go-http-peering/server/middleware.go

188 lines
4.5 KiB
Go
Raw Normal View History

2019-02-03 20:56:58 +01:00
package server
import (
"bytes"
"context"
2019-02-22 17:35:49 +01:00
"crypto/rsa"
2019-02-03 20:56:58 +01:00
"crypto/sha256"
"errors"
2019-02-22 17:35:49 +01:00
"io"
2019-02-03 20:56:58 +01:00
"io/ioutil"
"time"
2019-02-22 17:35:49 +01:00
peeringCrypto "forge.cadoles.com/wpetit/go-http-peering/crypto"
2019-02-03 20:56:58 +01:00
peering "forge.cadoles.com/wpetit/go-http-peering"
jwt "github.com/dgrijalva/jwt-go"
"net/http"
)
const (
2019-02-22 17:35:49 +01:00
ServerTokenHeader = "X-Server-Token" // nolint: gosec
ClientTokenHeader = "X-Client-Token"
KeyPeerID ContextKey = "PeerID"
2019-02-03 20:56:58 +01:00
)
var (
ErrInvalidClaims = errors.New("invalid claims")
ErrInvalidChecksum = errors.New("invalid checksum")
ErrNotPeered = errors.New("not peered")
)
type ContextKey string
2019-02-22 17:35:49 +01:00
func Authenticate(store peering.Store, key *rsa.PublicKey, funcs ...OptionFunc) func(http.Handler) http.Handler {
2019-02-03 20:56:58 +01:00
options := createOptions(funcs...)
logger := options.Logger
middleware := func(next http.Handler) http.Handler {
fn := func(w http.ResponseWriter, r *http.Request) {
2019-02-22 17:35:49 +01:00
serverToken := r.Header.Get(ServerTokenHeader)
if serverToken == "" {
2019-02-03 20:56:58 +01:00
sendError(w, http.StatusUnauthorized)
return
}
2019-02-22 17:35:49 +01:00
clientToken := r.Header.Get(ClientTokenHeader)
if clientToken == "" {
2019-02-03 20:56:58 +01:00
sendError(w, http.StatusUnauthorized)
return
}
2019-02-22 17:35:49 +01:00
serverClaims, err := assertServerToken(key, serverToken)
if err != nil {
2019-02-03 20:56:58 +01:00
logger.Printf("[ERROR] %s", err)
sendError(w, http.StatusUnauthorized)
return
}
2019-02-22 17:35:49 +01:00
clientClaims, err := assertClientToken(serverClaims.PeerID, store, clientToken)
2019-02-03 20:56:58 +01:00
if err != nil {
logger.Printf("[ERROR] %s", err)
if err == peering.ErrPeerNotFound || err == ErrNotPeered {
2019-02-22 17:35:49 +01:00
sendError(w, http.StatusUnauthorized)
} else {
sendError(w, http.StatusInternalServerError)
}
2019-02-03 20:56:58 +01:00
return
}
2019-02-22 17:35:49 +01:00
match, body, err := assertBodySum(r.Body, clientClaims.BodySum)
2019-02-03 20:56:58 +01:00
if err != nil {
logger.Printf("[ERROR] %s", err)
2019-02-22 17:35:49 +01:00
sendError(w, http.StatusInternalServerError)
2019-02-03 20:56:58 +01:00
return
}
if !match {
logger.Printf("[ERROR] %s", ErrInvalidChecksum)
sendError(w, http.StatusBadRequest)
return
}
2019-02-22 17:35:49 +01:00
if err := store.UpdateLastContact(serverClaims.PeerID, r.RemoteAddr, time.Now()); err != nil {
2019-02-03 20:56:58 +01:00
logger.Printf("[ERROR] %s", err)
sendError(w, http.StatusInternalServerError)
return
}
2019-02-22 17:35:49 +01:00
ctx := context.WithValue(r.Context(), KeyPeerID, serverClaims.PeerID)
2019-02-03 20:56:58 +01:00
r = r.WithContext(ctx)
r.Body = ioutil.NopCloser(bytes.NewBuffer(body))
next.ServeHTTP(w, r)
}
return http.HandlerFunc(fn)
}
return middleware
}
func GetPeerID(r *http.Request) (peering.PeerID, error) {
peerID, ok := r.Context().Value(KeyPeerID).(peering.PeerID)
if !ok {
return "", ErrUnauthorized
}
return peerID, nil
}
2019-02-22 17:35:49 +01:00
func assertServerToken(key *rsa.PublicKey, serverToken string) (*peering.ServerTokenClaims, error) {
fn := func(token *jwt.Token) (interface{}, error) {
return key, nil
}
token, err := jwt.ParseWithClaims(serverToken, &peering.ServerTokenClaims{}, fn)
if err != nil {
return nil, err
}
if !token.Valid {
return nil, ErrInvalidClaims
}
claims, ok := token.Claims.(*peering.ServerTokenClaims)
if !ok {
return nil, ErrInvalidClaims
}
return claims, nil
}
func assertClientToken(peerID peering.PeerID, store peering.Store, clientToken string) (*peering.ClientTokenClaims, error) {
fn := func(token *jwt.Token) (interface{}, error) {
peer, err := store.Get(peerID)
if err != nil {
return nil, err
}
if peer.Status == peering.StatusRejected {
return nil, ErrPeerRejected
}
if peer.Status != peering.StatusPeered {
return nil, ErrNotPeered
}
publicKey, err := peeringCrypto.DecodePEMToPublicKey(peer.PublicKey)
if err != nil {
return nil, err
}
return publicKey, nil
}
token, err := jwt.ParseWithClaims(clientToken, &peering.ClientTokenClaims{}, fn)
if err != nil {
return nil, err
}
if !token.Valid {
return nil, ErrInvalidClaims
}
claims, ok := token.Claims.(*peering.ClientTokenClaims)
if !ok {
return nil, ErrInvalidClaims
}
return claims, nil
}
func assertBodySum(rc io.ReadCloser, bodySum []byte) (bool, []byte, error) {
body, err := ioutil.ReadAll(rc)
if err != nil {
return false, nil, err
}
if err := rc.Close(); err != nil {
return false, nil, err
}
match, err := compareChecksum(body, bodySum)
if err != nil {
return false, nil, err
}
return match, body, nil
}
2019-02-03 20:56:58 +01:00
func sendError(w http.ResponseWriter, status int) {
http.Error(w, http.StatusText(status), status)
}
func compareChecksum(body []byte, sum []byte) (bool, error) {
sha := sha256.New()
_, err := sha.Write(body)
if err != nil {
return false, err
}
return bytes.Equal(sum, sha.Sum(nil)), nil
}