ceph/src/rgw/rgw_swift_auth.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3
   4 #include <array>
   5
   6 #include <boost/utility/string_ref.hpp>
   7 #include <boost/container/static_vector.hpp>
   8
   9 #include "rgw_swift_auth.h"
  10 #include "rgw_rest.h"
  11
  12 #include "common/ceph_crypto.h"
  13 #include "common/Clock.h"
  14
  15 #include "auth/Crypto.h"
  16
  17 #include "rgw_client_io.h"
  18 #include "rgw_http_client.h"
  19 #include "include/str_list.h"
  20
  21 #define dout_context g_ceph_context
  22 #define dout_subsys ceph_subsys_rgw
  23
  24 #define DEFAULT_SWIFT_PREFIX "/swift"
  25
  26 using namespace ceph::crypto;
  27
  28
  29 namespace rgw {
  30 namespace auth {
  31 namespace swift {
  32
  33 /* TempURL: applier */
  34 void TempURLApplier::modify_request_state(req_state* s) const       /* in/out */
  35 {
  36   bool inline_exists = false;
  37   const std::string& filename = s->info.args.get("filename");
  38
  39   s->info.args.get("inline", &inline_exists);
  40   if (inline_exists) {
  41     s->content_disp.override = "inline";
  42   } else if (!filename.empty()) {
  43     std::string fenc;
  44     url_encode(filename, fenc);
  45     s->content_disp.override = "attachment; filename=\"" + fenc + "\"";
  46   } else {
  47     std::string fenc;
  48     url_encode(s->object.name, fenc);
  49     s->content_disp.fallback = "attachment; filename=\"" + fenc + "\"";
  50   }
  51
  52   ldout(s->cct, 20) << "finished applying changes to req_state for TempURL: "
  53                     << " content_disp override " << s->content_disp.override
  54                     << " content_disp fallback " << s->content_disp.fallback
  55                     << dendl;
  56
  57 }
  58
  59 /* TempURL: engine */
  60 bool TempURLEngine::is_applicable(const req_state* const s) const noexcept
  61 {
  62   return s->info.args.exists("temp_url_sig") ||
  63          s->info.args.exists("temp_url_expires");
  64 }
  65
  66 void TempURLEngine::get_owner_info(const req_state* const s,
  67                                    RGWUserInfo& owner_info) const
  68 {
  69   /* We cannot use req_state::bucket_name because it isn't available
  70    * now. It will be initialized in RGWHandler_REST_SWIFT::postauth_init(). */
  71   const string& bucket_name = s->init_state.url_bucket;
  72
  73   /* TempURL requires that bucket and object names are specified. */
  74   if (bucket_name.empty() || s->object.empty()) {
  75     throw -EPERM;
  76   }
  77
  78   /* TempURL case is completely different than the Keystone auth - you may
  79    * get account name only through extraction from URL. In turn, knowledge
  80    * about account is neccessary to obtain its bucket tenant. Without that,
  81    * the access would be limited to accounts with empty tenant. */
  82   string bucket_tenant;
  83   if (!s->account_name.empty()) {
  84     RGWUserInfo uinfo;
  85     bool found = false;
  86
  87     const rgw_user uid(s->account_name);
  88     if (uid.tenant.empty()) {
  89       const rgw_user tenanted_uid(uid.id, uid.id);
  90
  91       if (rgw_get_user_info_by_uid(store, tenanted_uid, uinfo) >= 0) {
  92         /* Succeeded. */
  93         bucket_tenant = uinfo.user_id.tenant;
  94         found = true;
  95       }
  96     }
  97
  98     if (!found && rgw_get_user_info_by_uid(store, uid, uinfo) < 0) {
  99       throw -EPERM;
 100     } else {
 101       bucket_tenant = uinfo.user_id.tenant;
 102     }
 103   }
 104
 105   /* Need to get user info of bucket owner. */
