1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
6 #include <boost/utility/string_view.hpp>
7 #include <boost/container/static_vector.hpp>
8 #include <boost/algorithm/string/predicate.hpp>
9 #include <boost/algorithm/string.hpp>
11 #include "rgw_swift_auth.h"
14 #include "common/ceph_crypto.h"
15 #include "common/Clock.h"
17 #include "auth/Crypto.h"
19 #include "rgw_client_io.h"
20 #include "rgw_http_client.h"
21 #include "include/str_list.h"
23 #define dout_context g_ceph_context
24 #define dout_subsys ceph_subsys_rgw
26 #define DEFAULT_SWIFT_PREFIX "/swift"
28 using namespace ceph::crypto
;
35 /* TempURL: applier */
36 void TempURLApplier::modify_request_state(req_state
* s
) const /* in/out */
38 bool inline_exists
= false;
39 const std::string
& filename
= s
->info
.args
.get("filename");
41 s
->info
.args
.get("inline", &inline_exists
);
43 s
->content_disp
.override
= "inline";
44 } else if (!filename
.empty()) {
46 url_encode(filename
, fenc
);
47 s
->content_disp
.override
= "attachment; filename=\"" + fenc
+ "\"";
50 url_encode(s
->object
.name
, fenc
);
51 s
->content_disp
.fallback
= "attachment; filename=\"" + fenc
+ "\"";
54 ldout(s
->cct
, 20) << "finished applying changes to req_state for TempURL: "
55 << " content_disp override " << s
->content_disp
.override
56 << " content_disp fallback " << s
->content_disp
.fallback
62 bool TempURLEngine::is_applicable(const req_state
* const s
) const noexcept
64 return s
->info
.args
.exists("temp_url_sig") ||
65 s
->info
.args
.exists("temp_url_expires");
68 void TempURLEngine::get_owner_info(const req_state
* const s
,
69 RGWUserInfo
& owner_info
) const
71 /* We cannot use req_state::bucket_name because it isn't available
72 * now. It will be initialized in RGWHandler_REST_SWIFT::postauth_init(). */
73 const string
& bucket_name
= s
->init_state
.url_bucket
;
75 /* TempURL requires that bucket and object names are specified. */
76 if (bucket_name
.empty() || s
->object
.empty()) {
80 /* TempURL case is completely different than the Keystone auth - you may
81 * get account name only through extraction from URL. In turn, knowledge
82 * about account is neccessary to obtain its bucket tenant. Without that,
83 * the access would be limited to accounts with empty tenant. */
85 if (!s
->account_name
.empty()) {
89 const rgw_user
uid(s
->account_name
);
90 if (uid
.tenant
.empty()) {
91 const rgw_user
tenanted_uid(uid
.id
, uid
.id
);
93 if (rgw_get_user_info_by_uid(store
, tenanted_uid
, uinfo
) >= 0) {
95 bucket_tenant
= uinfo
.user_id
.tenant
;
100 if (!found
&& rgw_get_user_info_by_uid(store
, uid
, uinfo
) < 0) {
103 bucket_tenant
= uinfo
.user_id
.tenant
;
107 /* Need to get user info of bucket owner. */
108 RGWBucketInfo bucket_info
;
109 int ret
= store
->get_bucket_info(*static_cast<RGWObjectCtx
*>(s
->obj_ctx
),
110 bucket_tenant
, bucket_name
,
111 bucket_info
, nullptr);
116 ldout(cct
, 20) << "temp url user (bucket owner): " << bucket_info
.owner
119 if (rgw_get_user_info_by_uid(store
, bucket_info
.owner
, owner_info
) < 0) {
124 bool TempURLEngine::is_expired(const std::string
& expires
) const
127 const utime_t now
= ceph_clock_now();
128 const uint64_t expiration
= (uint64_t)strict_strtoll(expires
.c_str(),
131 dout(5) << "failed to parse temp_url_expires: " << err
<< dendl
;
135 if (expiration
<= (uint64_t)now
.sec()) {
136 dout(5) << "temp url expired: " << expiration
<< " <= " << now
.sec() << dendl
;
143 std::string
extract_swift_subuser(const std::string
& swift_user_name
) {
144 size_t pos
= swift_user_name
.find(':');
145 if (std::string::npos
== pos
) {
146 return swift_user_name
;
148 return swift_user_name
.substr(pos
+ 1);
152 class TempURLEngine::SignatureHelper
155 static constexpr uint32_t output_size
=
156 CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
* 2 + 1;
158 unsigned char dest
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
