1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab ft=cpp
8 #include <boost/container/static_vector.hpp>
9 #include <boost/algorithm/string/predicate.hpp>
10 #include <boost/algorithm/string.hpp>
12 #include "rgw_swift_auth.h"
15 #include "common/ceph_crypto.h"
16 #include "common/Clock.h"
18 #include "include/random.h"
20 #include "rgw_client_io.h"
21 #include "rgw_http_client.h"
22 #include "rgw_sal_rados.h"
23 #include "include/str_list.h"
25 #define dout_context g_ceph_context
26 #define dout_subsys ceph_subsys_rgw
28 #define DEFAULT_SWIFT_PREFIX "/swift"
31 using namespace ceph::crypto
;
38 /* TempURL: applier */
39 void TempURLApplier::modify_request_state(const DoutPrefixProvider
* dpp
, req_state
* s
) const /* in/out */
41 bool inline_exists
= false;
42 const std::string
& filename
= s
->info
.args
.get("filename");
44 s
->info
.args
.get("inline", &inline_exists
);
46 s
->content_disp
.override
= "inline";
47 } else if (!filename
.empty()) {
49 url_encode(filename
, fenc
);
50 s
->content_disp
.override
= "attachment; filename=\"" + fenc
+ "\"";
53 url_encode(s
->object
->get_name(), fenc
);
54 s
->content_disp
.fallback
= "attachment; filename=\"" + fenc
+ "\"";
57 ldpp_dout(dpp
, 20) << "finished applying changes to req_state for TempURL: "
58 << " content_disp override " << s
->content_disp
.override
59 << " content_disp fallback " << s
->content_disp
.fallback
65 bool TempURLEngine::is_applicable(const req_state
* const s
) const noexcept
67 return s
->info
.args
.exists("temp_url_sig") ||
68 s
->info
.args
.exists("temp_url_expires");
71 void TempURLEngine::get_owner_info(const DoutPrefixProvider
* dpp
, const req_state
* const s
,
72 RGWUserInfo
& owner_info
, optional_yield y
) const
74 /* We cannot use req_state::bucket_name because it isn't available
75 * now. It will be initialized in RGWHandler_REST_SWIFT::postauth_init(). */
76 const string
& bucket_name
= s
->init_state
.url_bucket
;
78 /* TempURL requires that bucket and object names are specified. */
79 if (bucket_name
.empty() || s
->object
->empty()) {
83 /* TempURL case is completely different than the Keystone auth - you may
84 * get account name only through extraction from URL. In turn, knowledge
85 * about account is neccessary to obtain its bucket tenant. Without that,
86 * the access would be limited to accounts with empty tenant. */
88 if (!s
->account_name
.empty()) {
90 std::unique_ptr
<rgw::sal::User
> user
;
92 rgw_user
uid(s
->account_name
);
93 if (uid
.tenant
.empty()) {
94 rgw_user
tenanted_uid(uid
.id
, uid
.id
);
95 user
= store
->get_user(tenanted_uid
);
96 if (user
->load_user(dpp
, s
->yield
) >= 0) {
103 user
= store
->get_user(uid
);
104 if (user
->load_user(dpp
, s
->yield
) < 0) {
109 bucket_tenant
= user
->get_tenant();
113 b
.tenant
= std::move(bucket_tenant
);
114 b
.name
= std::move(bucket_name
);
115 std::unique_ptr
<rgw::sal::Bucket
> bucket
;
116 int ret
= store
->get_bucket(dpp
, nullptr, b
, &bucket
, s
->yield
);
121 ldpp_dout(dpp
, 20) << "temp url user (bucket owner): " << bucket
->get_info().owner
124 std::unique_ptr
<rgw::sal::User
> user
;
125 user
= store
->get_user(bucket
->get_info().owner
);
126 if (user
->load_user(dpp
, s
->yield
) < 0) {
130 owner_info
= user
->get_info();
133 std::string
TempURLEngine::convert_from_iso8601(std::string expires
) const
