TrueCloudLab/frostfs-s3-gw
18
3
Fork 20
Code Issues 29 Pull requests 6 Projects Releases 23 Packages Activity Actions

[#83] Use multiple bearer tokens

Browse source 
Signed-off-by: Denis Kirillov <denis@nspcc.ru>
This commit is contained in:
Denis Kirillov 2021-06-17 19:45:50 +03:00
parent 9060b0a988
commit d1594b586e
7 changed files with 279 additions and 215 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
api/auth/center.go
View file

@ -15,7 +15,6 @@ import (
v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
"github.com/nspcc-dev/neofs-api-go/pkg/object"
"github.com/nspcc-dev/neofs-api-go/pkg/token"
"github.com/nspcc-dev/neofs-s3-gw/authmate"
"github.com/nspcc-dev/neofs-s3-gw/creds/tokens"
"github.com/nspcc-dev/neofs-sdk-go/pkg/pool"
"go.uber.org/zap"
@ -98,12 +97,7 @@ func (c *center) Authenticate(r *http.Request) (*token.BearerToken, error) {
return nil, fmt.Errorf("could not parse AccessBox address: %s : %w", accessKeyID, err)
}
tkn, err := c.cli.GetBearerToken(r.Context(), address)
if err != nil {
return nil, err
}
secret, err := authmate.BearerToAccessKey(tkn)
tkns, err := c.cli.GetTokens(r.Context(), address)
if err != nil {
return nil, err
}
@ -119,7 +113,7 @@ func (c *center) Authenticate(r *http.Request) (*token.BearerToken, error) {
}
}
awsCreds := credentials.NewStaticCredentials(accessKeyID, secret, "")
awsCreds := credentials.NewStaticCredentials(accessKeyID, tkns.AccessKey, "")
signer := v4.NewSigner(awsCreds)
signer.DisableURIPathEscaping = true
@ -133,5 +127,5 @@ func (c *center) Authenticate(r *http.Request) (*token.BearerToken, error) {
return nil, errors.New("failed to pass authentication procedure")
}
return tkn, nil
return tkns.BearerToken, nil
}