]; // 20
159 char dest_str
[output_size
];
162 SignatureHelper() = default;
164 const char* calc(const std::string
& key
,
165 const boost::string_view
& method
,
166 const boost::string_view
& path
,
167 const std::string
& expires
) {
169 using ceph::crypto::HMACSHA1
;
170 using UCHARPTR
= const unsigned char*;
172 HMACSHA1
hmac((UCHARPTR
) key
.c_str(), key
.size());
173 hmac
.Update((UCHARPTR
) method
.data(), method
.size());
174 hmac
.Update((UCHARPTR
) "\n", 1);
175 hmac
.Update((UCHARPTR
) expires
.c_str(), expires
.size());
176 hmac
.Update((UCHARPTR
) "\n", 1);
177 hmac
.Update((UCHARPTR
) path
.data(), path
.size());
180 buf_to_hex((UCHARPTR
) dest
, sizeof(dest
), dest_str
);
185 bool is_equal_to(const std::string
& rhs
) const {
186 /* never allow out-of-range exception */
187 if (rhs
.size() < (output_size
- 1)) {
190 return rhs
.compare(0 /* pos */, output_size
, dest_str
) == 0;
193 }; /* TempURLEngine::SignatureHelper */
195 class TempURLEngine::PrefixableSignatureHelper
196 : private TempURLEngine::SignatureHelper
{
197 using base_t
= SignatureHelper
;
199 const boost::string_view decoded_uri
;
200 const boost::string_view object_name
;
201 boost::string_view no_obj_uri
;
203 const boost::optional
<const std::string
&> prefix
;
206 PrefixableSignatureHelper(const std::string
& decoded_uri
,
207 const std::string
& object_name
,
208 const boost::optional
<const std::string
&> prefix
)
209 : decoded_uri(decoded_uri
),
210 object_name(object_name
),
212 /* Transform: v1/acct/cont/obj - > v1/acct/cont/ */
214 decoded_uri
.substr(0, decoded_uri
.length() - object_name
.length());
217 const char* calc(const std::string
& key
,
218 const boost::string_view
& method
,
219 const boost::string_view
& path
,
220 const std::string
& expires
) {
222 return base_t::calc(key
, method
, path
, expires
);
224 const auto prefixed_path
= \
225 string_cat_reserve("prefix:", no_obj_uri
, *prefix
);
226 return base_t::calc(key
, method
, prefixed_path
, expires
);
230 bool is_equal_to(const std::string
& rhs
) const {
231 bool is_auth_ok
= base_t::is_equal_to(rhs
);
233 if (prefix
&& is_auth_ok
) {
234 const auto prefix_uri
= string_cat_reserve(no_obj_uri
, *prefix
);
235 is_auth_ok
= boost::algorithm::starts_with(decoded_uri
, prefix_uri
);
240 }; /* TempURLEngine::PrefixableSignatureHelper */
242 TempURLEngine::result_t
243 TempURLEngine::authenticate(const req_state
* const s
) const
245 if (! is_applicable(s
)) {
246 return result_t::deny();
249 /* NOTE(rzarzynski): RGWHTTPArgs::get(), in contrast to RGWEnv::get(),
250 * never returns nullptr. If the requested parameter is absent, we will
251 * get the empty string. */
252 const std::string
& temp_url_sig
= s
->info
.args
.get("temp_url_sig");
253 const std::string
& temp_url_expires
= s
->info
.args
.get("temp_url_expires");
255 if (temp_url_sig
.empty() || temp_url_expires
.empty()) {
256 return result_t::deny();
259 /* Though, for prefixed tempurls we need to differentiate between empty
260 * prefix and lack of prefix. Empty prefix means allowance for whole
262 const boost::optional
<const std::string
&> temp_url_prefix
= \
263 s
->info
.args
.get_optional("temp_url_prefix");
265 RGWUserInfo owner_info
;
267 get_owner_info(s
, owner_info
);
269 ldout(cct
, 5) << "cannot get user_info of account's owner" << dendl
;
270 return result_t::reject();
273 if (owner_info
.temp_url_keys
.empty()) {
274 ldout(cct
, 5) << "user does not have temp url key set, aborting" << dendl
;
275 return result_t::reject();
278 if (is_expired(temp_url_expires
)) {
279 ldout(cct
, 5) << "temp url link expired" << dendl
;
280 return result_t::reject(-EPERM
);
283 /* We need to verify two paths because of compliance with Swift, Tempest
284 * and old versions of RadosGW. The second item will have the prefix
285 * of Swift API entry point removed. */