 106   RGWBucketInfo bucket_info;
 107   int ret = store->get_bucket_info(*static_cast<RGWObjectCtx *>(s->obj_ctx),
 108                                    bucket_tenant, bucket_name,
 109                                    bucket_info, nullptr);
 110   if (ret < 0) {
 111     throw ret;
 112   }
 113
 114   ldout(cct, 20) << "temp url user (bucket owner): " << bucket_info.owner
 115                  << dendl;
 116
 117   if (rgw_get_user_info_by_uid(store, bucket_info.owner, owner_info) < 0) {
 118     throw -EPERM;
 119   }
 120 }
 121
 122 bool TempURLEngine::is_expired(const std::string& expires) const
 123 {
 124   string err;
 125   const utime_t now = ceph_clock_now();
 126   const uint64_t expiration = (uint64_t)strict_strtoll(expires.c_str(),
 127                                                        10, &err);
 128   if (!err.empty()) {
 129     dout(5) << "failed to parse temp_url_expires: " << err << dendl;
 130     return true;
 131   }
 132
 133   if (expiration <= (uint64_t)now.sec()) {
 134     dout(5) << "temp url expired: " << expiration << " <= " << now.sec() << dendl;
 135     return true;
 136   }
 137
 138   return false;
 139 }
 140
 141 std::string extract_swift_subuser(const std::string& swift_user_name) {
 142   size_t pos = swift_user_name.find(':');
 143   if (std::string::npos == pos) {
 144     return swift_user_name;
 145   } else {
 146     return swift_user_name.substr(pos + 1);
 147   }
 148 }
 149
 150 class TempURLEngine::SignatureHelper
 151 {
 152 private:
 153   static constexpr uint32_t output_size =
 154     CEPH_CRYPTO_HMACSHA1_DIGESTSIZE * 2 + 1;
 155
 156   unsigned char dest[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE]; // 20
 157   char dest_str[output_size];
 158
 159 public:
 160   SignatureHelper() = default;
 161
 162   const char* calc(const std::string& key,
 163                    const boost::string_ref& method,
 164                    const boost::string_ref& path,
 165                    const std::string& expires) {
 166
 167     using ceph::crypto::HMACSHA1;
 168     using UCHARPTR = const unsigned char*;
 169
 170     HMACSHA1 hmac((UCHARPTR) key.c_str(), key.size());
 171     hmac.Update((UCHARPTR) method.data(), method.size());
 172     hmac.Update((UCHARPTR) "\n", 1);
 173     hmac.Update((UCHARPTR) expires.c_str(), expires.size());
 174     hmac.Update((UCHARPTR) "\n", 1);
 175     hmac.Update((UCHARPTR) path.data(), path.size());
 176     hmac.Final(dest);
 177
 178     buf_to_hex((UCHARPTR) dest, sizeof(dest), dest_str);
 179
 180     return dest_str;
 181   }
 182
 183   bool is_equal_to(const std::string& rhs) const {
 184     /* never allow out-of-range exception */
 185     if (rhs.size() < (output_size - 1)) {
 186       return false;
 187     }
 188     return rhs.compare(0 /* pos */,  output_size, dest_str) == 0;
 189   }
 190
 191 }; /* TempURLEngine::SignatureHelper */
 192
 193 TempURLEngine::result_t
 194 TempURLEngine::authenticate(const req_state* const s) const
 195 {
 196   if (! is_applicable(s)) {
 197     return result_t::deny();
 198   }
 199
 200   const string& temp_url_sig = s->info.args.get("temp_url_sig");
 201   const string& temp_url_expires = s->info.args.get("temp_url_expires");
 202
 203   if (temp_url_sig.empty() || temp_url_expires.empty()) {
 204     return result_t::deny();
 205   }
 206
 207   RGWUserInfo owner_info;
 208   try {
 209     get_owner_info(s, owner_info);
 210   } catch (...) {
 211     ldout(cct, 5) << "cannot get user_info of account's owner" << dendl;