54
authmate/authmate.go
View file

@ -3,7 +3,6 @@ package authmate
import (
"context"
"crypto/ecdsa"
"crypto/sha256"
"encoding/hex"
"encoding/json"
"fmt"
@ -152,7 +151,7 @@ func (a *Agent) IssueSecret(ctx context.Context, w io.Writer, options *IssueSecr
return fmt.Errorf("failed to build eacl table: %w", err)
}
bearerTkn, err := buildBearerToken(options.NeoFSKey, bearerRules, options.GatesPublicKeys[0])
gatesData, err := buildBearerTokens(options.NeoFSKey, bearerRules, options.GatesPublicKeys)
if err != nil {
return fmt.Errorf("failed to build bearer token: %w", err)
}
@ -162,13 +161,13 @@ func (a *Agent) IssueSecret(ctx context.Context, w io.Writer, options *IssueSecr
return fmt.Errorf("failed to create session token: %w", err)
}
box, ownerKey, err := accessbox.PackTokens(bearerTkn, sessionTkn, options.GatesPublicKeys...)
box, secrets, err := accessbox.PackTokens(gatesData, sessionTkn)
if err != nil {
return err
}
a.log.Info("store bearer token into NeoFS",
zap.Stringer("owner_tkn", bearerTkn.Issuer()))
zap.Stringer("owner_tkn", oid))
if !options.SessionTkn && len(options.ContextRules) > 0 {
_, err := w.Write([]byte("Warning: rules for session token were set but --create-session flag wasn't, " +
@ -179,23 +178,18 @@ func (a *Agent) IssueSecret(ctx context.Context, w io.Writer, options *IssueSecr
}
address, err := tokens.
New(a.pool, ownerKey).
New(a.pool, secrets.EphemeralKey).
Put(ctx, cid, oid, box, options.GatesPublicKeys...)
if err != nil {
return fmt.Errorf("failed to put bearer token: %w", err)
}
secret, err := BearerToAccessKey(bearerTkn)
if err != nil {
return fmt.Errorf("failed to get bearer token secret key: %w", err)
}
accessKeyID := address.ContainerID().String() + "_" + address.ObjectID().String()
ir := &issuingResult{
AccessKeyID: accessKeyID,
SecretAccessKey: secret,
OwnerPrivateKey: hex.EncodeToString(crypto.MarshalPrivateKey(ownerKey)),
SecretAccessKey: secrets.AccessKey,
OwnerPrivateKey: hex.EncodeToString(crypto.MarshalPrivateKey(secrets.EphemeralKey)),
}
enc := json.NewEncoder(w)
@ -212,19 +206,14 @@ func (a *Agent) ObtainSecret(ctx context.Context, w io.Writer, options *ObtainSe
return fmt.Errorf("failed to parse secret address: %w", err)
}
tkn, err := bearerCreds.GetBearerToken(ctx, address)
tkns, err := bearerCreds.GetTokens(ctx, address)
if err != nil {
return fmt.Errorf("failed to get bearer token: %w", err)
}
secret, err := BearerToAccessKey(tkn)
if err != nil {
return fmt.Errorf("failed to get bearer token secret key: %w", err)
return fmt.Errorf("failed to get tokens: %w", err)
}
or := &obtainingResult{
BearerToken: tkn,
SecretAccessKey: secret,
BearerToken: tkns.BearerToken,
SecretAccessKey: tkns.AccessKey,
}
enc := json.NewEncoder(w)
@ -316,6 +305,18 @@ func buildBearerToken(key *ecdsa.PrivateKey, table *eacl.Table, ownerKey *ecdsa.
return bearerToken, bearerToken.SignToken(key)
}
func buildBearerTokens(key *ecdsa.PrivateKey, table *eacl.Table, ownerKeys []*ecdsa.PublicKey) ([]*accessbox.GateData, error) {
gatesData := make([]*accessbox.GateData, 0, len(ownerKeys))
for _, ownerKey := range ownerKeys {
tkn, err := buildBearerToken(key, table, ownerKey)
if err != nil {
return nil, err
}
gatesData = append(gatesData, accessbox.NewGateData(tkn, ownerKey))
}
return gatesData, nil
}
func buildSessionToken(key *ecdsa.PrivateKey, oid *owner.ID, ctx *session.ContainerContext) (*session.Token, error) {
tok := session.NewToken()
tok.SetContext(ctx)
@ -340,17 +341,6 @@ func createSessionToken(options *IssueSecretOptions, oid *owner.ID) (*session.To
return nil, nil
}
// BearerToAccessKey returns secret access key generated from given BearerToken.
func BearerToAccessKey(tkn *token.BearerToken) (string, error) {
data, err := tkn.Marshal()
if err != nil {
return "", err
}
hash := sha256.Sum256(data)
return hex.EncodeToString(hash[:]), nil
}
func ownerIDFromNeoFSKey(key *ecdsa.PublicKey) (*owner.ID, error) {
wallet, err := owner.NEO3WalletFromPublicKey(key)
if err != nil {

