8debdc1501
The strategy of hex encoding a random byte array only uses the following characters: 0123456789abcdef Instead of the entire bootstrapping token character set: 0123456789abcdefghijklmnopqrstuvwxyz Update the token generation to use the entire character set. This increases the token secret from 48 bits of entropy to ~82 bits. 256^8 (1.8e+19) vs. 36^16 (7.9e+24).
126 lines
3.6 KiB
Go
126 lines
3.6 KiB
Go
/*
|
|
Copyright 2017 The Kubernetes Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package token
|
|
|
|
import (
|
|
"bufio"
|
|
"crypto/rand"
|
|
"fmt"
|
|
"regexp"
|
|
|
|
kubeadmapi "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm"
|
|
)
|
|
|
|
const (
|
|
// TokenIDBytes defines a number of bytes used for a token id
|
|
TokenIDBytes = 6
|
|
// TokenSecretBytes defines a number of bytes used for a secret
|
|
TokenSecretBytes = 16
|
|
)
|
|
|
|
var (
|
|
// TokenIDRegexpString defines token's id regular expression pattern
|
|
TokenIDRegexpString = "^([a-z0-9]{6})$"
|
|
// TokenIDRegexp is a compiled regular expression of TokenIDRegexpString
|
|
TokenIDRegexp = regexp.MustCompile(TokenIDRegexpString)
|
|
// TokenRegexpString defines id.secret regular expression pattern
|
|
TokenRegexpString = "^([a-z0-9]{6})\\.([a-z0-9]{16})$"
|
|
// TokenRegexp is a compiled regular expression of TokenRegexpString
|
|
TokenRegexp = regexp.MustCompile(TokenRegexpString)
|
|
)
|
|
|
|
const validBootstrapTokenChars = "0123456789abcdefghijklmnopqrstuvwxyz"
|
|
|
|
func randBytes(length int) (string, error) {
|
|
// len("0123456789abcdefghijklmnopqrstuvwxyz") = 36 which doesn't evenly divide
|
|
// the possible values of a byte: 256 mod 36 = 4. Discard any random bytes we
|
|
// read that are >= 252 so the bytes we evenly divide the character set.
|
|
const maxByteValue = 252
|
|
|
|
var (
|
|
b byte
|
|
err error
|
|
token = make([]byte, length)
|
|
)
|
|
|
|
reader := bufio.NewReaderSize(rand.Reader, length*2)
|
|
for i := range token {
|
|
for {
|
|
if b, err = reader.ReadByte(); err != nil {
|
|
return "", err
|
|
}
|
|
if b < maxByteValue {
|
|
break
|
|
}
|
|
}
|
|
|
|
token[i] = validBootstrapTokenChars[int(b)%len(validBootstrapTokenChars)]
|
|
}
|
|
|
|
return string(token), nil
|
|
}
|
|
|
|
// GenerateToken generates a new token with a token ID that is valid as a
|
|
// Kubernetes DNS label.
|
|
// For more info, see kubernetes/pkg/util/validation/validation.go.
|
|
func GenerateToken() (string, error) {
|
|
tokenID, err := randBytes(TokenIDBytes)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
tokenSecret, err := randBytes(TokenSecretBytes)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
|
|
return fmt.Sprintf("%s.%s", tokenID, tokenSecret), nil
|
|
}
|
|
|
|
// ParseTokenID tries and parse a valid token ID from a string.
|
|
// An error is returned in case of failure.
|
|
func ParseTokenID(s string) error {
|
|
if !TokenIDRegexp.MatchString(s) {
|
|
return fmt.Errorf("token ID [%q] was not of form [%q]", s, TokenIDRegexpString)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ParseToken tries and parse a valid token from a string.
|
|
// A token ID and token secret are returned in case of success, an error otherwise.
|
|
func ParseToken(s string) (string, string, error) {
|
|
split := TokenRegexp.FindStringSubmatch(s)
|
|
if len(split) != 3 {
|
|
return "", "", fmt.Errorf("token [%q] was not of form [%q]", s, TokenRegexpString)
|
|
}
|
|
return split[1], split[2], nil
|
|
}
|
|
|
|
// BearerToken returns a string representation of the passed token.
|
|
func BearerToken(d *kubeadmapi.TokenDiscovery) string {
|
|
return fmt.Sprintf("%s.%s", d.ID, d.Secret)
|
|
}
|
|
|
|
// ValidateToken validates whether a token is well-formed.
|
|
// In case it's not, the corresponding error is returned as well.
|
|
func ValidateToken(d *kubeadmapi.TokenDiscovery) (bool, error) {
|
|
if _, _, err := ParseToken(d.ID + "." + d.Secret); err != nil {
|
|
return false, err
|
|
}
|
|
return true, nil
|
|
}
|