 212     return result_t::reject();
 213   }
 214
 215   if (owner_info.temp_url_keys.empty()) {
 216     ldout(cct, 5) << "user does not have temp url key set, aborting" << dendl;
 217     return result_t::reject();
 218   }
 219
 220   if (is_expired(temp_url_expires)) {
 221     ldout(cct, 5) << "temp url link expired" << dendl;
 222     return result_t::reject();
 223   }
 224
 225   /* We need to verify two paths because of compliance with Swift, Tempest
 226    * and old versions of RadosGW. The second item will have the prefix
 227    * of Swift API entry point removed. */
 228
 229   /* XXX can we search this ONCE? */
 230   const size_t pos = g_conf->rgw_swift_url_prefix.find_last_not_of('/') + 1;
 231   boost::string_ref ref_uri = s->decoded_uri;
 232   const std::array<boost::string_ref, 2> allowed_paths = {
 233     ref_uri,
 234     ref_uri.substr(pos + 1)
 235   };
 236
 237   /* Account owner calculates the signature also against a HTTP method. */
 238   boost::container::static_vector<boost::string_ref, 3> allowed_methods;
 239   if (strcmp("HEAD", s->info.method) == 0) {
 240     /* HEAD requests are specially handled. */
 241     /* TODO: after getting a newer boost (with static_vector supporting
 242      * initializers lists), get back to the good notation:
 243      *   allowed_methods = {"HEAD", "GET", "PUT" };
 244      * Just for now let's use emplace_back to construct the vector. */
 245     allowed_methods.emplace_back("HEAD");
 246     allowed_methods.emplace_back("GET");
 247     allowed_methods.emplace_back("PUT");
 248   } else if (strlen(s->info.method) > 0) {
 249     allowed_methods.emplace_back(s->info.method);
 250   }
 251
 252   /* Need to try each combination of keys, allowed path and methods. */
 253   SignatureHelper sig_helper;
 254   for (const auto& kv : owner_info.temp_url_keys) {
 255     const int temp_url_key_num = kv.first;
 256     const string& temp_url_key = kv.second;
 257
 258     if (temp_url_key.empty()) {
 259       continue;
 260     }
 261
 262     for (const auto& path : allowed_paths) {
 263       for (const auto& method : allowed_methods) {
 264         const char* const local_sig = sig_helper.calc(temp_url_key, method,
 265                                                       path, temp_url_expires);
 266
 267         ldout(s->cct, 20) << "temp url signature [" << temp_url_key_num
 268                           << "] (calculated): " << local_sig
 269                           << dendl;
 270
 271         if (sig_helper.is_equal_to(temp_url_sig)) {
 272           auto apl = apl_factory->create_apl_turl(cct, s, owner_info);
 273           return result_t::grant(std::move(apl));
 274         } else {
 275           ldout(s->cct,  5) << "temp url signature mismatch: " << local_sig
 276                             << " != " << temp_url_sig  << dendl;
 277         }
 278       }
 279     }
 280   }
 281
 282   return result_t::reject();
 283 }
 284
 285
 286 /* External token */
 287 bool ExternalTokenEngine::is_applicable(const std::string& token) const noexcept
 288 {
 289   if (token.empty()) {
 290     return false;
 291   } else if (g_conf->rgw_swift_auth_url.empty()) {
 292     return false;
 293   } else {
 294     return true;
 295   }
 296 }
 297
 298 ExternalTokenEngine::result_t
 299 ExternalTokenEngine::authenticate(const std::string& token,
 300                                   const req_state* const s) const
 301 {
 302   if (! is_applicable(token)) {
 303     return result_t::deny();
 304   }
 305