135 /* Swift's TempURL allows clients to send the expiration as ISO8601-
136 * compatible strings. Though, only plain UNIX timestamp are taken
137 * for the HMAC calculations. We need to make the conversion. */
139 if (!parse_iso8601(expires
.c_str(), &date_t
, nullptr, true)) {
142 return std::to_string(internal_timegm(&date_t
));
146 bool TempURLEngine::is_expired(const std::string
& expires
) const
149 const utime_t now
= ceph_clock_now();
150 const uint64_t expiration
= (uint64_t)strict_strtoll(expires
.c_str(),
153 dout(5) << "failed to parse temp_url_expires: " << err
<< dendl
;
157 if (expiration
<= (uint64_t)now
.sec()) {
158 dout(5) << "temp url expired: " << expiration
<< " <= " << now
.sec() << dendl
;
165 bool TempURLEngine::is_disallowed_header_present(const req_info
& info
) const
167 static const auto headers
= {
168 "HTTP_X_OBJECT_MANIFEST",
171 return std::any_of(std::begin(headers
), std::end(headers
),
172 [&info
](const char* header
) {
173 return info
.env
->exists(header
);
177 std::string
extract_swift_subuser(const std::string
& swift_user_name
)
179 size_t pos
= swift_user_name
.find(':');
180 if (std::string::npos
== pos
) {
181 return swift_user_name
;
183 return swift_user_name
.substr(pos
+ 1);
187 class TempURLEngine::SignatureHelper
190 static constexpr uint32_t output_size
=
191 CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
* 2 + 1;
193 unsigned char dest
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
]; // 20
194 char dest_str
[output_size
];
197 SignatureHelper() = default;
199 const char* calc(const std::string
& key
,
200 const std::string_view
& method
,
201 const std::string_view
& path
,
202 const std::string
& expires
) {
204 using ceph::crypto::HMACSHA1
;
205 using UCHARPTR
= const unsigned char*;
207 HMACSHA1
hmac((UCHARPTR
) key
.c_str(), key
.size());
208 hmac
.Update((UCHARPTR
) method
.data(), method
.size());
209 hmac
.Update((UCHARPTR
) "\n", 1);
210 hmac
.Update((UCHARPTR
) expires
.c_str(), expires
.size());
211 hmac
.Update((UCHARPTR
) "\n", 1);
212 hmac
.Update((UCHARPTR
) path
.data(), path
.size());
215 buf_to_hex((UCHARPTR
) dest
, sizeof(dest
), dest_str
);
220 bool is_equal_to(const std::string
& rhs
) const {
221 /* never allow out-of-range exception */
222 if (rhs
.size() < (output_size
- 1)) {
225 return rhs
.compare(0 /* pos */, output_size
, dest_str
) == 0;
228 }; /* TempURLEngine::SignatureHelper */
230 class TempURLEngine::PrefixableSignatureHelper
231 : private TempURLEngine::SignatureHelper
{
232 using base_t
= SignatureHelper
;
234 const std::string_view decoded_uri
;
235 const std::string_view object_name
;
236 std::string_view no_obj_uri
;
238 const boost::optional
<const std::string
&> prefix
;
241 PrefixableSignatureHelper(const std::string
& _decoded_uri
,
242 const std::string
& object_name
,
243 const boost::optional
<const std::string
&> prefix
)
244 : decoded_uri(_decoded_uri
),
245 object_name(object_name
),
247 /* Transform: v1/acct/cont/obj - > v1/acct/cont/
249 * NOTE(rzarzynski): we really want to substr() on std::string_view,
250 * not std::string. Otherwise we would end with no_obj_uri referencing
253 decoded_uri
.substr(0, decoded_uri
.length() - object_name
.length());
256 const char* calc(const std::string
& key
,
257 const std::string_view
& method
,
258 const std::string_view