287 /* XXX can we search this ONCE? */
288 const size_t pos
= g_conf
->rgw_swift_url_prefix
.find_last_not_of('/') + 1;
289 const boost::string_view ref_uri
= s
->decoded_uri
;
290 const std::array
<boost::string_view
, 2> allowed_paths
= {
292 ref_uri
.substr(pos
+ 1)
295 /* Account owner calculates the signature also against a HTTP method. */
296 boost::container::static_vector
<boost::string_view
, 3> allowed_methods
;
297 if (strcmp("HEAD", s
->info
.method
) == 0) {
298 /* HEAD requests are specially handled. */
299 /* TODO: after getting a newer boost (with static_vector supporting
300 * initializers lists), get back to the good notation:
301 * allowed_methods = {"HEAD", "GET", "PUT" };
302 * Just for now let's use emplace_back to construct the vector. */
303 allowed_methods
.emplace_back("HEAD");
304 allowed_methods
.emplace_back("GET");
305 allowed_methods
.emplace_back("PUT");
306 } else if (strlen(s
->info
.method
) > 0) {
307 allowed_methods
.emplace_back(s
->info
.method
);
310 /* Need to try each combination of keys, allowed path and methods. */
311 PrefixableSignatureHelper sig_helper
{
317 for (const auto& kv
: owner_info
.temp_url_keys
) {
318 const int temp_url_key_num
= kv
.first
;
319 const string
& temp_url_key
= kv
.second
;
321 if (temp_url_key
.empty()) {
325 for (const auto& path
: allowed_paths
) {
326 for (const auto& method
: allowed_methods
) {
327 const char* const local_sig
= sig_helper
.calc(temp_url_key
, method
,
328 path
, temp_url_expires
);
330 ldout(s
->cct
, 20) << "temp url signature [" << temp_url_key_num
331 << "] (calculated): " << local_sig
334 if (sig_helper
.is_equal_to(temp_url_sig
)) {
335 auto apl
= apl_factory
->create_apl_turl(cct
, s
, owner_info
);
336 return result_t::grant(std::move(apl
));
338 ldout(s
->cct
, 5) << "temp url signature mismatch: " << local_sig
339 << " != " << temp_url_sig
<< dendl
;
345 return result_t::reject();
350 bool ExternalTokenEngine::is_applicable(const std::string
& token
) const noexcept
354 } else if (g_conf
->rgw_swift_auth_url
.empty()) {
361 ExternalTokenEngine::result_t
362 ExternalTokenEngine::authenticate(const std::string
& token
,
363 const req_state
* const s
) const
365 if (! is_applicable(token
)) {
366 return result_t::deny();
369 std::string auth_url
= g_conf
->rgw_swift_auth_url
;
370 if (auth_url
.back() != '/') {
371 auth_url
.append("/");
374 auth_url
.append("token");
375 char url_buf
[auth_url
.size() + 1 + token
.length() + 1];
376 sprintf(url_buf
, "%s/%s", auth_url
.c_str(), token
.c_str());
378 RGWHTTPHeadersCollector
validator(cct
, { "X-Auth-Groups", "X-Auth-Ttl" });
380 ldout(cct
, 10) << "rgw_swift_validate_token url=" << url_buf
<< dendl
;
382 int ret
= validator
.process(url_buf
);
387 std::string swift_user
;
389 std::vector
<std::string
> swift_groups
;
390 get_str_vec(validator
.get_header_value("X-Auth-Groups"),
393 if (0 == swift_groups
.size()) {
394 return result_t::deny(-EPERM
);
396 swift_user
= std::move(swift_groups
[0]);
398 } catch (std::out_of_range
) {
399 /* The X-Auth-Groups header isn't present in the response. */
400 return result_t::deny(-EPERM
);
403 if (swift_user
.empty()) {
404 return result_t::deny(-EPERM
);
407 ldout(cct
, 10) << "swift user=" << swift_user
<< dendl
;
409 RGWUserInfo tmp_uinfo
;
410 ret
= rgw_get_user_info_by_swift(store
, swift_user
, tmp_uinfo
);
412 ldout(cct
, 0) << "NOTICE: couldn't map swift user" << dendl
;
416 auto apl
= apl_factory
->create_apl_local(cct
, s
, tmp_uinfo
,
417 extract_swift_subuser(swift_user
));
418 return result_t::grant(std::move(apl
));
421 static int build_token(const string
& swift_user
,
423 const uint64_t nonce
,
424 const utime_t
& expiration
,
427 ::encode(swift_user
, bl
);
429 ::encode(expiration
, bl
);
431 bufferptr
p(CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
);
433 char buf
[bl
.length() * 2 + 1];
