Enterprise - Support reading a signed file with details of Enterprise license

dgraph/cmd/alpha/admin_backup.go

@@ -42,10 +42,9 @@ func backupHandler(w http.ResponseWriter, r *http.Request) {
 	if !handlerInit(w, r, http.MethodPost) {
 		return
 	}
-	if !Alpha.Conf.GetBool("enterprise_features") {
-		x.SetStatus(w,
-			"You must enable Dgraph enterprise features first. "+
-				"Restart Dgraph Alpha with --enterprise_features",
+	if !worker.EnterpriseEnabled() {
+		x.SetStatus(w, "You must enable enterprise features first. "+
+			"Supply the appropriate license file to Dgraph Zero using a flag or the HTTP endpoint.",
 			"Backup failed.")
 		return
 	}

dgraph/cmd/alpha/run.go

@@ -93,8 +93,6 @@ they form a Raft group and provide synchronous replication.
 	// with the flag name so that the values are picked up by Cobra/Viper's various config inputs
 	// (e.g, config file, env vars, cli flags, etc.)
 	flag := Alpha.Cmd.Flags()
-	flag.Bool("enterprise_features", false, "Enable Dgraph enterprise features. "+
-		"If you set this to true, you agree to the Dgraph Community License.")
 	flag.StringP("postings", "p", "p", "Directory to store posting lists.")
 
 	// Options around how to set up Badger.
@@ -435,11 +433,6 @@ func run() {
 
 	secretFile := Alpha.Conf.GetString("acl_secret_file")
 	if secretFile != "" {
-		if !Alpha.Conf.GetBool("enterprise_features") {
-			glog.Fatalf("You must enable Dgraph enterprise features with the " +
-				"--enterprise_features option in order to use ACL.")
-		}
-
 		hmacSecret, err := ioutil.ReadFile(secretFile)
 		if err != nil {
 			glog.Fatalf("Unable to read HMAC secret from file: %v", secretFile)

dgraph/cmd/zero/http.go

@@ -17,8 +17,10 @@
 package zero
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"net/http"
 	"strconv"
@@ -232,6 +234,38 @@ func (st *state) getState(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+// applyEnterpriseLicense accepts a PGP message as a POST request body, verifies that it was
+// signed using our private key and applies the license which has maxNodes and Expiry to the
+// cluster.
+func (st *state) applyEnterpriseLicense(w http.ResponseWriter, r *http.Request) {
+	x.AddCorsHeaders(w)
+	if r.Method == "OPTIONS" {
+		return
+	}
+	if r.Method != http.MethodPost {
+		w.WriteHeader(http.StatusBadRequest)
+		x.SetStatus(w, x.ErrorInvalidMethod, "Invalid method")
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	b, err := ioutil.ReadAll(r.Body)
+	if err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		x.SetStatus(w, x.ErrorInvalidRequest, err.Error())
+		return
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Minute)
+	defer cancel()
+	if err := st.zero.applyEnterpriseLicense(ctx, bytes.NewReader(b)); err != nil {
+		w.WriteHeader(http.StatusBadRequest)
+		x.SetStatus(w, x.ErrorInvalidRequest, err.Error())
+		return
+	}
+	x.SetStatus(w, x.Success, "Done")
+}
+
 func (st *state) serveHTTP(l net.Listener) {
 	srv := &http.Server{
 		ReadTimeout:  10 * time.Second,

