Compare commits

...

2 Commits

2 changed files with 51 additions and 14 deletions

View File

@ -58,7 +58,13 @@ func Authenticate(store peering.Store, key *rsa.PublicKey, funcs ...OptionFunc)
return return
} }
clientClaims, err := assertClientToken(serverClaims.PeerID, store, clientToken) clientClaims, err := assertClientToken(
serverClaims.PeerID,
store,
clientToken,
logger,
options.IgnoredClientTokenErrors...,
)
if err != nil { if err != nil {
logger.Printf("[ERROR] %s", err) logger.Printf("[ERROR] %s", err)
switch err { switch err {
@ -78,11 +84,12 @@ func Authenticate(store peering.Store, key *rsa.PublicKey, funcs ...OptionFunc)
return return
} }
sendError(w, http.StatusForbidden) sendError(w, http.StatusForbidden)
return
default: default:
sendError(w, http.StatusInternalServerError) sendError(w, http.StatusInternalServerError)
}
return return
} }
}
match, body, err := assertBodySum(r.Body, clientClaims.BodySum) match, body, err := assertBodySum(r.Body, clientClaims.BodySum)
if err != nil { if err != nil {
@ -145,7 +152,7 @@ func assertServerToken(key *rsa.PublicKey, serverToken string) (*peering.ServerT
return claims, nil return claims, nil
} }
func assertClientToken(peerID peering.PeerID, store peering.Store, clientToken string) (*peering.ClientTokenClaims, error) { func assertClientToken(peerID peering.PeerID, store peering.Store, clientToken string, logger Logger, ignoredValidationErrors ...uint32) (*peering.ClientTokenClaims, error) {
fn := func(token *jwt.Token) (interface{}, error) { fn := func(token *jwt.Token) (interface{}, error) {
peer, err := store.Get(peerID) peer, err := store.Get(peerID)
if err != nil { if err != nil {
@ -163,17 +170,8 @@ func assertClientToken(peerID peering.PeerID, store peering.Store, clientToken s
} }
return publicKey, nil return publicKey, nil
} }
token, err := jwt.ParseWithClaims(clientToken, &peering.ClientTokenClaims{}, fn)
if err != nil { getPeeringClaims := func(token *jwt.Token) (*peering.ClientTokenClaims, error) {
validationError, ok := err.(*jwt.ValidationError)
if ok {
return nil, validationError.Inner
}
return nil, err
}
if !token.Valid {
return nil, ErrInvalidClaims
}
claims, ok := token.Claims.(*peering.ClientTokenClaims) claims, ok := token.Claims.(*peering.ClientTokenClaims)
if !ok { if !ok {
return nil, ErrInvalidClaims return nil, ErrInvalidClaims
@ -181,6 +179,28 @@ func assertClientToken(peerID peering.PeerID, store peering.Store, clientToken s
return claims, nil return claims, nil
} }
token, err := jwt.ParseWithClaims(clientToken, &peering.ClientTokenClaims{}, fn)
if err != nil {
validationError, ok := err.(*jwt.ValidationError)
if ok {
for _, c := range ignoredValidationErrors {
if validationError.Errors&c != 0 {
logger.Printf("ignoring token validation error: '%s'", validationError.Inner)
return getPeeringClaims(token)
}
}
return nil, validationError.Inner
}
return nil, err
}
if !token.Valid {
return nil, ErrInvalidClaims
}
return getPeeringClaims(token)
}
func assertBodySum(rc io.ReadCloser, bodySum []byte) (bool, []byte, error) { func assertBodySum(rc io.ReadCloser, bodySum []byte) (bool, []byte, error) {
body, err := ioutil.ReadAll(rc) body, err := ioutil.ReadAll(rc)
if err != nil { if err != nil {
@ -200,6 +220,15 @@ func sendError(w http.ResponseWriter, status int) {
http.Error(w, http.StatusText(status), status) http.Error(w, http.StatusText(status), status)
} }
func filterIgnoredValidationError(err *jwt.ValidationError, ignored ...uint32) error {
for _, c := range ignored {
if err.Errors&c != 0 {
return nil
}
}
return err
}
func compareChecksum(body []byte, sum []byte) (bool, error) { func compareChecksum(body []byte, sum []byte) (bool, error) {
sha := sha256.New() sha := sha256.New()
_, err := sha.Write(body) _, err := sha.Write(body)

View File

@ -14,6 +14,7 @@ type Options struct {
PeerAttributes []string PeerAttributes []string
ErrorHandler ErrorHandler ErrorHandler ErrorHandler
Logger Logger Logger Logger
IgnoredClientTokenErrors []uint32
} }
type OptionFunc func(*Options) type OptionFunc func(*Options)
@ -38,12 +39,19 @@ func WithErrorHandler(handler ErrorHandler) OptionFunc {
} }
} }
func WithIgnoredClientTokenErrors(codes ...uint32) OptionFunc {
return func(options *Options) {
options.IgnoredClientTokenErrors = codes
}
}
func defaultOptions() *Options { func defaultOptions() *Options {
logger := log.New(os.Stdout, "[go-http-peering] ", log.LstdFlags|log.Lshortfile) logger := log.New(os.Stdout, "[go-http-peering] ", log.LstdFlags|log.Lshortfile)
return &Options{ return &Options{
PeerAttributes: []string{"Label"}, PeerAttributes: []string{"Label"},
ErrorHandler: DefaultErrorHandler, ErrorHandler: DefaultErrorHandler,
Logger: logger, Logger: logger,
IgnoredClientTokenErrors: make([]uint32, 0),
} }
} }