From aa28121466afed97a4e52a575817f73d1205ddd1 Mon Sep 17 00:00:00 2001 From: Pavel Korotkov Date: Wed, 15 Jul 2020 16:48:25 +0300 Subject: [PATCH] Introduce a auth center + secure enclave in a separate package --- auth/center.go | 80 ++++++++++++++++++++++ auth/enclave.go | 159 +++++++++++++++++++++++++++++++++++++++++++ neofs/layer/auth.go | 162 -------------------------------------------- 3 files changed, 239 insertions(+), 162 deletions(-) create mode 100644 auth/center.go create mode 100644 auth/enclave.go delete mode 100644 neofs/layer/auth.go diff --git a/auth/center.go b/auth/center.go new file mode 100644 index 0000000..dc556ce --- /dev/null +++ b/auth/center.go @@ -0,0 +1,80 @@ +package auth + +import ( + "crypto/sha256" + + "github.com/klauspost/compress/zstd" + "github.com/nspcc-dev/neofs-api-go/service" + "github.com/pkg/errors" +) + +var _debug = false + +func SetDebug() { + _debug = true +} + +// Center is a central app's authentication/authorization management unit. +type Center struct { + zstdEncoder *zstd.Encoder + zstdDecoder *zstd.Decoder +} + +// NewAuthCenter creates an instance of AuthCenter. +func NewCenter() (*Center, error) { + zstdEncoder, _ := zstd.NewWriter(nil) + zstdDecoder, _ := zstd.NewReader(nil) + ac := &Center{zstdEncoder: zstdEncoder, zstdDecoder: zstdDecoder} + return ac, nil +} + +func (ac *Center) PackBearerToken(bearerToken *service.BearerTokenMsg) ([]byte, error) { + data, err := bearerToken.Marshal() + if err != nil { + return nil, errors.Wrap(err, "failed to marshal bearer token") + } + encryptedKeyID, err := globalEnclave.Encrypt(gateUserAuthKey, ac.compress(data)) + if err != nil { + return nil, errors.Wrap(err, "") + } + return append(sha256Hash(data), encryptedKeyID...), nil +} + +func (ac *Center) UnpackBearerToken(packedBearerToken []byte) (*service.BearerTokenMsg, error) { + compressedKeyID := packedBearerToken[32:] + encryptedKeyID, err := ac.decompress(compressedKeyID) + if err != nil { + return nil, errors.Wrap(err, "failed to decompress key ID") + } + keyID, err := globalEnclave.Decrypt(gateUserAuthKey, encryptedKeyID) + if err != nil { + return nil, errors.Wrap(err, "failed to decrypt key ID") + } + bearerToken := new(service.BearerTokenMsg) + if err := bearerToken.Unmarshal(keyID); err != nil { + return nil, errors.Wrap(err, "failed to unmarshal embedded bearer token") + } + return bearerToken, nil +} + +func (ac *Center) compress(data []byte) []byte { + ac.zstdEncoder.Reset(nil) + var compressedData []byte + ac.zstdEncoder.EncodeAll(data, compressedData) + return compressedData +} + +func (ac *Center) decompress(data []byte) ([]byte, error) { + ac.zstdDecoder.Reset(nil) + var decompressedData []byte + if _, err := ac.zstdDecoder.DecodeAll(data, decompressedData); err != nil { + return nil, err + } + return decompressedData, nil +} + +func sha256Hash(data []byte) []byte { + hash := sha256.New() + hash.Write(data) + return hash.Sum(nil) +} diff --git a/auth/enclave.go b/auth/enclave.go new file mode 100644 index 0000000..851e89c --- /dev/null +++ b/auth/enclave.go @@ -0,0 +1,159 @@ +package auth + +import ( + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/rsa" + "crypto/sha256" + "crypto/x509" + "encoding/pem" + "io/ioutil" + "os" + "path/filepath" + + "github.com/pkg/errors" +) + +const ( + // PathToUserAuthPrivateKeyFile is a linux-specific predefined path + // to a persisted RSA private key for authenticating at S3 server. + PathToUserAuthPrivateKeyFile = "/etc/neofs/1.pem" + // PathToNeoFSECDSAPrivateKeyFile is a linux-specific predefined path + // to a persisted ECDSA private key for accessing NeoFS network. + PathToNeoFSECDSAPrivateKeyFile = "/etc/neofs/2.pem" +) + +const ( + gatewayEncryptionKeySize = 4096 +) + +const ( + _ encryptionKeyName = iota + // Indicates that the key is used to encrypt + // a bearer token to pass auth procedure. + gateUserAuthKey +) + +const ( + _ signatureKeyName = iota + // Indicates that the key is a NeoFS ECDSA key. + gateNeoFSECDSAKey + // Indicates that the key is a NeoFS Ed25519 key. + gateNeoFSEd25519Key +) + +type ( + signatureKeyName byte + encryptionKeyName byte +) + +type ( + signatureKeyPair struct { + PrivateKey *ecdsa.PrivateKey + PublicKey *ecdsa.PublicKey + } + + encryptionKeyPair struct { + PrivateKey *rsa.PrivateKey + PublicKey *rsa.PublicKey + } +) + +var globalEnclave *secureEnclave + +func init() { + var err error + globalEnclave, err = newSecureEnclave() + if err != nil { + panic("failed to initialize secure enclave") + } +} + +type secureEnclave struct { + signatureKeys map[signatureKeyName]signatureKeyPair + encryptionKeys map[encryptionKeyName]encryptionKeyPair +} + +func newSecureEnclave() (*secureEnclave, error) { + var ( + pathToKey1, pathToKey2 string + key1 *rsa.PrivateKey + key2 *ecdsa.PrivateKey + ) + // FIXME: Get private keys properly. + if _debug { + ep, _ := os.Executable() + base := filepath.Dir(ep) + pathToKey1, pathToKey2 = filepath.Join(base, "1.pem"), filepath.Join(base, "2.pem") + } else { + pathToKey1, pathToKey2 = PathToUserAuthPrivateKeyFile, PathToNeoFSECDSAPrivateKeyFile + } + if key1bs, err := ioutil.ReadFile(pathToKey1); err != nil { + // No file found. + if os.IsNotExist(err) { + if key1, err = rsa.GenerateKey(rand.Reader, gatewayEncryptionKeySize); err != nil { + return nil, errors.Wrap(err, "failed to generate RSA key") + } + key1bs := x509.MarshalPKCS1PrivateKey(key1) + data := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: key1bs}) + if err := ioutil.WriteFile(pathToKey1, data, 0o600); err != nil { + return nil, errors.Wrapf(err, "failed to write file %s", pathToKey1) + } + } else { + return nil, errors.Wrapf(err, "failed to open file %s", pathToKey1) + } + } else { + pemBlock, _ := pem.Decode(key1bs) + if pemBlock == nil { + return nil, errors.Errorf("failed to decode PEM data from file %s", pathToKey1) + } + key1, err = x509.ParsePKCS1PrivateKey(pemBlock.Bytes) + if err != nil { + return nil, errors.Wrapf(err, "failed to parse private key bytes from pem data from file %s", pathToKey1) + } + } + if key2bs, err := ioutil.ReadFile(pathToKey2); err != nil { + // No file found. + if os.IsNotExist(err) { + if key2, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader); err != nil { + return nil, errors.Wrap(err, "failed to generate ECDSA key") + } + key2bs, err := x509.MarshalECPrivateKey(key2) + if err != nil { + return nil, errors.New("failed to marshal ECDSA private key") + } + data := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: key2bs}) + if err := ioutil.WriteFile(pathToKey2, data, 0o600); err != nil { + return nil, errors.Wrapf(err, "failed to write file %s", pathToKey2) + } + } else { + return nil, errors.Wrapf(err, "failed to open file %s", pathToKey2) + } + } else { + pemBlock, _ := pem.Decode(key2bs) + if pemBlock == nil { + return nil, errors.Errorf("failed to decode PEM data from file %s", pathToKey2) + } + key2, err = x509.ParseECPrivateKey(pemBlock.Bytes) + if err != nil { + return nil, errors.Wrapf(err, "failed to parse private key bytes from pem data from file %s", pathToKey2) + } + } + return &secureEnclave{ + encryptionKeys: map[encryptionKeyName]encryptionKeyPair{ + gateUserAuthKey: {key1, &key1.PublicKey}, + }, + signatureKeys: map[signatureKeyName]signatureKeyPair{ + gateNeoFSECDSAKey: {key2, &key2.PublicKey}, + }, + }, nil +} + +func (se *secureEnclave) Encrypt(keyName encryptionKeyName, data []byte) ([]byte, error) { + return rsa.EncryptOAEP(sha256.New(), rand.Reader, se.encryptionKeys[keyName].PublicKey, data, []byte{}) +} + +func (se *secureEnclave) Decrypt(keyName encryptionKeyName, data []byte) ([]byte, error) { + return rsa.DecryptOAEP(sha256.New(), rand.Reader, se.encryptionKeys[keyName].PrivateKey, data, []byte{}) +} diff --git a/neofs/layer/auth.go b/neofs/layer/auth.go deleted file mode 100644 index d6e32fe..0000000 --- a/neofs/layer/auth.go +++ /dev/null @@ -1,162 +0,0 @@ -package layer - -import ( - "crypto/ecdsa" - "crypto/rand" - "crypto/rsa" - "crypto/sha256" - - "github.com/klauspost/compress/zstd" - "github.com/nspcc-dev/neofs-api-go/service" - "github.com/pkg/errors" -) - -const ( - gatewayEncryptionKeySize = 2048 -) - -type ( - signatureKeyName byte - encryptionKeyName byte -) - -const ( - _ signatureKeyName = iota - // Indicates that the key is a NeoFS ECDSA key. - gateNeoFSECDSAKey - gateNeoFSEd25519Key -) - -const ( - _ encryptionKeyName = iota - // Indicates that the key is used to encrypt - // a bearer token to pass auth procedure. - gateUserAuthKey -) - -type ( - signatureKeyPair struct { - PrivateKey *ecdsa.PrivateKey - PublicKey *ecdsa.PublicKey - } - - encryptionKeyPair struct { - PrivateKey *rsa.PrivateKey - PublicKey *rsa.PublicKey - } -) - -type secureEnclave struct { - signatureKeys map[signatureKeyName]signatureKeyPair - encryptionKeys map[encryptionKeyName]encryptionKeyPair -} - -func newSecureEnclave() (*secureEnclave, error) { - // TODO: Get private keys. - // TODO: Fetch NeoFS and Auth private keys from app settings. - return &secureEnclave{ - signatureKeys: map[signatureKeyName]signatureKeyPair{}, - encryptionKeys: map[encryptionKeyName]encryptionKeyPair{}, - }, nil -} - -func (se *secureEnclave) Encrypt(keyName encryptionKeyName, data []byte) ([]byte, error) { - return rsa.EncryptOAEP(sha256.New(), rand.Reader, se.encryptionKeys[keyName].PublicKey, data, []byte{}) -} - -func (se *secureEnclave) Decrypt(keyName encryptionKeyName, data []byte) ([]byte, error) { - return rsa.DecryptOAEP(sha256.New(), rand.Reader, se.encryptionKeys[keyName].PrivateKey, data, []byte{}) -} - -var globalEnclave *secureEnclave - -func init() { - var err error - globalEnclave, err = newSecureEnclave() - if err != nil { - panic("failed to initialize secure enclave") - } -} - -// AuthCenter is a central app's authentication/authorization management unit. -type AuthCenter struct { - zstdEncoder *zstd.Encoder - zstdDecoder *zstd.Decoder -} - -// NewAuthCenter creates an instance of AuthCenter. -func NewAuthCenter() (*AuthCenter, error) { - // var ( - // err error - // privateKey *rsa.PrivateKey - // ) - // secureEnclave := &SecureEnclave{} - // privateKey, err = secureEnclave.PullGatewayEncryptionPrivateKey() - // if err != nil { - // return nil, errors.Wrap(err, "failed to pull gateway private key from trusted enclave") - // } - // if privateKey == nil { - // // TODO: Move this logic to the enclave. - // if privateKey, err = rsa.GenerateKey(rand.Reader, gatewayEncryptionKeySize); err != nil { - // return nil, errors.Wrap(err, "failed to generate gateway private key") - // } - // // if err = keysEnclave.PushGatewayEncryptionPrivateKey(privateKey); err != nil { - // // return nil, errors.Wrap(err, "failed to push gateway private key to trusted enclave") - // // } - // } - zstdEncoder, _ := zstd.NewWriter(nil) - zstdDecoder, _ := zstd.NewReader(nil) - ac := &AuthCenter{zstdEncoder: zstdEncoder, zstdDecoder: zstdDecoder} - return ac, nil -} - -func (ac *AuthCenter) PackBearerToken(bearerToken *service.BearerTokenMsg) ([]byte, error) { - data, err := bearerToken.Marshal() - if err != nil { - return nil, errors.Wrap(err, "failed to marshal bearer token") - } - encryptedKeyID, err := globalEnclave.Encrypt(gateUserAuthKey, ac.compress(data)) - if err != nil { - return nil, errors.Wrap(err, "") - } - return append(sha256Hash(data), encryptedKeyID...), nil -} - -func (ac *AuthCenter) UnpackBearerToken(packedBearerToken []byte) (*service.BearerTokenMsg, error) { - compressedKeyID := packedBearerToken[32:] - encryptedKeyID, err := ac.decompress(compressedKeyID) - if err != nil { - return nil, errors.Wrap(err, "failed to decompress key ID") - } - keyID, err := globalEnclave.Decrypt(gateUserAuthKey, encryptedKeyID) - if err != nil { - return nil, errors.Wrap(err, "failed to decrypt key ID") - } - bearerToken := new(service.BearerTokenMsg) - if err := bearerToken.Unmarshal(keyID); err != nil { - return nil, errors.Wrap(err, "failed to unmarshal embedded bearer token") - } - return bearerToken, nil -} - -func (ac *AuthCenter) compress(data []byte) []byte { - ac.zstdEncoder.Reset(nil) - var compressedData []byte - ac.zstdEncoder.EncodeAll(data, compressedData) - return compressedData -} - -func (ac *AuthCenter) decompress(data []byte) ([]byte, error) { - ac.zstdDecoder.Reset(nil) - var decompressedData []byte - if _, err := ac.zstdDecoder.DecodeAll(data, decompressedData); err != nil { - return nil, err - } - return decompressedData, nil -} - -func sha256Hash(data []byte) []byte { - hash := sha256.New() - hash.Write(data) - return hash.Sum(nil) -}