dgraph/cmd/zero/pgp.go

@@ -0,0 +1,125 @@
+/*
+ * Copyright 2017-2018 Dgraph Labs, Inc. and Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package zero
+
+import (
+	"encoding/json"
+	"io"
+	"io/ioutil"
+
+	"github.com/pkg/errors"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/armor"
+)
+
+const publicKey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBF1T7lcBEADmxqS4gowV74h92QVehIchRkkZ74uQgFDQUPhs89vf5EvCci8m
+LJYrsrBrDBQESjw+jQVQumtSnXqUIcVdumG80Nkgg01JuANOtqRs0vfd2P4piqxp
+VCGrBATl0+9PrlQn/e8x6V449HLUeAx8jxML/us08RFzbLYoIFEnBdwbIJDfW6tl
+CPS02Nj3ZW83crRCwyNjkSrSNt/TW5hVdYYveBe4urtJJgd/HWoytwHygtDIz5oc
+ZjWMQxPXs2e0pYCTSCeqOOUu1LR7K6sHrhgYu1xMq3F8Vr9oqH5ZnwwydYd4GWQg
+VfZEb/suXc9raxCcvIU5R32IHrfbFL5NQB9Cv9LxS4/13eoaIQ77eNJb0HYzo2CB
+z88pidYGFuRzb6nkvi641XsBux0ox+4jXZJW6n83hsTc2Gjbo1JQZXU+3PbcMj8i
+iWTwoDtev9uIFFWsSCGLulQVYH+0cdiBvmR0Jfb5JkE7d69+F7//AVD5Zcs6fnn3
+kKNomPF4v9ujQEBh7SGSZCxDHwGL/wrs1ajRiwbTehjgFi1S3BIvE5LdbNzbVAJP
+5p/eXgJfStI8vOTsvtsZDxskz2JbxmNBC3vfQqdmms8Vs764BVrtg77YLqCkhRsZ
+g47sBiRnffXBAoM3zR+gTAkl47hUP/GJXc/wXz9RWxa8jb1fHpUHqh4prQARAQAB
+tB9EZ3JhcGggTGFicyA8Y29udGFjdEBkZ3JhcGguaW8+iQJOBBMBCgA4FiEElb71
+YXoTIYk1CVfE2dE672U82kUFAl1T7lcCGwMFCwkIBwIGFQoJCAsCBBYCAwECHgEC
+F4AACgkQ2dE672U82kWzLxAArQ50WlEy/8FE7X5I5pG6r1zM00kTHQDTfGP62/fF
+H4IisQnaZsCOA6jNqIKx67bqIVCAGg+8xPf2jUhgFc+KlNV9FffLBD8xXB/SiDMM
+M045wR9Ob1Zk691T7u+Fsgo+c9d/XFPcAgfP2hpIG/AH39JZaVbS04faa8v2kV9+
+mMZPlop+9dG8rpr4HBm4z054lLc0RIAv9bSmr7YMPv8r61PK1En6PDXszKyobkP2
+LkcM8DHAimZiIHvPhY5/wbCVFEig0oxZv975lP6cczhbESagR06kjZQZAu5Kh3Cb
+H+EFfhvSZ9m4pLwId5j1MpNiVJxR4mKsVyTgooiQuBmnCS0c6aOWEBx+heZfnE/O
+HKXVtbJnJqnc4kismi7ccBlycoONKy3s1Aewkm4NKnr0eB3ciWCVpqQjieA1u6Kt
+bdVMtRj7jTIh47X8khrI6k/asCOz2I4r0ZtoU4SR+/tiSkhRpG2PLpss/Jlv0SrB
+mKSto7IStD5xDKCxheOsTxZnP9vzeD9N78JH8tyxHJPld4wwcn5VJlWVDv8SauMW
+m/JPuE1BX/h4Zy51HH8g3u8EgKV9EMngWU4oF+kcv7px14Cwkk3wH4ebHPixhMHj
+jzNNm6rISGv2CWVVOQcLN2euzbJkWRQ9zWjBnkUL3ILw8JDUIdsTEufzSVGvYMCe
+eMe5Ag0EXVPuVwEQAKOtFT53vLqGPAu6XLHWzf+zf8ikzJ4hE0i+zNQ4vBV7jGRY
+45GsLWtziIq8dJnVlHJZ5FudcWdiUKNokO83MVV88H8bbgF4MF6/lZQrqV9a/NEI
+zEZ5WIKQtFBTXe2HjIgdoJjiRarIVQ3UE7NAoMRoY36btKQKURf3CLcjMpa2a9RK
+AWNt+Y0LqFjjJc5/0zlpV/hnBb7ARdHEXOanzmp5c2w75lf1eL8mAMI/gCMJ5IrX
+fA7R1uWgZzVOW38bl8WEfT+z2Be6vy06EEz7NS9c9VvnC7FAguOjEU+fSIDut45S
+lrSAiQzkNljHRPif6hMsbcUrYeNSH8TLI42j51WkszK0bpB0fpZSH+tcNzx1S0MR
+ESsf1FncgMVRdQDJMeXe7yNgxpwp7ir1aOXZvX/sN+1CwGNh3hNLFqMo1yenec/x
+27MitsJOfrHJ6g8ibOsDNOBZxRGQbpBikaHSnDcScA88r2+Yia8BXegxLsvZjWZO
+Uy5DVOxesNAlWLh/q11djREfrOQOVuPaR4rviaJ4j324Hx8AP0rerRnP0/RUu3Xj
+9/kOE0sOcXskolyVUOdN7/6OfGX+XwVtwQfrVZZ1yhRnSJi/M4tPHHRWrfzvElfT