& path
,
259 const std::string
& expires
) {
261 return base_t::calc(key
, method
, path
, expires
);
263 const auto prefixed_path
= \
264 string_cat_reserve("prefix:", no_obj_uri
, *prefix
);
265 return base_t::calc(key
, method
, prefixed_path
, expires
);
269 bool is_equal_to(const std::string
& rhs
) const {
270 bool is_auth_ok
= base_t::is_equal_to(rhs
);
272 if (prefix
&& is_auth_ok
) {
273 const auto prefix_uri
= string_cat_reserve(no_obj_uri
, *prefix
);
274 is_auth_ok
= boost::algorithm::starts_with(decoded_uri
, prefix_uri
);
279 }; /* TempURLEngine::PrefixableSignatureHelper */
281 TempURLEngine::result_t
282 TempURLEngine::authenticate(const DoutPrefixProvider
* dpp
, const req_state
* const s
, optional_yield y
) const
284 if (! is_applicable(s
)) {
285 return result_t::deny();
288 /* NOTE(rzarzynski): RGWHTTPArgs::get(), in contrast to RGWEnv::get(),
289 * never returns nullptr. If the requested parameter is absent, we will
290 * get the empty string. */
291 const std::string
& temp_url_sig
= s
->info
.args
.get("temp_url_sig");
292 const std::string
& temp_url_expires
= \
293 convert_from_iso8601(s
->info
.args
.get("temp_url_expires"));
295 if (temp_url_sig
.empty() || temp_url_expires
.empty()) {
296 return result_t::deny();
299 /* Though, for prefixed tempurls we need to differentiate between empty
300 * prefix and lack of prefix. Empty prefix means allowance for whole
302 const boost::optional
<const std::string
&> temp_url_prefix
= \
303 s
->info
.args
.get_optional("temp_url_prefix");
305 RGWUserInfo owner_info
;
307 get_owner_info(dpp
, s
, owner_info
, y
);
309 ldpp_dout(dpp
, 5) << "cannot get user_info of account's owner" << dendl
;
310 return result_t::reject();
313 if (owner_info
.temp_url_keys
.empty()) {
314 ldpp_dout(dpp
, 5) << "user does not have temp url key set, aborting" << dendl
;
315 return result_t::reject();
318 if (is_expired(temp_url_expires
)) {
319 ldpp_dout(dpp
, 5) << "temp url link expired" << dendl
;
320 return result_t::reject(-EPERM
);
323 if (is_disallowed_header_present(s
->info
)) {
324 ldout(cct
, 5) << "temp url rejected due to disallowed header" << dendl
;
325 return result_t::reject(-EINVAL
);
328 /* We need to verify two paths because of compliance with Swift, Tempest
329 * and old versions of RadosGW. The second item will have the prefix
330 * of Swift API entry point removed. */
332 /* XXX can we search this ONCE? */
333 const size_t pos
= g_conf()->rgw_swift_url_prefix
.find_last_not_of('/') + 1;
334 const std::string_view ref_uri
= s
->decoded_uri
;
335 const std::array
<std::string_view
, 2> allowed_paths
= {
337 ref_uri
.substr(pos
+ 1)
340 /* Account owner calculates the signature also against a HTTP method. */
341 boost::container::static_vector
<std::string_view
, 3> allowed_methods
;
342 if (strcmp("HEAD", s
->info
.method
) == 0) {
343 /* HEAD requests are specially handled. */
344 /* TODO: after getting a newer boost (with static_vector supporting
345 * initializers lists), get back to the good notation:
346 * allowed_methods = {"HEAD", "GET", "PUT" };
347 * Just for now let's use emplace_back to construct the vector. */
348 allowed_methods
.emplace_back("HEAD");
349 allowed_methods
.emplace_back("GET");
350 allowed_methods
.emplace_back("PUT");
351 } else if (strlen(s
->info
.method
) > 0) {
352 allowed_methods