158
creds/accessbox/accessbox.go
View file

@ -7,6 +7,7 @@ import (
"crypto/elliptic"
"crypto/rand"
"crypto/sha256"
"encoding/hex"
"fmt"
"io"
@ -18,9 +19,23 @@ import (
"google.golang.org/protobuf/proto"
)
type tokenInterface interface {
Marshal(bs ...[]byte) ([]byte, error)
Unmarshal([]byte) error
// GateData represents gate tokens in AccessBox.
type GateData struct {
AccessKey string
BearerToken *token.BearerToken
SessionToken *session.Token
OwnerKey *ecdsa.PublicKey
}
// NewGateData returns GateData from provided bearer token and public key.
func NewGateData(bearerTkn *token.BearerToken, ownerKey *ecdsa.PublicKey) *GateData {
return &GateData{BearerToken: bearerTkn, OwnerKey: ownerKey}
}
// Secrets represents AccessKey and key to encrypt gate tokens.
type Secrets struct {
AccessKey string
EphemeralKey *ecdsa.PrivateKey
}
// Marshal returns the wire-format of AccessBox.
@ -35,7 +50,7 @@ func (x *AccessBox) Unmarshal(data []byte) error {
// PackTokens adds a bearer and session tokens to BearerTokens and SessionToken lists respectively.
// Session token can be nil.
func PackTokens(bearer *token.BearerToken, sess *session.Token, keys ...*ecdsa.PublicKey) (*AccessBox, *ecdsa.PrivateKey, error) {
func PackTokens(gatesData []*GateData, sess *session.Token) (*AccessBox, *Secrets, error) {
box := &AccessBox{}
ephemeralKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
if err != nil {
@ -43,98 +58,105 @@ func PackTokens(bearer *token.BearerToken, sess *session.Token, keys ...*ecdsa.P
}
box.OwnerPublicKey = crypto.MarshalPublicKey(&ephemeralKey.PublicKey)
if err := box.addToken(bearer, &box.BearerTokens, ephemeralKey, keys...); err != nil {
return nil, nil, fmt.Errorf("failed to add bearer token to accessbox: %w", err)
}
if sess != nil {
if err := box.addToken(sess, &box.SessionTokens, ephemeralKey, keys...); err != nil {
return nil, nil, fmt.Errorf("failed to add session token to accessbox: %w", err)
}
secret, err := generateSecret()
if err != nil {
return nil, nil, fmt.Errorf("failed to generate accessKey as hex: %w", err)
}
return box, ephemeralKey, err
if err := box.addTokens(gatesData, ephemeralKey, sess, secret); err != nil {
return nil, nil, fmt.Errorf("failed to add tokens to accessbox: %w", err)
}
return box, &Secrets{hex.EncodeToString(secret), ephemeralKey}, err
}
// GetBearerToken returns bearer token from AccessBox.
func (x *AccessBox) GetBearerToken(owner *ecdsa.PrivateKey) (*token.BearerToken, error) {
// GetTokens returns gate tokens from AccessBox.
func (x *AccessBox) GetTokens(owner *ecdsa.PrivateKey) (*GateData, error) {
sender := crypto.UnmarshalPublicKey(x.OwnerPublicKey)
ownerKey := crypto.MarshalPublicKey(&owner.PublicKey)
for _, data := range x.BearerTokens {
if !bytes.Equal(data.GatePublicKey, ownerKey) {
for _, gate := range x.Gates {
if !bytes.Equal(gate.GatePublicKey, ownerKey) {
continue
}
tkn := token.NewBearerToken()
if err := decodeToken(data.Token, tkn, owner, sender); err != nil {
return nil, fmt.Errorf("failed to decode bearer token: %w", err)
gateData, err := decodeGate(gate, owner, sender)
if err != nil {
return nil, fmt.Errorf("failed to decode gate: %w", err)
}
return tkn, nil
return gateData, nil
}
return nil, fmt.Errorf("no bearer token for key %x was found", ownerKey)
return nil, fmt.Errorf("no gate data for key %x was found", ownerKey)
}
// GetSessionToken returns session token from AccessBox.
func (x *AccessBox) GetSessionToken(owner *ecdsa.PrivateKey) (*session.Token, error) {
sender := crypto.UnmarshalPublicKey(x.OwnerPublicKey)