 306   std::string auth_url = g_conf->rgw_swift_auth_url;
 307   if (auth_url.back() != '/') {
 308     auth_url.append("/");
 309   }
 310
 311   auth_url.append("token");
 312   char url_buf[auth_url.size() + 1 + token.length() + 1];
 313   sprintf(url_buf, "%s/%s", auth_url.c_str(), token.c_str());
 314
 315   RGWHTTPHeadersCollector validator(cct, { "X-Auth-Groups", "X-Auth-Ttl" });
 316
 317   ldout(cct, 10) << "rgw_swift_validate_token url=" << url_buf << dendl;
 318
 319   int ret = validator.process(url_buf);
 320   if (ret < 0) {
 321     throw ret;
 322   }
 323
 324   std::string swift_user;
 325   try {
 326     std::vector<std::string> swift_groups;
 327     get_str_vec(validator.get_header_value("X-Auth-Groups"),
 328                 ",", swift_groups);
 329
 330     if (0 == swift_groups.size()) {
 331       return result_t::deny(-EPERM);
 332     } else {
 333       swift_user = std::move(swift_groups[0]);
 334     }
 335   } catch (std::out_of_range) {
 336     /* The X-Auth-Groups header isn't present in the response. */
 337     return result_t::deny(-EPERM);
 338   }
 339
 340   if (swift_user.empty()) {
 341     return result_t::deny(-EPERM);
 342   }
 343
 344   ldout(cct, 10) << "swift user=" << swift_user << dendl;
 345
 346   RGWUserInfo tmp_uinfo;
 347   ret = rgw_get_user_info_by_swift(store, swift_user, tmp_uinfo);
 348   if (ret < 0) {
 349     ldout(cct, 0) << "NOTICE: couldn't map swift user" << dendl;
 350     throw ret;
 351   }
 352
 353   auto apl = apl_factory->create_apl_local(cct, s, tmp_uinfo,
 354                                            extract_swift_subuser(swift_user));
 355   return result_t::grant(std::move(apl));
 356 }
 357
 358 static int build_token(const string& swift_user,
 359                        const string& key,
 360                        const uint64_t nonce,
 361                        const utime_t& expiration,
 362                        bufferlist& bl)
 363 {
 364   ::encode(swift_user, bl);
 365   ::encode(nonce, bl);
 366   ::encode(expiration, bl);
 367
 368   bufferptr p(CEPH_CRYPTO_HMACSHA1_DIGESTSIZE);
 369
 370   char buf[bl.length() * 2 + 1];
 371   buf_to_hex((const unsigned char *)bl.c_str(), bl.length(), buf);
 372   dout(20) << "build_token token=" << buf << dendl;
 373
 374   char k[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE];
 375   memset(k, 0, sizeof(k));
 376   const char *s = key.c_str();
 377   for (int i = 0; i < (int)key.length(); i++, s++) {
 378     k[i % CEPH_CRYPTO_HMACSHA1_DIGESTSIZE] |= *s;
 379   }
 380   calc_hmac_sha1(k, sizeof(k), bl.c_str(), bl.length(), p.c_str());
 381
 382   bl.append(p);
 383
 384   return 0;
 385
 386 }
 387
 388 static int encode_token(CephContext *cct, string& swift_user, string& key,
 389                         bufferlist& bl)
 390 {
 391   uint64_t nonce;
 392
 393   int ret = get_random_bytes((char *)&nonce, sizeof(nonce));
 394   if (ret < 0)
 395     return ret;
 396
 397   utime_t expiration = ceph_clock_now();
 398   expiration += cct->_conf->rgw_swift_token_expiration;
 399
 400   return build_token(swift_user, key, nonce, expiration, bl);
 401 }
 402
 403
 404 /* AUTH_rgwtk (signed token): engine */
 405 bool SignedTokenEngine::is_applicable(const std::string& token) const noexcept
 406 {
 407   if (token.empty()) {
 408     return false;
 409   } else {
 410     return token.compare(0, 10, "AUTH_rgwtk") == 0;
 411   }
 412 }
 413
 414 SignedTokenEngine::result_t
 415 SignedTokenEngine::authenticate(const std::string& token,
 416                                 const req_state* const s) const
