2020-07-15 13:48:25 +00:00
|
|
|
package auth
|
|
|
|
|
|
|
|
import (
|
2020-07-20 17:23:16 +00:00
|
|
|
"bytes"
|
2020-08-06 15:23:01 +00:00
|
|
|
"context"
|
2020-07-15 20:16:27 +00:00
|
|
|
"crypto/ecdsa"
|
|
|
|
"io/ioutil"
|
2020-07-16 15:33:47 +00:00
|
|
|
"net/http"
|
|
|
|
"regexp"
|
2020-07-20 23:43:40 +00:00
|
|
|
"strings"
|
2020-08-06 15:23:01 +00:00
|
|
|
"time"
|
2020-07-15 13:48:25 +00:00
|
|
|
|
2020-08-06 15:23:01 +00:00
|
|
|
aws_credentials "github.com/aws/aws-sdk-go/aws/credentials"
|
|
|
|
v4 "github.com/aws/aws-sdk-go/aws/signer/v4"
|
2020-07-15 20:16:27 +00:00
|
|
|
"github.com/nspcc-dev/neofs-api-go/refs"
|
2020-07-15 13:48:25 +00:00
|
|
|
"github.com/nspcc-dev/neofs-api-go/service"
|
2020-08-05 22:40:54 +00:00
|
|
|
"github.com/nspcc-dev/neofs-authmate/accessbox/hcs"
|
2020-08-06 15:09:45 +00:00
|
|
|
"github.com/nspcc-dev/neofs-authmate/credentials"
|
2020-08-05 22:40:54 +00:00
|
|
|
"github.com/nspcc-dev/neofs-authmate/gates"
|
|
|
|
manager "github.com/nspcc-dev/neofs-authmate/neofsmanager"
|
2020-07-15 13:48:25 +00:00
|
|
|
"github.com/pkg/errors"
|
2020-07-20 17:23:16 +00:00
|
|
|
"go.uber.org/zap"
|
2020-07-15 13:48:25 +00:00
|
|
|
)
|
|
|
|
|
2020-07-28 15:27:43 +00:00
|
|
|
var authorizationFieldRegexp = regexp.MustCompile(`AWS4-HMAC-SHA256 Credential=(?P<access_key_id>[^/]+)/(?P<date>[^/]+)/(?P<region>[^/]*)/(?P<service>[^/]+)/aws4_request,\s*SignedHeaders=(?P<signed_header_fields>.+),\s*Signature=(?P<v4_signature>.+)`)
|
2020-07-16 15:33:47 +00:00
|
|
|
|
2020-07-20 17:23:16 +00:00
|
|
|
const emptyStringSHA256 = `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`
|
|
|
|
|
2020-07-15 13:48:25 +00:00
|
|
|
// Center is a central app's authentication/authorization management unit.
|
|
|
|
type Center struct {
|
2020-08-06 15:09:45 +00:00
|
|
|
log *zap.Logger
|
|
|
|
submatcher *regexpSubmatcher
|
|
|
|
neofsCredentials *credentials.Credentials
|
|
|
|
manager *manager.Manager
|
|
|
|
authKeys *hcs.X25519Keys
|
2020-07-15 13:48:25 +00:00
|
|
|
}
|
|
|
|
|
2020-07-15 15:20:45 +00:00
|
|
|
// NewCenter creates an instance of AuthCenter.