ownerKey := crypto.MarshalPublicKey(&owner.PublicKey)
for _, data := range x.SessionTokens {
if !bytes.Equal(data.GatePublicKey, ownerKey) {
continue
}
tkn := session.NewToken()
if err := decodeToken(data.Token, tkn, owner, sender); err != nil {
return nil, fmt.Errorf("failed to decode session token: %w", err)
}
return tkn, nil
}
return nil, fmt.Errorf("no session token for key %x was found", ownerKey)
}
func (x *AccessBox) addToken(tkn tokenInterface, list *[]*AccessBox_Token, owner *ecdsa.PrivateKey, keys ...*ecdsa.PublicKey) error {
for i, sender := range keys {
data, err := encodeToken(tkn, owner, sender)
func (x *AccessBox) addTokens(gatesData []*GateData, ephemeralKey *ecdsa.PrivateKey, sess *session.Token, secret []byte) error {
for i, gate := range gatesData {
encBearer, err := gate.BearerToken.Marshal()
if err != nil {
return fmt.Errorf("%w, sender = %d", err, i)
}
*list = append(*list, newToken(data, crypto.MarshalPublicKey(sender)))
var encSession []byte
if sess != nil {
encSession, err = gate.SessionToken.Marshal()
if err != nil {
return fmt.Errorf("%w, sender = %d", err, i)
}
}
tokens := new(Tokens)
tokens.AccessKey = secret
tokens.BearerToken = encBearer
tokens.SessionToken = encSession
boxGate, err := encodeGate(ephemeralKey, gate.OwnerKey, tokens)
if err != nil {
return err
}
x.Gates = append(x.Gates, boxGate)
}
return nil
}
func newToken(data []byte, key []byte) *AccessBox_Token {
res := new(AccessBox_Token)
res.Token = data
res.GatePublicKey = key
return res
}
func encodeToken(tkn tokenInterface, owner *ecdsa.PrivateKey, sender *ecdsa.PublicKey) ([]byte, error) {
data, err := tkn.Marshal()
func encodeGate(ephemeralKey *ecdsa.PrivateKey, ownerKey *ecdsa.PublicKey, tokens *Tokens) (*AccessBox_Gate, error) {
data, err := proto.Marshal(tokens)
if err != nil {
return nil, err
}
encrypted, err := encrypt(owner, sender, data)
encrypted, err := encrypt(ephemeralKey, ownerKey, data)
if err != nil {
return nil, err
}
return encrypted, nil
gate := new(AccessBox_Gate)
gate.GatePublicKey = crypto.MarshalPublicKey(ownerKey)
gate.Tokens = encrypted
return gate, nil
}
func decodeToken(data []byte, tkn tokenInterface, owner *ecdsa.PrivateKey, sender *ecdsa.PublicKey) error {
decoded, err := decrypt(owner, sender, data)
func decodeGate(gate *AccessBox_Gate, owner *ecdsa.PrivateKey, sender *ecdsa.PublicKey) (*GateData, error) {
data, err := decrypt(owner, sender, gate.Tokens)
if err != nil {
return err
return nil, err
}
tokens := new(Tokens)
if err := proto.Unmarshal(data, tokens); err != nil {
return nil, err
}
err = tkn.Unmarshal(decoded)
if err != nil {
return err
bearerTkn := token.NewBearerToken()
if err := bearerTkn.Unmarshal(tokens.BearerToken); err != nil {
return nil, err
}
sessionTkn := session.NewToken()
if err := sessionTkn.Unmarshal(tokens.SessionToken); err != nil {
return nil, err
}
return nil
gateData := NewGateData(bearerTkn, &owner.PublicKey)
gateData.SessionToken = sessionTkn
gateData.AccessKey = hex.EncodeToString(tokens.AccessKey)
return gateData, nil
}
func generateShared256(prv *ecdsa.PrivateKey, pub *ecdsa.PublicKey) (sk []byte, err error) {
@ -200,9 +222,11 @@ func getCipher(owner *ecdsa.PrivateKey, sender *ecdsa.PublicKey) (cipher.AEAD, e
return nil, err
}
aead, err := chacha20poly1305.NewX(key)
if err != nil {
return nil, err
}
return aead, nil
return chacha20poly1305.NewX(key)
}
func generateSecret() ([]byte, error) {
b := make([]byte, 32)
_, err := io.ReadFull(rand.Reader, b)
return b, err
}

