*: make bcrypt-cost configurable

Documentation/op-guide/configuration.md

@@ -375,6 +375,10 @@ Follow the instructions when using these flags.
 + Example option of JWT: '--auth-token jwt,pub-key=app.rsa.pub,priv-key=app.rsa,sign-method=RS512,ttl=10m'
 + default: "simple"
 
+### --bcrypt-cost
++ Specify the cost / strength of the bcrypt algorithm for hashing auth passwords. Valid values are between 4 and 31.
++ default: 10
+
 ## Experimental flags
 
 ### --experimental-corrupt-check-time

auth/store.go

@@ -1048,12 +1048,18 @@ func decomposeOpts(optstr string) (string, map[string]string, error) {
 
 }
 
-func NewTokenProvider(lg *zap.Logger, tokenOpts string, indexWaiter func(uint64) <-chan struct{}) (TokenProvider, error) {
+func NewTokenProvider(lg *zap.Logger, tokenOpts string, bcryptCost int, indexWaiter func(uint64) <-chan struct{}) (TokenProvider, error) {
 	tokenType, typeSpecificOpts, err := decomposeOpts(tokenOpts)
 	if err != nil {
 		return nil, ErrInvalidAuthOpts
 	}
 
+	if bcryptCost < bcrypt.MinCost || bcryptCost > bcrypt.MaxCost {
+		plog.Errorf("Invalid bcrypt-cost: %d", bcryptCost)
+		return nil, ErrInvalidAuthOpts
+	}
+	BcryptCost = bcryptCost
+
 	switch tokenType {
 	case "simple":
 		if lg != nil {

auth/store_test.go

@@ -34,8 +34,6 @@ import (
 	"google.golang.org/grpc/metadata"
 )
 
-func init() { BcryptCost = bcrypt.MinCost }
-
 func dummyIndexWaiter(index uint64) <-chan struct{} {
 	ch := make(chan struct{})
 	go func() {
@@ -50,7 +48,7 @@ func TestNewAuthStoreRevision(t *testing.T) {
 	b, tPath := backend.NewDefaultTmpBackend()
 	defer os.Remove(tPath)
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -78,7 +76,7 @@ func TestNewAuthStoreRevision(t *testing.T) {
 func setupAuthStore(t *testing.T) (store *authStore, teardownfunc func(t *testing.T)) {
 	b, tPath := backend.NewDefaultTmpBackend()
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -515,7 +513,7 @@ func TestAuthInfoFromCtxRace(t *testing.T) {
 	b, tPath := backend.NewDefaultTmpBackend()
 	defer os.Remove(tPath)
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -581,7 +579,7 @@ func TestRecoverFromSnapshot(t *testing.T) {
 
 	as.Close()
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -663,7 +661,7 @@ func TestRolesOrder(t *testing.T) {
 	b, tPath := backend.NewDefaultTmpBackend()
 	defer os.Remove(tPath)
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -709,7 +707,7 @@ func TestAuthInfoFromCtxWithRoot(t *testing.T) {
 	b, tPath := backend.NewDefaultTmpBackend()
 	defer os.Remove(tPath)
 
-	tp, err := NewTokenProvider(zap.NewExample(), "simple", dummyIndexWaiter)
+	tp, err := NewTokenProvider(zap.NewExample(), "simple", bcrypt.MinCost, dummyIndexWaiter)
 	if err != nil {
 		t.Fatal(err)
 	}

embed/config.go

@@ -44,6 +44,7 @@ import (
 	"github.com/ghodss/yaml"
 	"go.uber.org/zap"
 	"go.uber.org/zap/zapcore"
+	"golang.org/x/crypto/bcrypt"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/grpclog"
 )
@@ -249,7 +250,8 @@ type Config struct {
 	//	embed.StartEtcd(cfg)
 	ServiceRegister func(*grpc.Server) `json:"-"`
 
-	AuthToken string `json:"auth-token"`
+	AuthToken  string `json:"auth-token"`
+	BcryptCost uint   `json:"bcrypt-cost"`
 
 	ExperimentalInitialCorruptCheck bool          `json:"experimental-initial-corrupt-check"`
 	ExperimentalCorruptCheckTime    time.Duration `json:"experimental-corrupt-check-time"`
@@ -370,7 +372,8 @@ func NewConfig() *Config {
 		CORS:          map[string]struct{}{"*": {}},
 		HostWhitelist: map[string]struct{}{"*": {}},
 
-		AuthToken: "simple",
+		AuthToken:  "simple",
+		BcryptCost: uint(bcrypt.DefaultCost),
 
 		PreVote: false, // TODO: enable by default in v3.5
 

embed/etcd.go

@@ -183,6 +183,7 @@ func StartEtcd(inCfg *Config) (e *Etcd, err error) {
 		StrictReconfigCheck:        cfg.StrictReconfigCheck,
 		ClientCertAuthEnabled:      cfg.ClientTLSInfo.ClientCertAuth,
 		AuthToken:                  cfg.AuthToken,
+		BcryptCost:                 cfg.BcryptCost,
 		CORS:                       cfg.CORS,
 		HostWhitelist:              cfg.HostWhitelist,
 		InitialCorruptCheck:        cfg.ExperimentalInitialCorruptCheck,

embed/serve_test.go

@@ -20,6 +20,7 @@ import (
 	"testing"
 
 	"github.com/coreos/etcd/auth"
+	"golang.org/x/crypto/bcrypt"
 )
 