.emplace_back(s
->info
.method
);
355 /* Need to try each combination of keys, allowed path and methods. */
356 PrefixableSignatureHelper sig_helper
{
358 s
->object
->get_name(),
362 for (const auto& kv
: owner_info
.temp_url_keys
) {
363 const int temp_url_key_num
= kv
.first
;
364 const string
& temp_url_key
= kv
.second
;
366 if (temp_url_key
.empty()) {
370 for (const auto& path
: allowed_paths
) {
371 for (const auto& method
: allowed_methods
) {
372 const char* const local_sig
= sig_helper
.calc(temp_url_key
, method
,
373 path
, temp_url_expires
);
375 ldpp_dout(dpp
, 20) << "temp url signature [" << temp_url_key_num
376 << "] (calculated): " << local_sig
379 if (sig_helper
.is_equal_to(temp_url_sig
)) {
380 auto apl
= apl_factory
->create_apl_turl(cct
, s
, owner_info
);
381 return result_t::grant(std::move(apl
));
383 ldpp_dout(dpp
, 5) << "temp url signature mismatch: " << local_sig
384 << " != " << temp_url_sig
<< dendl
;
390 return result_t::reject();
395 bool ExternalTokenEngine::is_applicable(const std::string
& token
) const noexcept
399 } else if (g_conf()->rgw_swift_auth_url
.empty()) {
406 ExternalTokenEngine::result_t
407 ExternalTokenEngine::authenticate(const DoutPrefixProvider
* dpp
,
408 const std::string
& token
,
409 const req_state
* const s
, optional_yield y
) const
411 if (! is_applicable(token
)) {
412 return result_t::deny();
415 std::string auth_url
= g_conf()->rgw_swift_auth_url
;
416 if (auth_url
.back() != '/') {
417 auth_url
.append("/");
420 auth_url
.append("token");
421 char url_buf
[auth_url
.size() + 1 + token
.length() + 1];
422 sprintf(url_buf
, "%s/%s", auth_url
.c_str(), token
.c_str());
424 RGWHTTPHeadersCollector
validator(cct
, "GET", url_buf
, { "X-Auth-Groups", "X-Auth-Ttl" });
426 ldpp_dout(dpp
, 10) << "rgw_swift_validate_token url=" << url_buf
<< dendl
;
428 int ret
= validator
.process(y
);
433 std::string swift_user
;
435 std::vector
<std::string
> swift_groups
;
436 get_str_vec(validator
.get_header_value("X-Auth-Groups"),
439 if (0 == swift_groups
.size()) {
440 return result_t::deny(-EPERM
);
442 swift_user
= std::move(swift_groups
[0]);
444 } catch (const std::out_of_range
&) {
445 /* The X-Auth-Groups header isn't present in the response. */
446 return result_t::deny(-EPERM
);
449 if (swift_user
.empty()) {
450 return result_t::deny(-EPERM
);
453 ldpp_dout(dpp
, 10) << "swift user=" << swift_user
<< dendl
;
455 std::unique_ptr
<rgw::sal::User
> user
;
456 ret
= store
->get_user_by_swift(dpp
, swift_user
, s
->yield
, &user
);
458 ldpp_dout(dpp
, 0) << "NOTICE: couldn't map swift user" << dendl
;
462 auto apl
= apl_factory
->create_apl_local(cct
, s
, user
->get_info(),
463 extract_swift_subuser(swift_user
),
465 return result_t::grant(std::move(apl
));
468 static int build_token(const string
& swift_user
,
470 const uint64_t nonce
,
471 const utime_t
& expiration
,
475 encode(swift_user
, bl
);
477 encode(expiration
, bl
);
479 bufferptr
p(CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
);
481 char buf
[bl
.length() * 2 + 1];
482 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(), buf
);
483 dout(20) << "build_token token=" << buf
<< dendl
;
485 char k
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
];
486 // FIPS zeroization audit 20191116: this memset is not intended to
487 // wipe out a secret after use.