194
creds/accessbox/accessbox.pb.go
View file

@ -1,13 +1,12 @@
// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// protoc-gen-go v1.25.0
// protoc v3.15.8
// protoc-gen-go v1.26.0
// protoc v3.6.1
// source: creds/accessbox/accessbox.proto
package accessbox
import (
proto "github.com/golang/protobuf/proto"
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
reflect "reflect"
@ -21,18 +20,13 @@ const (
_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)
// This is a compile-time assertion that a sufficiently up-to-date version
// of the legacy proto package is being used.
const _ = proto.ProtoPackageIsVersion4
type AccessBox struct {
state protoimpl.MessageState
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
OwnerPublicKey []byte `protobuf:"bytes,1,opt,name=ownerPublicKey,json=oownerPublicKey,proto3" json:"ownerPublicKey,omitempty"`
BearerTokens []*AccessBox_Token `protobuf:"bytes,2,rep,name=bearerTokens,proto3" json:"bearerTokens,omitempty"`
SessionTokens []*AccessBox_Token `protobuf:"bytes,3,rep,name=sessionTokens,proto3" json:"sessionTokens,omitempty"`
OwnerPublicKey []byte `protobuf:"bytes,1,opt,name=ownerPublicKey,proto3" json:"ownerPublicKey,omitempty"`
Gates []*AccessBox_Gate `protobuf:"bytes,2,rep,name=gates,proto3" json:"gates,omitempty"`
}
func (x *AccessBox) Reset() {
@ -74,31 +68,25 @@ func (x *AccessBox) GetOwnerPublicKey() []byte {
return nil
}
func (x *AccessBox) GetBearerTokens() []*AccessBox_Token {
func (x *AccessBox) GetGates() []*AccessBox_Gate {
if x != nil {
return x.BearerTokens
return x.Gates
}
return nil
}
func (x *AccessBox) GetSessionTokens() []*AccessBox_Token {
if x != nil {
return x.SessionTokens
}
return nil
}
type AccessBox_Token struct {
type Tokens struct {
state protoimpl.MessageState
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Token []byte `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
GatePublicKey []byte `protobuf:"bytes,2,opt,name=gatePublicKey,proto3" json:"gatePublicKey,omitempty"`
AccessKey []byte `protobuf:"bytes,1,opt,name=accessKey,proto3" json:"accessKey,omitempty"`
BearerToken []byte `protobuf:"bytes,2,opt,name=bearerToken,proto3" json:"bearerToken,omitempty"`
SessionToken []byte `protobuf:"bytes,3,opt,name=sessionToken,proto3" json:"sessionToken,omitempty"`
}
func (x *AccessBox_Token) Reset() {
*x = AccessBox_Token{}
func (x *Tokens) Reset() {
*x = Tokens{}
if protoimpl.UnsafeEnabled {
mi := &file_creds_accessbox_accessbox_proto_msgTypes[1]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@ -106,13 +94,13 @@ func (x *AccessBox_Token) Reset() {
}
}
func (x *AccessBox_Token) String() string {
func (x *Tokens) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*AccessBox_Token) ProtoMessage() {}
func (*Tokens) ProtoMessage() {}
func (x *AccessBox_Token) ProtoReflect() protoreflect.Message {
func (x *Tokens) ProtoReflect() protoreflect.Message {
mi := &file_creds_accessbox_accessbox_proto_msgTypes[1]
if protoimpl.UnsafeEnabled && x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@ -124,19 +112,81 @@ func (x *AccessBox_Token) ProtoReflect() protoreflect.Message {
return mi.MessageOf(x)
}
// Deprecated: Use AccessBox_Token.ProtoReflect.Descriptor instead.
func (*AccessBox_Token) Descriptor() ([]byte, []int) {
return file_creds_accessbox_accessbox_proto_rawDescGZIP(), []int{0, 0}
// Deprecated: Use Tokens.ProtoReflect.Descriptor instead.
func (*Tokens) Descriptor() ([]byte, []int) {
return file_creds_accessbox_accessbox_proto_rawDescGZIP(), []int{1}
}
func (x *AccessBox_Token) GetToken() []byte {
func (x *Tokens) GetAccessKey() []byte {
if x != nil {
return x.Token
return x.AccessKey
}
return nil
}
func (x *AccessBox_Token) GetGatePublicKey() []byte {
func (x *Tokens) GetBearerToken() []byte {
if x != nil {
return x.BearerToken
}
return nil
}
func (x *Tokens) GetSessionToken() []byte {