|
2020-08-05 22:40:54 +00:00
|
|
|
func NewCenter(log *zap.Logger, neofsNodeAddress string) (*Center, error) {
|
|
|
|
m, err := manager.NewManager(neofsNodeAddress)
|
2020-07-21 10:21:03 +00:00
|
|
|
if err != nil {
|
2020-08-05 22:40:54 +00:00
|
|
|
return nil, err
|
2020-07-21 10:21:03 +00:00
|
|
|
}
|
2020-07-15 20:16:27 +00:00
|
|
|
return &Center{
|
2020-08-05 22:40:54 +00:00
|
|
|
log: log,
|
|
|
|
submatcher: ®expSubmatcher{re: authorizationFieldRegexp},
|
|
|
|
manager: m,
|
2020-07-21 10:21:03 +00:00
|
|
|
}, nil
|
2020-07-15 20:16:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (center *Center) SetNeoFSKeys(key *ecdsa.PrivateKey) error {
|
2020-08-06 17:55:07 +00:00
|
|
|
creds, err := credentials.NewFromKey(key)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2020-08-06 15:09:45 +00:00
|
|
|
center.neofsCredentials = creds
|
2020-07-15 20:16:27 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-07-21 09:44:25 +00:00
|
|
|
func (center *Center) GetNeoFSPrivateKey() *ecdsa.PrivateKey {
|
2020-08-06 15:09:45 +00:00
|
|
|
return center.neofsCredentials.Key()
|
2020-07-15 20:16:27 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (center *Center) GetOwnerID() refs.OwnerID {
|
2020-08-06 15:09:45 +00:00
|
|
|
return center.neofsCredentials.OwnerID()
|
2020-07-15 20:16:27 +00:00
|
|
|
}
|
|
|
|
|
2020-08-06 17:55:07 +00:00
|
|
|
func (center *Center) SetAuthKeys(key hcs.X25519PrivateKey) error {
|
2020-08-05 22:40:54 +00:00
|
|
|
keys, err := hcs.NewKeys(key)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
center.authKeys = keys
|
|
|
|
return nil
|
2020-07-15 13:48:25 +00:00
|
|
|
}
|
|
|
|
|
2020-07-24 14:03:02 +00:00
|
|
|
func (center *Center) AuthenticationPassed(request *http.Request) (*service.BearerTokenMsg, error) {
|
|
|
|
queryValues := request.URL.Query()
|
|
|
|
if queryValues.Get("X-Amz-Algorithm") == "AWS4-HMAC-SHA256" {
|
|
|
|
return nil, errors.New("pre-signed form of request is not supported")
|
|
|
|
}
|
|
|
|
authHeaderField := request.Header["Authorization"]
|
|
|
|
if len(authHeaderField) != 1 {
|
|
|
|
return nil, errors.New("unsupported request: wrong length of Authorization header field")
|
|
|
|
}
|
|
|
|
sms1 := center.submatcher.getSubmatches(authHeaderField[0])
|
|
|
|
if len(sms1) != 6 {
|
|
|
|
return nil, errors.New("bad Authorization header field")
|
|
|
|
}
|
|
|
|
signedHeaderFieldsNames := strings.Split(sms1["signed_header_fields"], ";")
|
|
|
|
if len(signedHeaderFieldsNames) == 0 {
|
|
|
|
return nil, errors.New("wrong format of signed headers part")
|
|
|
|
}
|
2020-08-06 15:23:01 +00:00
|
|
|
signatureDateTime, err := time.Parse("20060102T150405Z", request.Header.Get("X-Amz-Date"))
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "failed to parse x-amz-date header field")
|
|
|
|
}
|
2020-07-24 14:03:02 +00:00
|
|
|
accessKeyID := sms1["access_key_id"]
|
2020-08-06 15:23:01 +00:00
|
|
|
bearerToken, secretAccessKey, err := center.fetchBearerToken(accessKeyID)
|
2020-07-24 14:03:02 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "failed to fetch bearer token")
|
|
|
|
}
|