488 memset(k
, 0, sizeof(k
));
489 const char *s
= key
.c_str();
490 for (int i
= 0; i
< (int)key
.length(); i
++, s
++) {
491 k
[i
% CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
] |= *s
;
493 calc_hmac_sha1(k
, sizeof(k
), bl
.c_str(), bl
.length(), p
.c_str());
494 ::ceph::crypto::zeroize_for_security(k
, sizeof(k
));
502 static int encode_token(CephContext
*cct
, string
& swift_user
, string
& key
,
505 const auto nonce
= ceph::util::generate_random_number
<uint64_t>();
507 utime_t expiration
= ceph_clock_now();
508 expiration
+= cct
->_conf
->rgw_swift_token_expiration
;
510 return build_token(swift_user
, key
, nonce
, expiration
, bl
);
514 /* AUTH_rgwtk (signed token): engine */
515 bool SignedTokenEngine::is_applicable(const std::string
& token
) const noexcept
520 return token
.compare(0, 10, "AUTH_rgwtk") == 0;
524 SignedTokenEngine::result_t
525 SignedTokenEngine::authenticate(const DoutPrefixProvider
* dpp
,
526 const std::string
& token
,
527 const req_state
* const s
) const
529 if (! is_applicable(token
)) {
530 return result_t::deny(-EPERM
);
533 /* Effective token string is the part after the prefix. */
534 const std::string etoken
= token
.substr(strlen("AUTH_rgwtk"));
535 const size_t etoken_len
= etoken
.length();
537 if (etoken_len
& 1) {
538 ldpp_dout(dpp
, 0) << "NOTICE: failed to verify token: odd token length="
539 << etoken_len
<< dendl
;
543 ceph::bufferptr
p(etoken_len
/2);
544 int ret
= hex_to_buf(etoken
.c_str(), p
.c_str(), etoken_len
);
549 ceph::bufferlist tok_bl
;
554 std::string swift_user
;
557 auto iter
= tok_bl
.cbegin();
560 decode(swift_user
, iter
);
562 decode(expiration
, iter
);
563 } catch (buffer::error
& err
) {
564 ldpp_dout(dpp
, 0) << "NOTICE: failed to decode token" << dendl
;
568 const utime_t now
= ceph_clock_now();
569 if (expiration
< now
) {
570 ldpp_dout(dpp
, 0) << "NOTICE: old timed out token was used now=" << now
571 << " token.expiration=" << expiration
573 return result_t::deny(-EPERM
);
576 std::unique_ptr
<rgw::sal::User
> user
;
577 ret
= store
->get_user_by_swift(dpp
, swift_user
, s
->yield
, &user
);
582 ldpp_dout(dpp
, 10) << "swift_user=" << swift_user
<< dendl
;
584 const auto siter
= user
->get_info().swift_keys
.find(swift_user
);
585 if (siter
== std::end(user
->get_info().swift_keys
)) {
586 return result_t::deny(-EPERM
);
589 const auto swift_key
= siter
->second
;
591 bufferlist local_tok_bl
;
592 ret
= build_token(swift_user
, swift_key
.key
, nonce
, expiration
, local_tok_bl
);
597 if (local_tok_bl
.length() != tok_bl
.length()) {
598 ldpp_dout(dpp
, 0) << "NOTICE: tokens length mismatch:"
599 << " tok_bl.length()=" << tok_bl
.length()
600 << " local_tok_bl.length()=" << local_tok_bl
.length()
602 return result_t::deny(-EPERM
);
605 if (memcmp(local_tok_bl
.c_str(), tok_bl
.c_str(),
606 local_tok_bl
.length()) != 0) {
607 char buf
[local_tok_bl
.length() * 2 + 1];
609 buf_to_hex(reinterpret_cast<const unsigned char *>(local_tok_bl
.c_str()),
610 local_tok_bl
.length(), buf
);
612 ldpp_dout(dpp
, 0) << "NOTICE: tokens mismatch tok=" << buf
<< dendl
;
613 return result_t::deny(-EPERM
);
616 auto apl
= apl_factory
->create_apl_local(cct
, s
, user
->get_info(),
617 extract_swift_subuser(swift_user
),
619 return result_t::grant(std::move(apl
));
622 } /* namespace swift */
623 } /* namespace auth */
624 } /* namespace rgw */
627 void RGW_SWIFT_Auth_Get::execute(optional_yield y
)
631 const char *key
= s
->info
.env
->get("HTTP_X_AUTH_KEY");
632 const char *user_name
= s
->info
.env
->get("HTTP_X_AUTH_USER");
634 s
->prot_flags
|= RGW_REST_SWIFT
;
637 std::unique_ptr
<rgw::sal::User
> user
;
639 RGWAccessKey
*swift_key
;
640 map
<string
, RGWAccessKey
>::iterator siter
;
642 string swift_url
= g_conf()->rgw_swift_url
;
643 string swift_prefix
= g_conf()->rgw_swift_url_prefix
;
647 * We did not allow an empty Swift prefix before, but we want it now.