if x != nil {
return x.SessionToken
}
return nil
}
type AccessBox_Gate struct {
state protoimpl.MessageState
sizeCache protoimpl.SizeCache
unknownFields protoimpl.UnknownFields
Tokens []byte `protobuf:"bytes,1,opt,name=tokens,proto3" json:"tokens,omitempty"`
GatePublicKey []byte `protobuf:"bytes,2,opt,name=gatePublicKey,proto3" json:"gatePublicKey,omitempty"`
}
func (x *AccessBox_Gate) Reset() {
*x = AccessBox_Gate{}
if protoimpl.UnsafeEnabled {
mi := &file_creds_accessbox_accessbox_proto_msgTypes[2]
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
ms.StoreMessageInfo(mi)
}
}
func (x *AccessBox_Gate) String() string {
return protoimpl.X.MessageStringOf(x)
}
func (*AccessBox_Gate) ProtoMessage() {}
func (x *AccessBox_Gate) ProtoReflect() protoreflect.Message {
mi := &file_creds_accessbox_accessbox_proto_msgTypes[2]
if protoimpl.UnsafeEnabled && x != nil {
ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
if ms.LoadMessageInfo() == nil {
ms.StoreMessageInfo(mi)
}
return ms
}
return mi.MessageOf(x)
}
// Deprecated: Use AccessBox_Gate.ProtoReflect.Descriptor instead.
func (*AccessBox_Gate) Descriptor() ([]byte, []int) {
return file_creds_accessbox_accessbox_proto_rawDescGZIP(), []int{0, 0}
}
func (x *AccessBox_Gate) GetTokens() []byte {
if x != nil {
return x.Tokens
}
return nil
}
func (x *AccessBox_Gate) GetGatePublicKey() []byte {
if x != nil {
return x.GatePublicKey
}
@ -148,27 +198,29 @@ var File_creds_accessbox_accessbox_proto protoreflect.FileDescriptor
var file_creds_accessbox_accessbox_proto_rawDesc = []byte{
0x0a, 0x1f, 0x63, 0x72, 0x65, 0x64, 0x73, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x62, 0x6f,
0x78, 0x2f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x70, 0x72, 0x6f, 0x74,
0x6f, 0x12, 0x09, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x22, 0xfb, 0x01, 0x0a,
0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x42, 0x6f, 0x78, 0x12, 0x27, 0x0a, 0x0e, 0x6f, 0x77,
0x6f, 0x12, 0x09, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x22, 0xaa, 0x01, 0x0a,
0x09, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x42, 0x6f, 0x78, 0x12, 0x26, 0x0a, 0x0e, 0x6f, 0x77,
0x6e, 0x65, 0x72, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
0x28, 0x0c, 0x52, 0x0f, 0x6f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63,
0x4b, 0x65, 0x79, 0x12, 0x3e, 0x0a, 0x0c, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b,
0x65, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x61, 0x63, 0x63, 0x65,
0x73, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x42, 0x6f, 0x78, 0x2e,
0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x0c, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b,
0x65, 0x6e, 0x73, 0x12, 0x40, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f,
0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x61, 0x63, 0x63,
0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x42, 0x6f, 0x78,
0x2e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54,
0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x1a, 0x43, 0x0a, 0x05, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x14,
0x0a, 0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x74,
0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x24, 0x0a, 0x0d, 0x67, 0x61, 0x74, 0x65, 0x50, 0x75, 0x62, 0x6c,
0x69, 0x63, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0d, 0x67, 0x61, 0x74,
0x65, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69,
0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6e, 0x73, 0x70, 0x63, 0x63, 0x2d, 0x64,
0x65, 0x76, 0x2f, 0x6e, 0x65, 0x6f, 0x66, 0x73, 0x2d, 0x73, 0x33, 0x2d, 0x67, 0x77, 0x2f, 0x63,
0x72, 0x65, 0x64, 0x73, 0x2f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x62, 0x6f, 0x78, 0x3b, 0x61, 0x63,
0x63, 0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x28, 0x0c, 0x52, 0x0e, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
