Varnish Summit, 2016

2. Access Control

3. Access Control
• IP-based access
• Basic auth
• Various cookie based access controls

4. IP-based ACLs
# Who is allowed to purge....
acl local {
"localhost";
"192.168.1.0"/24; /* and everyone on the local network */
! "192.168.1.23"; /* except for the dialin router */
}
sub vcl_recv {
if (req.method == "PURGE") {
if (client.ip ~ local) {
return(purge);
} else {
return(synth(403, "Access denied."));
}
}
}

5. Basic Auth
• Not really used
• There is aVMOD for that

6. Cookie based auth
• Generate random cookie
• Issue a cookie to a client
• Authenticate the user that has the cookie

7. Crypto-signed cookies
• Sign the cookie
• Issue to the client
• Cookie is now tamperproof
• You can also verify it’s origin
• Problem: Now the format of the cookie is
defined in two places

8. Silly crypto access
example
sub vcl_recv {
unset req.http.authstatus;
if (req.http.signature) {
set req.http.sig-verf = digest.hmac_sha256("secret", req.http.username + req.url);
if (req.http.sig-verf == req.http.signature) {
set req.http.authstatus = "ok";
}
}
if (req.http.authstatus == "ok") {
return(synth(200, "ok"));
} else {
return(synth(401, "Not ok"));
}
}

9. demo

10. Points to remember
• If you add a random string your crypto
cookie becomes really hard to crack
• Client side scripting required to manipulate
the cookies

11. Example 2

12. “Sharing cookie
formats across services
is bad"

13. Best of both worlds
• Login-service does auth and issues cookie
• Varnish verifies cookie against API
• Varnish issues it’s own cookies to track
state

14. Architecture
client varnish
auth
content

15. Varnish auth toolkit
aka
Varnish Paywall

16. Key design decisions
• Access control is either metered or
subscription based
• Products IDs - different subscription
offerings
• Article IDs - unique article ID for metering
• Auth through cookie and API

17. How is it built?
• DigestVMOD - Crypto
• HeaderVMOD - Managing multiple headers
w/same name
• VariableVMOD - configuration and state
• PaywallVMOD - misc
• Opt. MemcachedVMOD - store quota data
in Memcached

18. Backend header ex
• X-Access-Control: subscription,metered
• X-Aid: 1234
• X-Auth-Failed: /login.html
• X-Pids: 23,55

19. Auth server interface
• Input: vpw_id (cookie from SSO)
• VPW-Allowed-Pids: 75,23
• VPW-TTL: 30

20. Demo

21. Q&A