 // TestStartEtcdWrongToken ensures that StartEtcd with wrong configs returns with error.
@@ -36,3 +37,33 @@ func TestStartEtcdWrongToken(t *testing.T) {
 		t.Fatalf("expected %v, got %v", auth.ErrInvalidAuthOpts, err)
 	}
 }
+
+// TestStartEtcdLargeBcryptCost ensures that StartEtcd with invalid large bcrypt-cost returns with error.
+func TestStartEtcdLargeBcryptCost(t *testing.T) {
+	tdir, err := ioutil.TempDir(os.TempDir(), "large-bcrypt-cost-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tdir)
+	cfg := NewConfig()
+	cfg.Dir = tdir
+	cfg.BcryptCost = uint(bcrypt.MaxCost) + 1
+	if _, err = StartEtcd(cfg); err != auth.ErrInvalidAuthOpts {
+		t.Fatalf("expected %v, got %v", auth.ErrInvalidAuthOpts, err)
+	}
+}
+
+// TestStartEtcdSmallBcryptCost ensures that StartEtcd with invalid small bcrypt-cost returns with error.
+func TestStartEtcdSmallBcryptCost(t *testing.T) {
+	tdir, err := ioutil.TempDir(os.TempDir(), "small-bcrypt-cost-test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(tdir)
+	cfg := NewConfig()
+	cfg.Dir = tdir
+	cfg.BcryptCost = uint(bcrypt.MinCost) - 1
+	if _, err = StartEtcd(cfg); err != auth.ErrInvalidAuthOpts {
+		t.Fatalf("expected %v, got %v", auth.ErrInvalidAuthOpts, err)
+	}
+}

etcdmain/config.go

@@ -237,6 +237,7 @@ func newConfig() *config {
 
 	// auth
 	fs.StringVar(&cfg.ec.AuthToken, "auth-token", cfg.ec.AuthToken, "Specify auth token specific options.")
+	fs.UintVar(&cfg.ec.BcryptCost, "bcrypt-cost", cfg.ec.BcryptCost, "Bcrypt algorithm cost / strength for hashing auth passwords")
 
 	// experimental
 	fs.BoolVar(&cfg.ec.ExperimentalInitialCorruptCheck, "experimental-initial-corrupt-check", cfg.ec.ExperimentalInitialCorruptCheck, "Enable to check data corruption before serving any client/peer traffic.")

etcdmain/help.go

@@ -148,6 +148,8 @@ Security:
 Auth:
   --auth-token 'simple'
     Specify a v3 authentication token type and its options ('simple' or 'jwt').
+  --bcrypt-cost 10
+    Specify the cost / strength of the bcrypt algorithm for hashing auth passwords. Valid values are between 4 and 31.
 
 Profiling:
   --enable-pprof 'false'

etcdserver/config.go

@@ -103,7 +103,8 @@ type ServerConfig struct {
 	// ClientCertAuthEnabled is true when cert has been signed by the client CA.
 	ClientCertAuthEnabled bool
 
-	AuthToken string
+	AuthToken  string
+	BcryptCost uint
 
 	// InitialCorruptCheck is true to check data corruption on boot
 	// before serving any peer/client traffic.

etcdserver/server.go

@@ -547,7 +547,7 @@ func NewServer(cfg ServerConfig) (srv *EtcdServer, err error) {
 	}()
 
 	srv.consistIndex.setConsistentIndex(srv.kv.ConsistentIndex())
-	tp, err := auth.NewTokenProvider(cfg.Logger, cfg.AuthToken,
+	tp, err := auth.NewTokenProvider(cfg.Logger, cfg.AuthToken, int(cfg.BcryptCost),
 		func(index uint64) <-chan struct{} {
 			return srv.applyWait.Wait(index)
 		},

integration/cluster.go

@@ -53,6 +53,7 @@ import (
 
 	"github.com/coreos/pkg/capnslog"
 	"github.com/soheilhy/cmux"
+	"golang.org/x/crypto/bcrypt"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/grpclog"
 	"google.golang.org/grpc/keepalive"
@@ -605,6 +606,7 @@ func mustNewMember(t *testing.T, mcfg memberConfig) *member {
 		m.MaxRequestBytes = embed.DefaultMaxRequestBytes
 	}
 	m.AuthToken = "simple" // for the purpose of integration testing, simple token is enough
+	m.BcryptCost = uint(bcrypt.MinCost)
 
 	m.grpcServerOpts = []grpc.ServerOption{}
 	if mcfg.grpcKeepAliveMinTime > time.Duration(0) {

tests/e2e/cluster_test.go

@@ -123,6 +123,7 @@ type etcdProcessClusterConfig struct {
 	noStrictReconfig    bool
 	initialCorruptCheck bool
 	authTokenOpts       string
+	bcryptCost          int
 }
 
 // newEtcdProcessCluster launches a new cluster from etcd processes, returning
@@ -249,6 +250,12 @@ func (cfg *etcdProcessClusterConfig) etcdServerProcessConfigs() []*etcdServerPro
 			args = append(args, "--auth-token", cfg.authTokenOpts)
 		}
 
+		if cfg.bcryptCost > 0 {
+			args = append(args,
+				"--bcrypt-cost", fmt.Sprintf("%d", cfg.bcryptCost),
+			)
+		}
+
 		etcdCfgs[i] = &etcdServerProcessConfig{
 			execPath:     cfg.execPath,
 			args:         args,