0x65, 0x79, 0x12, 0x2f, 0x0a, 0x05, 0x67, 0x61, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
0x0b, 0x32, 0x19, 0x2e, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x62, 0x6f, 0x78, 0x2e, 0x41, 0x63,
0x63, 0x65, 0x73, 0x73, 0x42, 0x6f, 0x78, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x52, 0x05, 0x67, 0x61,
0x74, 0x65, 0x73, 0x1a, 0x44, 0x0a, 0x04, 0x47, 0x61, 0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x74,
0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x74, 0x6f, 0x6b,
0x65, 0x6e, 0x73, 0x12, 0x24, 0x0a, 0x0d, 0x67, 0x61, 0x74, 0x65, 0x50, 0x75, 0x62, 0x6c, 0x69,
0x63, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0d, 0x67, 0x61, 0x74, 0x65,
0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0x6c, 0x0a, 0x06, 0x54, 0x6f, 0x6b,
0x65, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79,
0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65,
0x79, 0x12, 0x20, 0x0a, 0x0b, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x62, 0x65, 0x61, 0x72, 0x65, 0x72, 0x54, 0x6f,
0x6b, 0x65, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f,
0x6b, 0x65, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75,
0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6e, 0x73, 0x70, 0x63, 0x63, 0x2d, 0x64, 0x65, 0x76, 0x2f,
0x6e, 0x65, 0x6f, 0x66, 0x73, 0x2d, 0x73, 0x33, 0x2d, 0x67, 0x77, 0x2f, 0x63, 0x72, 0x65, 0x64,
0x73, 0x2f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x62, 0x6f, 0x78, 0x3b, 0x61, 0x63, 0x63, 0x65, 0x73,
0x73, 0x62, 0x6f, 0x78, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
@ -183,19 +235,19 @@ func file_creds_accessbox_accessbox_proto_rawDescGZIP() []byte {
return file_creds_accessbox_accessbox_proto_rawDescData
}
var file_creds_accessbox_accessbox_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
var file_creds_accessbox_accessbox_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
var file_creds_accessbox_accessbox_proto_goTypes = []interface{}{
(*AccessBox)(nil), // 0: accessbox.AccessBox
(*AccessBox_Token)(nil), // 1: accessbox.AccessBox.Token
(*AccessBox)(nil), // 0: accessbox.AccessBox
(*Tokens)(nil), // 1: accessbox.Tokens
(*AccessBox_Gate)(nil), // 2: accessbox.AccessBox.Gate
}
var file_creds_accessbox_accessbox_proto_depIdxs = []int32{
1, // 0: accessbox.AccessBox.bearerTokens:type_name -> accessbox.AccessBox.Token
1, // 1: accessbox.AccessBox.sessionTokens:type_name -> accessbox.AccessBox.Token
2, // [2:2] is the sub-list for method output_type
2, // [2:2] is the sub-list for method input_type
2, // [2:2] is the sub-list for extension type_name
2, // [2:2] is the sub-list for extension extendee
0, // [0:2] is the sub-list for field type_name
2, // 0: accessbox.AccessBox.gates:type_name -> accessbox.AccessBox.Gate
1, // [1:1] is the sub-list for method output_type
1, // [1:1] is the sub-list for method input_type
1, // [1:1] is the sub-list for extension type_name
1, // [1:1] is the sub-list for extension extendee
0, // [0:1] is the sub-list for field type_name
}
func init() { file_creds_accessbox_accessbox_proto_init() }
@ -217,7 +269,19 @@ func file_creds_accessbox_accessbox_proto_init() {
}
}
file_creds_accessbox_accessbox_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
switch v := v.(*AccessBox_Token); i {
switch v := v.(*Tokens); i {
case 0:
return &v.state
case 1:
return &v.sizeCache
case 2:
return &v.unknownFields
default:
return nil
}
}
file_creds_accessbox_accessbox_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
switch v := v.(*AccessBox_Gate); i {
case 0:
return &v.state
case 1:
@ -235,7 +299,7 @@ func file_creds_accessbox_accessbox_proto_init() {
GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
RawDescriptor: file_creds_accessbox_accessbox_proto_rawDesc,
NumEnums: 0,
NumMessages: 2,
NumMessages: 3,
NumExtensions: 0,
NumServices: 0,
},

