/dragonfly/v2/cmd/dependency/base"
 	"d7y.io/dragonfly/v2/pkg/net/ip"
+	grpcauth "d7y.io/dragonfly/v2/pkg/rpc/auth/jwt"
 	"d7y.io/dragonfly/v2/pkg/types"
 )
 
@@ -39,6 +40,9 @@ type Config struct {
 	// Auth configuration.
 	Auth AuthConfig `yaml:"auth" mapstructure:"auth"`
 
+	// GRPCAuth is the inter-component gRPC authentication configuration.
+	GRPCAuth grpcauth.Config `yaml:"grpcAuth" mapstructure:"grpcAuth"`
+
 	// Database configuration.
 	Database DatabaseConfig `yaml:"database" mapstructure:"database"`
 
@@ -441,6 +445,7 @@ func New() *Config {
 				MaxRefresh: DefaultJWTMaxRefresh,
 			},
 		},
+		GRPCAuth: grpcauth.DefaultConfig(),
 		Database: DatabaseConfig{
 			Type: DatabaseTypeMysql,
 			Mysql: MysqlConfig{
@@ -533,6 +538,10 @@ func (cfg *Config) Validate() error {
 		return errors.New("grpc requires parameter requestRateLimit")
 	}
 
+	if err := grpcauth.ValidateConfig(cfg.GRPCAuth); err != nil {
+		return err
+	}
+
 	if cfg.Server.REST.TLS != nil {
 		if cfg.Server.REST.TLS.Cert == "" {
 			return errors.New("rest tls requires parameter cert")

manager/config/config_test.go

@@ -24,6 +24,8 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"gopkg.in/yaml.v3"
+
+	grpcauth "d7y.io/dragonfly/v2/pkg/rpc/auth/jwt"
 )
 
 var (
@@ -127,6 +129,22 @@ func TestConfig_Load(t *testing.T) {
 				MaxRefresh: 1 * time.Minute,
 			},
 		},
+		GRPCAuth: grpcauth.Config{
+			Mode:                     grpcauth.ModeRequired,
+			RequireTransportSecurity: true,
+			JWT: grpcauth.JWTConfig{
+				Issuer:        "dragonfly-test",
+				TokenTTL:      10 * time.Minute,
+				MaxTokenTTL:   15 * time.Minute,
+				ClockSkew:     30 * time.Second,
+				RefreshBefore: time.Minute,
+				ActiveKeyID:   "test-key",
+				Keys: []grpcauth.KeyConfig{{
+					ID:         "test-key",
+					SecretFile: "/etc/dragonfly/secrets/grpc-jwt/test-key",
+				}},
+			},
+		},
 		Database: DatabaseConfig{
 			Type: "mysql",
 			Mysql: MysqlConfig{
@@ -262,6 +280,16 @@ func TestConfig_Validate(t *testing.T) {
 				assert.EqualError(err, "server requires parameter name")
 			},
 		},
+		{
+			name:   "grpc auth rejects unsupported mode",
+			config: New(),
+			mock: func(cfg *Config) {
+				cfg.GRPCAuth.Mode = "unknown"
+			},
+			expect: func(t *testing.T, err error) {
+				assert.EqualError(t, err, `grpc auth has unsupported mode "unknown"`)
+			},
+		},
 		{
 			name:   "grpc requires parameter advertiseIP",
 			config: New(),

manager/config/testdata/manager.yaml

@@ -30,6 +30,20 @@ auth:
     timeout: 30s
     maxRefresh: 1m
 
+grpcAuth:
+  mode: required
+  requireTransportSecurity: true
+  jwt:
+    issuer: dragonfly-test
+    tokenTTL: 10m
+    maxTokenTTL: 15m
+    clockSkew: 30s
+    refreshBefore: 1m
+    activeKeyID: test-key
+    keys:
+      - id: test-key
+        secretFile: /etc/dragonfly/secrets/grpc-jwt/test-key
+
 database:
   type: mysql
   mysql:

manager/manager.go

@@ -46,6 +46,7 @@ import (
 	pkggc "d7y.io/dragonfly/v2/pkg/gc"
 	"d7y.io/dragonfly/v2/pkg/redis"
 	"d7y.io/dragonfly/v2/pkg/rpc"
+	grpcauth "d7y.io/dragonfly/v2/pkg/rpc/auth/jwt"
 )
 
 const (
@@ -113,6 +114,11 @@ type Server struct {
 // New creates a new manager server.
 func New(cfg *config.Config, d dfpath.Dfpath) (*Server, error) {
 	s := &Server{config: cfg}
+	authenticator, err := grpcauth.New(cfg.GRPCAuth)
+	if err != nil {
+		return nil, err
+	}
+	logger.Infof("initialized gRPC authentication with mode %s", authenticator.Mode())
 
 	// Initialize database.
 	db, err := database.New(cfg)
@@ -189,7 +195,7 @@ func New(cfg *config.Config, d dfpath.Dfpath) (*Server, error) {
 	}
 
 	// Initialize GRPC server.
-	_, grpcServer, err := rpcserver.New(cfg, db, cache, searcher, options...)
+	_, grpcServer, err := rpcserver.NewWithAuthentication(cfg, authenticator, db, cache, searcher, options...)
 	if err != nil {
 		return nil, err
 	}

manager/rpcserver/rpcserver.go

@@ -26,6 +26,7 @@ import (
 	"d7y.io/dragonfly/v2/manager/database"
 	"d7y.io/dragonfly/v2/manager/models"
 	"d7y.io/dragonfly/v2/manager/searcher"
+	grpcauth "d7y.io/dragonfly/v2/pkg/rpc/auth/jwt"
 	managerserver "d7y.io/dragonfly/v2/pkg/rpc/manager/server"
 )
 
@@ -51,6 +52,14 @@ type Server struct {
 func New(
 	cfg *config.Config, database *database.Database, cache *cache.Cache, searcher searcher.Searcher,
 	opts ...grpc.ServerOption) (*Server, *grpc.Server, error) {
+	return NewWithAuthentication(cfg, nil, database, cache, searcher, opts...)
+}
+
+// NewWithAuthentication returns a new manager server with inter-component JWT
+// authentication.
+func NewWithAuthentication(
+	cfg *config.Config, authenticator *grpcauth.Authenticator, database *database.Database, cache *cache.Cache, searcher searcher.Searcher,
+	opts ...grpc.ServerOption) (*Server, *grpc.Server, error) {
 	s := &Server{
 		config:   cfg,
 		db:       database.DB,
@@ -59,10 +68,11 @@ func New(
 		searcher: searcher,
 	}
 
-	return s, managerserver.New(
+	return s, managerserver.NewWithAuthentication(
 		newManagerServerV1(s.config, database, s.cache, s.searcher),
 		newManagerServerV2(s.config, database, s.cache, s.searcher),
 		cfg.Server.GRPC.RequestRateLimit,
+		authenticator,
 		opts...), nil
 }