2020-08-06 15:23:01 +00:00
|
|
|
otherRequest := request.Clone(context.TODO())
|
|
|
|
otherRequest.Header = map[string][]string{}
|
|
|
|
for hfn, hfvs := range request.Header {
|
|
|
|
for _, shfn := range signedHeaderFieldsNames {
|
|
|
|
if strings.EqualFold(hfn, shfn) {
|
|
|
|
otherRequest.Header[hfn] = hfvs
|
2020-07-24 14:03:02 +00:00
|
|
|
}
|
|
|
|
}
|
2020-08-06 15:23:01 +00:00
|
|
|
}
|
|
|
|
awsCreds := aws_credentials.NewStaticCredentials(accessKeyID, secretAccessKey, "")
|
|
|
|
signer := v4.NewSigner(awsCreds)
|
|
|
|
body, err := readAndKeepBody(request)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "failed to read out request body")
|
|
|
|
}
|
|
|
|
_, err = signer.Sign(otherRequest, body, sms1["service"], sms1["region"], signatureDateTime)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "failed to sign temporary HTTP request")
|
|
|
|
}
|
|
|
|
sms2 := center.submatcher.getSubmatches(otherRequest.Header.Get("Authorization"))
|
|
|
|
if sms1["v4_signature"] != sms2["v4_signature"] {
|
|
|
|
return nil, errors.Wrap(err, "failed to pass authentication procedure")
|
|
|
|
}
|
2020-07-24 14:03:02 +00:00
|
|
|
return bearerToken, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (center *Center) fetchBearerToken(accessKeyID string) (*service.BearerTokenMsg, string, error) {
|
2020-08-05 22:40:54 +00:00
|
|
|
akid := new(refs.Address)
|
|
|
|
if err := akid.Parse(accessKeyID); err != nil {
|
|
|
|
return nil, "", errors.Wrap(err, "failed to parse access key id as refs.Address")
|
|
|
|
}
|
|
|
|
config := &gates.ObtainingConfig{
|
|
|
|
BaseConfig: gates.BaseConfig{
|
2020-08-06 15:09:45 +00:00
|
|
|
OperationalCredentials: center.neofsCredentials,
|
|
|
|
Manager: center.manager,
|
2020-08-05 22:40:54 +00:00
|
|
|
},
|
|
|
|
GateKeys: center.authKeys,
|
|
|
|
SecretAddress: akid,
|
|
|
|
}
|
|
|
|
res, err := gates.ObtainSecret(config)
|
2020-07-20 23:43:40 +00:00
|
|
|
if err != nil {
|
2020-08-05 22:40:54 +00:00
|
|
|
return nil, "", errors.Wrap(err, "failed to obtain secret")
|
2020-07-20 23:43:40 +00:00
|
|
|
}
|
2020-08-05 22:40:54 +00:00
|
|
|
return res.BearerToken, res.SecretAccessKey, nil
|
2020-07-16 15:33:47 +00:00
|
|
|
}
|
|
|
|
|
2020-07-21 09:40:46 +00:00
|
|
|
// TODO: Make this write into a smart buffer backed by a file on a fast drive.
|
2020-07-20 23:43:40 +00:00
|
|
|
func readAndKeepBody(request *http.Request) (*bytes.Reader, error) {
|
2020-07-20 17:23:16 +00:00
|
|
|
if request.Body == nil {
|
2020-07-20 23:43:40 +00:00
|
|
|
var r bytes.Reader
|
|
|
|
return &r, nil
|
|
|
|
}
|
|
|
|
payload, err := ioutil.ReadAll(request.Body)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2020-07-20 17:23:16 +00:00
|
|
|
}
|
|
|
|
request.Body = ioutil.NopCloser(bytes.NewReader(payload))
|
2020-07-20 23:43:40 +00:00
|
|
|
return bytes.NewReader(payload), nil
|
2020-07-20 17:23:16 +00:00
|
|
|
}
|
2020-08-06 11:56:40 +00:00
|
|
|
|
|
|
|
func LoadGateAuthPrivateKey(path string) (hcs.X25519PrivateKey, error) {
|
2020-08-06 16:05:15 +00:00
|
|
|
return ioutil.ReadFile(path)
|
2020-08-06 11:56:40 +00:00
|
|
|
}
|