15
creds/accessbox/accessbox.proto
View file

@ -7,13 +7,18 @@ option go_package = "github.com/nspcc-dev/neofs-s3-gw/creds/tokenbox;accessbox";
message AccessBox {
message Token {
bytes token = 1 [json_name = "token"];
message Gate {
bytes tokens = 1 [json_name = "tokens"];
bytes gatePublicKey = 2 [json_name = "gatePublicKey"];
}
bytes ownerPublicKey = 1 [json_name = "oownerPublicKey"];
repeated Token bearerTokens = 2 [json_name = "bearerTokens"];
repeated Token sessionTokens = 3 [json_name = "sessionTokens"];
bytes ownerPublicKey = 1 [json_name = "ownerPublicKey"];
repeated Gate gates = 2 [json_name = "gates"];
}
message Tokens {
bytes accessKey = 1 [json_name = "accessKey"];
bytes bearerToken = 2 [json_name = "bearerToken"];
bytes sessionToken = 3 [json_name = "sessionToken"];
}

34
creds/accessbox/bearer_token_test.go
View file

@ -11,7 +11,7 @@ import (
"github.com/stretchr/testify/require"
)
func Test_tokens_encode_decode(t *testing.T) {
func Test_tokens_encrypt_decrypt(t *testing.T) {
var (
tkn = token.NewBearerToken()
tkn2 = token.NewBearerToken()
@ -25,10 +25,16 @@ func Test_tokens_encode_decode(t *testing.T) {
tkn.SetEACLTable(eacl.NewTable())
require.NoError(t, tkn.SignToken(sec))
data, err := encodeToken(tkn, cred, &cred.PublicKey)
rawTkn, err := tkn.Marshal()
require.NoError(t, err)
err = decodeToken(data, tkn2, cred, &cred.PublicKey)
data, err := encrypt(cred, &cred.PublicKey, rawTkn)
require.NoError(t, err)
rawTkn2, err := decrypt(cred, &cred.PublicKey, data)
require.NoError(t, err)
err = tkn2.Unmarshal(rawTkn2)
require.NoError(t, err)
require.Equal(t, tkn, tkn2)
@ -50,7 +56,8 @@ func Test_bearer_token_in_access_box(t *testing.T) {
tkn.SetEACLTable(eacl.NewTable())
require.NoError(t, tkn.SignToken(sec))
box, _, err = PackTokens(tkn, nil, &cred.PublicKey)
gate := NewGateData(tkn, &cred.PublicKey)
box, _, err = PackTokens([]*GateData{gate}, nil)
require.NoError(t, err)
data, err := box.Marshal()
@ -59,10 +66,10 @@ func Test_bearer_token_in_access_box(t *testing.T) {
err = box2.Unmarshal(data)
require.NoError(t, err)
tkn2, err := box2.GetBearerToken(cred)
tkns, err := box2.GetTokens(cred)
require.NoError(t, err)
require.Equal(t, tkn, tkn2)
require.Equal(t, tkn, tkns.BearerToken)
}
func Test_accessbox_multiple_keys(t *testing.T) {
@ -78,25 +85,25 @@ func Test_accessbox_multiple_keys(t *testing.T) {
require.NoError(t, tkn.SignToken(sec))
count := 10
pubs := make([]*ecdsa.PublicKey, 0, count)
gates := make([]*GateData, 0, count)
keys := make([]*ecdsa.PrivateKey, 0, count)
{ // generate keys
for i := 0; i < count; i++ {
cred, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
require.NoError(t, err)
pubs = append(pubs, &cred.PublicKey)
gates = append(gates, NewGateData(tkn, &cred.PublicKey))
keys = append(keys, cred)
}
}
box, _, err = PackTokens(tkn, nil, pubs...)
box, _, err = PackTokens(gates, nil)
require.NoError(t, err)
for i, k := range keys {
tkn2, err := box.GetBearerToken(k)
tkns, err := box.GetTokens(k)
require.NoError(t, err, "key #%d: %s failed", i, k)
require.Equal(t, tkn2, tkn)
require.Equal(t, tkns.BearerToken, tkn)
}
}
@ -118,9 +125,10 @@ func Test_unknown_key(t *testing.T) {
tkn.SetEACLTable(eacl.NewTable())
require.NoError(t, tkn.SignToken(sec))
box, _, err = PackTokens(tkn, nil, &cred.PublicKey)
gate := NewGateData(tkn, &cred.PublicKey)
box, _, err = PackTokens([]*GateData{gate}, nil)
require.NoError(t, err)
_, err = box.GetBearerToken(wrongCred)
_, err = box.GetTokens(wrongCred)
require.Error(t, err)
}

27
creds/tokens/credentials.go
View file

@ -13,8 +13,6 @@ import (
cid "github.com/nspcc-dev/neofs-api-go/pkg/container/id"
"github.com/nspcc-dev/neofs-api-go/pkg/object"
"github.com/nspcc-dev/neofs-api-go/pkg/owner"
"github.com/nspcc-dev/neofs-api-go/pkg/session"
"github.com/nspcc-dev/neofs-api-go/pkg/token"
"github.com/nspcc-dev/neofs-s3-gw/creds/accessbox"
"github.com/nspcc-dev/neofs-sdk-go/pkg/pool"
)
@ -22,8 +20,7 @@ import (
type (
// Credentials is a bearer token get/put interface.
Credentials interface {
GetBearerToken(context.Context, *object.Address) (*token.BearerToken, error)
GetSessionToken(context.Context, *object.Address) (*session.Token, error)
GetTokens(context.Context, *object.Address) (*accessbox.GateData, error)
Put(context.Context, *cid.ID, *owner.ID, *accessbox.AccessBox, ...*ecdsa.PublicKey) (*object.Address, error)
}
@ -62,31 +59,13 @@ func (c *cred) releaseBuffer(buf *bytes.Buffer) {
bufferPool.Put(buf)
}
func (c *cred) GetBearerToken(ctx context.Context, address *object.Address) (*token.BearerToken, error) {
func (c *cred) GetTokens(ctx context.Context, address *object.Address) (*accessbox.GateData, error) {
box, err := c.getAccessBox(ctx, address)
if err != nil {
return nil, err
}
tkn, err := box.GetBearerToken(c.key)
if err != nil {
return nil, err
}
return tkn, nil
}
func (c *cred) GetSessionToken(ctx context.Context, address *object.Address) (*session.Token, error) {
box, err := c.getAccessBox(ctx, address)
if err != nil {
return nil, err
}
tkn, err := box.GetSessionToken(c.key)
if err != nil {
return nil, err
}
return tkn, nil
return box.GetTokens(c.key)
}
func (c *cred) getAccessBox(ctx context.Context, address *object.Address) (*accessbox.AccessBox, error) {