434 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(), buf
);
435 dout(20) << "build_token token=" << buf
<< dendl
;
437 char k
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
];
438 memset(k
, 0, sizeof(k
));
439 const char *s
= key
.c_str();
440 for (int i
= 0; i
< (int)key
.length(); i
++, s
++) {
441 k
[i
% CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
] |= *s
;
443 calc_hmac_sha1(k
, sizeof(k
), bl
.c_str(), bl
.length(), p
.c_str());
451 static int encode_token(CephContext
*cct
, string
& swift_user
, string
& key
,
456 int ret
= get_random_bytes((char *)&nonce
, sizeof(nonce
));
460 utime_t expiration
= ceph_clock_now();
461 expiration
+= cct
->_conf
->rgw_swift_token_expiration
;
463 return build_token(swift_user
, key
, nonce
, expiration
, bl
);
467 /* AUTH_rgwtk (signed token): engine */
468 bool SignedTokenEngine::is_applicable(const std::string
& token
) const noexcept
473 return token
.compare(0, 10, "AUTH_rgwtk") == 0;
477 SignedTokenEngine::result_t
478 SignedTokenEngine::authenticate(const std::string
& token
,
479 const req_state
* const s
) const
481 if (! is_applicable(token
)) {
482 return result_t::deny(-EPERM
);
485 /* Effective token string is the part after the prefix. */
486 const std::string etoken
= token
.substr(strlen("AUTH_rgwtk"));
487 const size_t etoken_len
= etoken
.length();
489 if (etoken_len
& 1) {
490 ldout(cct
, 0) << "NOTICE: failed to verify token: odd token length="
491 << etoken_len
<< dendl
;
495 ceph::bufferptr
p(etoken_len
/2);
496 int ret
= hex_to_buf(etoken
.c_str(), p
.c_str(), etoken_len
);
501 ceph::bufferlist tok_bl
;
506 std::string swift_user
;
509 /*const*/ auto iter
= tok_bl
.begin();
511 ::decode(swift_user
, iter
);
512 ::decode(nonce
, iter
);
513 ::decode(expiration
, iter
);
514 } catch (buffer::error
& err
) {
515 ldout(cct
, 0) << "NOTICE: failed to decode token" << dendl
;
519 const utime_t now
= ceph_clock_now();
520 if (expiration
< now
) {
521 ldout(cct
, 0) << "NOTICE: old timed out token was used now=" << now
522 << " token.expiration=" << expiration
524 return result_t::deny(-EPERM
);
527 RGWUserInfo user_info
;
528 ret
= rgw_get_user_info_by_swift(store
, swift_user
, user_info
);
533 ldout(cct
, 10) << "swift_user=" << swift_user
<< dendl
;
535 const auto siter
= user_info
.swift_keys
.find(swift_user
);
536 if (siter
== std::end(user_info
.swift_keys
)) {
537 return result_t::deny(-EPERM
);
540 const auto swift_key
= siter
->second
;
542 bufferlist local_tok_bl
;
543 ret
= build_token(swift_user
, swift_key
.key
, nonce
, expiration
, local_tok_bl
);
548 if (local_tok_bl
.length() != tok_bl
.length()) {
549 ldout(cct
, 0) << "NOTICE: tokens length mismatch:"
550 << " tok_bl.length()=" << tok_bl
.length()
551 << " local_tok_bl.length()=" << local_tok_bl
.length()
553 return result_t::deny(-EPERM
);
556 if (memcmp(local_tok_bl
.c_str(), tok_bl
.c_str(),
557 local_tok_bl
.length()) != 0) {
558 char buf
[local_tok_bl
.length() * 2 + 1];
560 buf_to_hex(reinterpret_cast<const unsigned char *>(local_tok_bl
.c_str()),
561 local_tok_bl
.length(), buf
);
563 ldout(cct
, 0) << "NOTICE: tokens mismatch tok=" << buf
<< dendl
;
564 return result_t::deny(-EPERM
);
567 auto apl
= apl_factory
->create_apl_local(cct
, s
, user_info
,
568 extract_swift_subuser(swift_user
));
569 return result_t::grant(std::move(apl
));
572 } /* namespace swift */
573 } /* namespace auth */
574 } /* namespace rgw */
577 void RGW_SWIFT_Auth_Get::execute()
581 const char *key
= s
->info
.env
->get("HTTP_X_AUTH_KEY");
582 const char *user
= s
->info
.env
->get("HTTP_X_AUTH_USER");
584 s
->prot_flags
|= RGW_REST_SWIFT
;
589 RGWAccessKey
*swift_key
;
590 map
<string
, RGWAccessKey
>::iterator siter
;
592 string swift_url
= g_conf
->rgw_swift_url
;
593 string swift_prefix
= g_conf
->rgw_swift_url_prefix
;
597 * We did not allow an empty Swift prefix before, but we want it now.
