Feature/mongodb security

[baursn]

What problem are we solving?

added insecure_skip_verify option to mongodb filer store

How is the PR tested?

tested on my local instance

[kmlebedev]

@baursn I would recommend doing automatic reloading of certificates for https without restarting the process.
#

seaweedfs/weed/command/s3.go

Lines 293 to 322 in 3fae876

	if *s3opt.tlsPrivateKey != "" {
	pemfileOptions := pemfile.Options{
	CertFile: *s3opt.tlsCertificate,
	KeyFile: *s3opt.tlsPrivateKey,
	RefreshDuration: security.CredRefreshingInterval,
	}
	if s3opt.certProvider, err = pemfile.NewProvider(pemfileOptions); err != nil {
	glog.Fatalf("pemfile.NewProvider(%v) failed: %v", pemfileOptions, err)
	}
	caCertPool := x509.NewCertPool()
	if *s3Options.tlsCACertificate != "" {
	// load CA certificate file and add it to list of client CAs
	caCertFile, err := ioutil.ReadFile(*s3opt.tlsCACertificate)
	if err != nil {
	glog.Fatalf("error reading CA certificate: %v", err)
	}
	caCertPool.AppendCertsFromPEM(caCertFile)
	}
	clientAuth := tls.NoClientCert
	if *s3Options.tlsVerifyClientCert {
	clientAuth = tls.RequireAndVerifyClientCert
	}
	httpS.TLSConfig = &tls.Config{
	GetCertificate: s3opt.GetCertificateWithUpdate,
	ClientAuth: clientAuth,
	ClientCAs: caCertPool,
	}

Maybe the driver itself can replace the certificate during reconnections?

[baursn]

@baursn I would recommend doing automatic reloading of certificates for https without restarting the process. #

seaweedfs/weed/command/s3.go

Lines 293 to 322 in 3fae876

	if *s3opt.tlsPrivateKey != "" {
	pemfileOptions := pemfile.Options{
	CertFile: *s3opt.tlsCertificate,
	KeyFile: *s3opt.tlsPrivateKey,
	RefreshDuration: security.CredRefreshingInterval,
	}
	if s3opt.certProvider, err = pemfile.NewProvider(pemfileOptions); err != nil {
	glog.Fatalf("pemfile.NewProvider(%v) failed: %v", pemfileOptions, err)
	}
	caCertPool := x509.NewCertPool()
	if *s3Options.tlsCACertificate != "" {
	// load CA certificate file and add it to list of client CAs
	caCertFile, err := ioutil.ReadFile(*s3opt.tlsCACertificate)
	if err != nil {
	glog.Fatalf("error reading CA certificate: %v", err)
	}
	caCertPool.AppendCertsFromPEM(caCertFile)
	}
	clientAuth := tls.NoClientCert
	if *s3Options.tlsVerifyClientCert {
	clientAuth = tls.RequireAndVerifyClientCert
	}
	httpS.TLSConfig = &tls.Config{
	GetCertificate: s3opt.GetCertificateWithUpdate,
	ClientAuth: clientAuth,
	ClientCAs: caCertPool,
	}

Maybe the driver itself can replace the certificate during reconnections?

Is there any examples in other connectors, then i can take a look?