648 * So, we take rgw_swift_url_prefix = "/" to yield the empty prefix.
649 * The rgw_swift_url_prefix = "" is the default and yields "/swift"
650 * in a backwards-compatible way.
652 if (swift_prefix
.size() == 0) {
653 swift_prefix
= DEFAULT_SWIFT_PREFIX
;
654 } else if (swift_prefix
== "/") {
655 swift_prefix
.clear();
657 if (swift_prefix
[0] != '/') {
658 swift_prefix
.insert(0, "/");
662 if (swift_url
.size() == 0) {
663 bool add_port
= false;
664 const char *server_port
= s
->info
.env
->get("SERVER_PORT_SECURE");
665 const char *protocol
;
667 add_port
= (strcmp(server_port
, "443") != 0);
670 server_port
= s
->info
.env
->get("SERVER_PORT");
671 add_port
= (strcmp(server_port
, "80") != 0);
674 const char *host
= s
->info
.env
->get("HTTP_HOST");
676 dout(0) << "NOTICE: server is misconfigured, missing rgw_swift_url_prefix or rgw_swift_url, HTTP_HOST is not set" << dendl
;
680 swift_url
= protocol
;
681 swift_url
.append("://");
682 swift_url
.append(host
);
683 if (add_port
&& !strchr(host
, ':')) {
684 swift_url
.append(":");
685 swift_url
.append(server_port
);
689 if (!key
|| !user_name
)
692 user_str
= user_name
;
694 ret
= store
->get_user_by_swift(s
, user_str
, s
->yield
, &user
);
700 siter
= user
->get_info().swift_keys
.find(user_str
);
701 if (siter
== user
->get_info().swift_keys
.end()) {
705 swift_key
= &siter
->second
;
707 if (swift_key
->key
.compare(key
) != 0) {
708 dout(0) << "NOTICE: RGW_SWIFT_Auth_Get::execute(): bad swift key" << dendl
;
713 if (!g_conf()->rgw_swift_tenant_name
.empty()) {
714 tenant_path
= "/AUTH_";
715 tenant_path
.append(g_conf()->rgw_swift_tenant_name
);
716 } else if (g_conf()->rgw_swift_account_in_url
) {
717 tenant_path
= "/AUTH_";
718 tenant_path
.append(user
->get_id().to_str());
721 dump_header(s
, "X-Storage-Url", swift_url
+ swift_prefix
+ "/v1" +
724 using rgw::auth::swift::encode_token
;
725 if ((ret
= encode_token(s
->cct
, swift_key
->id
, swift_key
->key
, bl
)) < 0)
729 static constexpr size_t PREFIX_LEN
= sizeof("AUTH_rgwtk") - 1;
730 char token_val
[PREFIX_LEN
+ bl
.length() * 2 + 1];
732 snprintf(token_val
, PREFIX_LEN
+ 1, "AUTH_rgwtk");
733 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(),
734 token_val
+ PREFIX_LEN
);
736 dump_header(s
, "X-Storage-Token", token_val
);
737 dump_header(s
, "X-Auth-Token", token_val
);
740 ret
= STATUS_NO_CONTENT
;
743 set_req_state_err(s
, ret
);
748 int RGWHandler_SWIFT_Auth::init(rgw::sal::Store
* store
, struct req_state
*state
,
749 rgw::io::BasicClient
*cio
)
751 state
->dialect
= "swift-auth";
752 state
->formatter
= new JSONFormatter
;
753 state
->format
= RGW_FORMAT_JSON
;
755 return RGWHandler::init(store
, state
, cio
);
758 int RGWHandler_SWIFT_Auth::authorize(const DoutPrefixProvider
*dpp
, optional_yield
)
763 RGWOp
*RGWHandler_SWIFT_Auth::op_get()
765 return new RGW_SWIFT_Auth_Get
;