598 * So, we take rgw_swift_url_prefix = "/" to yield the empty prefix.
599 * The rgw_swift_url_prefix = "" is the default and yields "/swift"
600 * in a backwards-compatible way.
602 if (swift_prefix
.size() == 0) {
603 swift_prefix
= DEFAULT_SWIFT_PREFIX
;
604 } else if (swift_prefix
== "/") {
605 swift_prefix
.clear();
607 if (swift_prefix
[0] != '/') {
608 swift_prefix
.insert(0, "/");
612 if (swift_url
.size() == 0) {
613 bool add_port
= false;
614 const char *server_port
= s
->info
.env
->get("SERVER_PORT_SECURE");
615 const char *protocol
;
617 add_port
= (strcmp(server_port
, "443") != 0);
620 server_port
= s
->info
.env
->get("SERVER_PORT");
621 add_port
= (strcmp(server_port
, "80") != 0);
624 const char *host
= s
->info
.env
->get("HTTP_HOST");
626 dout(0) << "NOTICE: server is misconfigured, missing rgw_swift_url_prefix or rgw_swift_url, HTTP_HOST is not set" << dendl
;
630 swift_url
= protocol
;
631 swift_url
.append("://");
632 swift_url
.append(host
);
633 if (add_port
&& !strchr(host
, ':')) {
634 swift_url
.append(":");
635 swift_url
.append(server_port
);
644 if ((ret
= rgw_get_user_info_by_swift(store
, user_str
, info
)) < 0)
650 siter
= info
.swift_keys
.find(user_str
);
651 if (siter
== info
.swift_keys
.end()) {
655 swift_key
= &siter
->second
;
657 if (swift_key
->key
.compare(key
) != 0) {
658 dout(0) << "NOTICE: RGW_SWIFT_Auth_Get::execute(): bad swift key" << dendl
;
663 if (!g_conf
->rgw_swift_tenant_name
.empty()) {
664 tenant_path
= "/AUTH_";
665 tenant_path
.append(g_conf
->rgw_swift_tenant_name
);
666 } else if (g_conf
->rgw_swift_account_in_url
) {
667 tenant_path
= "/AUTH_";
668 tenant_path
.append(info
.user_id
.to_str());
671 dump_header(s
, "X-Storage-Url", swift_url
+ swift_prefix
+ "/v1" +
674 using rgw::auth::swift::encode_token
;
675 if ((ret
= encode_token(s
->cct
, swift_key
->id
, swift_key
->key
, bl
)) < 0)
679 static constexpr size_t PREFIX_LEN
= sizeof("AUTH_rgwtk") - 1;
680 char token_val
[PREFIX_LEN
+ bl
.length() * 2 + 1];
682 snprintf(token_val
, PREFIX_LEN
+ 1, "AUTH_rgwtk");
683 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(),
684 token_val
+ PREFIX_LEN
);
686 dump_header(s
, "X-Storage-Token", token_val
);
687 dump_header(s
, "X-Auth-Token", token_val
);
690 ret
= STATUS_NO_CONTENT
;
693 set_req_state_err(s
, ret
);
698 int RGWHandler_SWIFT_Auth::init(RGWRados
*store
, struct req_state
*state
,
699 rgw::io::BasicClient
*cio
)
701 state
->dialect
= "swift-auth";
702 state
->formatter
= new JSONFormatter
;
703 state
->format
= RGW_FORMAT_JSON
;
705 return RGWHandler::init(store
, state
, cio
);
708 int RGWHandler_SWIFT_Auth::authorize()
713 RGWOp
*RGWHandler_SWIFT_Auth::op_get()
715 return new RGW_SWIFT_Auth_Get
;