+LiOVZIoQNGC9LDYp2kif3zDtOzOwgyFcYnxbO5raL9Wy4+M8Inwjjt/vPnKVABEB
+AAGJAjYEGAEKACAWIQSVvvVhehMhiTUJV8TZ0TrvZTzaRQUCXVPuVwIbDAAKCRDZ
+0TrvZTzaRa0eD/9d1jb6zcihpD3E5YD6nNtREJF3fvDuTPLRRM1oGQ8nl7Jr3654
+ss5buPOgroFEJzp52fKDHyYpQlHn2PPrL9GGTQcTVof8MkYmgcMn9g+/2IBk9bfB
+YVs/N3GVOgD8DpVocdavI41p7CIDkvyiFHRjQyZqd+lmWKdPd0TlPd6UPqAuJDdP
+cKCpJIabo8RVVzwI7dRrveewO1sFWyEdE3uhLS35l4aZ5nMHsIpDLoZkf474k6bl
+KYDSEe/+qCgTak0Ol1Q9uV0jQcFhWnVq8eObBb/aZ5SkmLAPnlnr5TMJ2a6xMRUS
+fXxKSGuBcilhgpRnh6Lq01dYTRVKljxq8BbS9wK7d75ORKJlFAugBSOgujb5whG+
+hEaQQos8sHDOEka0KbCkTurYHt5+0enwFMCCbWQIT5z+j46yyAO9Om9p+M4H9qV7
+INbe2kxJPareejuWnf9Xy2FVzgO+7YGZmxiSrHurRBoZO8KNvjib23mUXVJOKMVB
+6gIZciMNVJ3HYTajtExS94eguukL9g+mAMSgRttNM6xlkJRCnzx55ie1VQ4kYhVR
+wbAzcSLeovdXC7FaCKtBRgsY/kDmnxJ6qlWzcbOJQ4FlRnHtGQSqFBPUUQVJuuMB
+zaY83TVDscYMz42G7eZ2skRZ8R6Rsm1jNIWeBwGKAc2y3o1vMaXJlmui2g==
+=9fdK
+-----END PGP PUBLIC KEY BLOCK-----`
+
+// verifySignature verifies the signature given a public key. It also JSON unmarshals the details
+// of the license and stores them in l.
+func verifySignature(signedFile, publicKey io.Reader, l *license) error {
+	entityList, err := openpgp.ReadArmoredKeyRing(publicKey)
+	if err != nil {
+		return errors.Wrapf(err, "while reading public key")
+	}
+
+	// The signed file is expected to be have ASCII encoding, so we have to decode it before
+	// reading.
+	b, err := armor.Decode(signedFile)
+	if err != nil {
+		return errors.Wrapf(err, "while decoding license file")
+	}
+
+	md, err := openpgp.ReadMessage(b.Body, entityList, nil, nil)
+	if err != nil {
+		return errors.Wrapf(err, "while reading PGP message from license file")
+	}
+
+	// We need to read the body for the signature verification check to happen.
+	// md.Signature would be non-nil after reading the body if the verification is successfull.
+	buf, err := ioutil.ReadAll(md.UnverifiedBody)
+	if err != nil {
+		return errors.Wrapf(err, "while reading body from signed license file")
+	}
+	// This could be nil even if signature verification failed, so we also check Signature == nil
+	// below.
+	if md.SignatureError != nil {
+		return errors.Wrapf(md.SignatureError,
+			"signature error while trying to verify license file")
+	}
+	if md.Signature == nil {
+		return errors.New("invalid signature while trying to verify license file")
+	}
+
+	err = json.Unmarshal(buf, l)
+	if err != nil {
+		return errors.Wrapf(err, "while JSON unmarshaling body of license file")
+	}
+	if l.User == "" || l.MaxNodes == 0 || l.Expiry.IsZero() {
+		return errors.Errorf("invalid JSON data, fields shouldn't be zero: %+v\n", l)
+	}
+	return nil
+}

