From 5e5ce27df7fa18bd300aabe8eeeadfaddf9f3e55 Mon Sep 17 00:00:00 2001 From: Aliaksandr Valialkin Date: Tue, 14 Sep 2021 12:17:49 +0300 Subject: [PATCH] app/vmauth: do not log invalid auth tokens by default for security reasons The logging can be enabled by passing `-logInvalidAuthTokens` command-line flag to vmauth --- app/vmauth/README.md | 2 ++ app/vmauth/main.go | 17 +++++++++++++++-- app/vmauth/target_url.go | 1 + docs/CHANGELOG.md | 1 + docs/vmauth.md | 2 ++ 5 files changed, 21 insertions(+), 2 deletions(-) diff --git a/app/vmauth/README.md b/app/vmauth/README.md index 2918823ad4..574dee7b46 100644 --- a/app/vmauth/README.md +++ b/app/vmauth/README.md @@ -230,6 +230,8 @@ See the docs at https://docs.victoriametrics.com/vmauth.html . Username for HTTP Basic Auth. The authentication is disabled if empty. See also -httpAuth.password -httpListenAddr string TCP address to listen for http connections (default ":8427") + -logInvalidAuthTokens + Whether to log requests with invalid auth tokens. Such requests are always counted at vmagent_http_request_errors_total{reason="invalid_auth_token"} metric, which is exposed at /metrics page -loggerDisableTimestamps Whether to disable writing timestamps in logs -loggerErrorsPerSecondLimit int diff --git a/app/vmauth/main.go b/app/vmauth/main.go index b12672fccb..e1b282bec5 100644 --- a/app/vmauth/main.go +++ b/app/vmauth/main.go @@ -2,6 +2,7 @@ package main import ( "flag" + "fmt" "net/http" "net/http/httputil" "net/url" @@ -21,6 +22,8 @@ var ( httpListenAddr = flag.String("httpListenAddr", ":8427", "TCP address to listen for http connections") maxIdleConnsPerBackend = flag.Int("maxIdleConnsPerBackend", 100, "The maximum number of idle connections vmauth can open per each backend host") reloadAuthKey = flag.String("reloadAuthKey", "", "Auth key for /-/reload http endpoint. It must be passed as authKey=...") + logInvalidAuthTokens = flag.Bool("logInvalidAuthTokens", false, "Whether to log requests with invalid auth tokens. "+ + `Such requests are always counted at vmagent_http_request_errors_total{reason="invalid_auth_token"} metric, which is exposed at /metrics page`) ) func main() { @@ -71,7 +74,13 @@ func requestHandler(w http.ResponseWriter, r *http.Request) bool { ac := authConfig.Load().(map[string]*UserInfo) ui := ac[authToken] if ui == nil { - httpserver.Errorf(w, r, "cannot find the provided auth token %q in config", authToken) + invalidAuthTokenRequests.Inc() + if *logInvalidAuthTokens { + httpserver.Errorf(w, r, "cannot find the provided auth token %q in config", authToken) + } else { + errStr := fmt.Sprintf("cannot find the provided auth token %q in config", authToken) + http.Error(w, errStr, http.StatusBadRequest) + } return true } ui.requests.Inc() @@ -99,7 +108,11 @@ func proxyRequest(w http.ResponseWriter, r *http.Request) { reverseProxy.ServeHTTP(w, r) } -var configReloadRequests = metrics.NewCounter(`vmagent_http_requests_total{path="/-/reload"}`) +var ( + configReloadRequests = metrics.NewCounter(`vmagent_http_requests_total{path="/-/reload"}`) + invalidAuthTokenRequests = metrics.NewCounter(`vmagent_http_request_errors_total{reason="invalid_auth_token"}`) + missingRouteRequests = metrics.NewCounter(`vmagent_http_request_errors_total{reason="missing_route"}`) +) var reverseProxy = &httputil.ReverseProxy{ Director: func(r *http.Request) { diff --git a/app/vmauth/target_url.go b/app/vmauth/target_url.go index 2e8817f8d7..cffadba9d5 100644 --- a/app/vmauth/target_url.go +++ b/app/vmauth/target_url.go @@ -53,5 +53,6 @@ func createTargetURL(ui *UserInfo, uOrig *url.URL) (*url.URL, error) { if ui.URLPrefix != nil { return ui.URLPrefix.mergeURLs(&u), nil } + missingRouteRequests.Inc() return nil, fmt.Errorf("missing route for %q", u.String()) } diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 00532362b7..b7fe9a9105 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -18,6 +18,7 @@ sort: 15 * FEATURE: vmagent: reduce CPU usage when calculating the number of newly added series per scrape (this number is sent to remote storage in `scrape_series_added` metric). * FEATURE: vmagent: reduce CPU usage when applying `series_limit` to scrape targets with constant set of metrics. See more information about `series_limit` [here](https://docs.victoriametrics.com/vmagent.html#cardinality-limiter). * FEATURE: vminsert: disable rerouting by default when a few of `vmstorage` nodes start accepting data at lower speed than the rest of `vmstorage` nodes. This should improve VictoriaMetrics cluster stability during rolling restarts and during spikes in [time series churn rate](https://docs.victoriametrics.com/FAQ.html#what-is-high-churn-rate). The rerouting can be enabled by passing `-disableRerouting=false` command-line flag to `vminsert`. +* FEATURE: vmauth: do not put invalid auth tokens into log by default due to security reasons. The logging can be returned back by passing `-logInvalidAuthTokens` command-line flag to `vmauth`. Requests with invalid auth tokens are counted at `vmagent_http_request_errors_total{reason="invalid_auth_token"}` metric exposed by `vmauth` at `/metrics` page. * BUGFIX: properly handle queries with multiple filters matching empty labels such as `metric{label1=~"foo|",label2="bar|"}`. This filter must match the following series: `metric`, `metric{label1="foo"}`, `metric{label2="bar"}` and `metric{label1="foo",label2="bar"}`. Previously it was matching only `metric{label1="foo",label2="bar"}`. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/1601). * BUGFIX: vmselect: reset connection timeouts after each request to `vmstorage`. This should prevent from `cannot read data in 0.000 seconds: unexpected EOF` warning in logs. See [this issue](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/1562). Thanks to @mxlxm . diff --git a/docs/vmauth.md b/docs/vmauth.md index 1cb2fa4f79..673bfcbf0b 100644 --- a/docs/vmauth.md +++ b/docs/vmauth.md @@ -234,6 +234,8 @@ See the docs at https://docs.victoriametrics.com/vmauth.html . Username for HTTP Basic Auth. The authentication is disabled if empty. See also -httpAuth.password -httpListenAddr string TCP address to listen for http connections (default ":8427") + -logInvalidAuthTokens + Whether to log requests with invalid auth tokens. Such requests are always counted at vmagent_http_request_errors_total{reason="invalid_auth_token"} metric, which is exposed at /metrics page -loggerDisableTimestamps Whether to disable writing timestamps in logs -loggerErrorsPerSecondLimit int