dgraph/cmd/zero/pgp_test.go

@@ -0,0 +1,124 @@
+package zero
+
+import (
+	"bytes"
+	"crypto"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/armor"
+	"golang.org/x/crypto/openpgp/packet"
+)
+
+func encodePublicKey(t *testing.T, e *openpgp.Entity) *bytes.Buffer {
+	b := new(bytes.Buffer)
+	encodedKeyBuf, err := armor.Encode(b, openpgp.PublicKeyType, nil)
+	require.NoError(t, err)
+	err = e.Serialize(encodedKeyBuf)
+	require.NoError(t, err)
+	err = encodedKeyBuf.Close()
+	require.NoError(t, err)
+	return b
+}
+
+func signAndWriteMessage(t *testing.T, entity *openpgp.Entity, json string) *bytes.Buffer {
+	b := new(bytes.Buffer)
+	w, err := openpgp.Sign(b, entity, nil, &packet.Config{
+		RSABits:     4096,
+		DefaultHash: crypto.SHA512,
+	})
+	require.NoError(t, err)
+
+	_, err = w.Write([]byte(json))
+	require.NoError(t, err)
+
+	err = w.Close()
+	require.NoError(t, err)
+
+	// armor encode the message
+	abuf := new(bytes.Buffer)
+	w, err = armor.Encode(abuf, "PGP MESSAGE", nil)
+	_, err = w.Write(b.Bytes())
+	require.NoError(t, err)
+
+	err = w.Close()
+	require.NoError(t, err)
+
+	return abuf
+}
+
+func TestEnterpriseDetails(t *testing.T) {
+	correctEntity, err := openpgp.NewEntity("correct", "", "[email protected]", &packet.Config{
+		RSABits:     4096,
+		DefaultHash: crypto.SHA512,
+	})
+
+	require.NoError(t, err)
+	incorrectEntity, err := openpgp.NewEntity("incorrect", "", "[email protected]", &packet.Config{
+		RSABits:     4096,
+		DefaultHash: crypto.SHA512,
+	})
+	require.NoError(t, err)
+	correctJSON := `{"entity": "entity", "max_nodes": 10, "expiry": "2019-08-16T19:09:06+10:00"}`
+	correctTime, err := time.Parse(time.RFC3339, "2019-08-16T19:09:06+10:00")
+	require.NoError(t, err)
+
+	var tests = []struct {
+		name            string
+		signingEntity   *openpgp.Entity
+		json            string
+		verifyingEntity *openpgp.Entity
+		expectError     bool
+		expectedOutput  license
+	}{
+		{
+			"Signing JSON with empty data should return an error",
+			correctEntity,
+			`{}`,
+			correctEntity,
+			true,
+			license{},
+		},
+		{
+			"Signing JSON with incorrect private key should return an error",
+			incorrectEntity,
+			correctJSON,
+			correctEntity,
+			true,
+			license{},
+		},
+		{
+			"Verifying data with incorrect public key should return an error",
+			correctEntity,
+			correctJSON,
+			incorrectEntity,
+			true,
+			license{},
+		},
+		{
+			"Verifying data with correct public key should return correct data",
+			correctEntity,
+			correctJSON,
+			correctEntity,
+			false,
+			license{"entity", 10, correctTime},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Logf("Running: %s\n", tt.name)
+		buf := signAndWriteMessage(t, tt.signingEntity, tt.json)
+		e := license{}
+		publicKey := encodePublicKey(t, tt.verifyingEntity)
+		err = verifySignature(buf, publicKey, &e)
+		if tt.expectError {
+			require.Error(t, err)
+			continue
+		}
+
+		require.NoError(t, err)
+		require.Equal(t, tt.expectedOutput, e)
+	}
+}