 417 {
 418   if (! is_applicable(token)) {
 419     return result_t::deny(-EPERM);
 420   }
 421
 422   /* Effective token string is the part after the prefix. */
 423   const std::string etoken = token.substr(strlen("AUTH_rgwtk"));
 424   const size_t etoken_len = etoken.length();
 425
 426   if (etoken_len & 1) {
 427     ldout(cct, 0) << "NOTICE: failed to verify token: odd token length="
 428                   << etoken_len << dendl;
 429     throw -EINVAL;
 430   }
 431
 432   ceph::bufferptr p(etoken_len/2);
 433   int ret = hex_to_buf(etoken.c_str(), p.c_str(), etoken_len);
 434   if (ret < 0) {
 435     throw ret;
 436   }
 437
 438   ceph::bufferlist tok_bl;
 439   tok_bl.append(p);
 440
 441   uint64_t nonce;
 442   utime_t expiration;
 443   std::string swift_user;
 444
 445   try {
 446     /*const*/ auto iter = tok_bl.begin();
 447
 448     ::decode(swift_user, iter);
 449     ::decode(nonce, iter);
 450     ::decode(expiration, iter);
 451   } catch (buffer::error& err) {
 452     ldout(cct, 0) << "NOTICE: failed to decode token" << dendl;
 453     throw -EINVAL;
 454   }
 455
 456   const utime_t now = ceph_clock_now();
 457   if (expiration < now) {
 458     ldout(cct, 0) << "NOTICE: old timed out token was used now=" << now
 459                   << " token.expiration=" << expiration
 460                   << dendl;
 461     return result_t::deny(-EPERM);
 462   }
 463
 464   RGWUserInfo user_info;
 465   ret = rgw_get_user_info_by_swift(store, swift_user, user_info);
 466   if (ret < 0) {
 467     throw ret;
 468   }
 469
 470   ldout(cct, 10) << "swift_user=" << swift_user << dendl;
 471
 472   const auto siter = user_info.swift_keys.find(swift_user);
 473   if (siter == std::end(user_info.swift_keys)) {
 474     return result_t::deny(-EPERM);
 475   }
 476
 477   const auto swift_key = siter->second;
 478
 479   bufferlist local_tok_bl;
 480   ret = build_token(swift_user, swift_key.key, nonce, expiration, local_tok_bl);
 481   if (ret < 0) {
 482     throw ret;
 483   }
 484
 485   if (local_tok_bl.length() != tok_bl.length()) {
 486     ldout(cct, 0) << "NOTICE: tokens length mismatch:"
 487                   << " tok_bl.length()=" << tok_bl.length()
 488                   << " local_tok_bl.length()=" << local_tok_bl.length()
 489                   << dendl;
 490     return result_t::deny(-EPERM);
 491   }
 492
 493   if (memcmp(local_tok_bl.c_str(), tok_bl.c_str(),
 494              local_tok_bl.length()) != 0) {
 495     char buf[local_tok_bl.length() * 2 + 1];
 496
 497     buf_to_hex(reinterpret_cast<const unsigned char *>(local_tok_bl.c_str()),
 498                local_tok_bl.length(), buf);
 499
 500     ldout(cct, 0) << "NOTICE: tokens mismatch tok=" << buf << dendl;
 501     return result_t::deny(-EPERM);
 502   }
 503
 504   auto apl = apl_factory->create_apl_local(cct, s, user_info,
 505                                            extract_swift_subuser(swift_user));
 506   return result_t::grant(std::move(apl));
 507 }
 508
 509 } /* namespace swift */
 510 } /* namespace auth */
 511 } /* namespace rgw */
 512
 513
 514 void RGW_SWIFT_Auth_Get::execute()
 515 {
 516   int ret = -EPERM;
 517
 518   const char *key = s->info.env->get("HTTP_X_AUTH_KEY");
 519   const char *user = s->info.env->get("HTTP_X_AUTH_USER");
 520
 521   s->prot_flags |= RGW_REST_SWIFT;
 522
 523   string user_str;
 524   RGWUserInfo info;
 525   bufferlist bl;
 526   RGWAccessKey *swift_key;
 527   map<string, RGWAccessKey>::iterator siter;
 528
 529   string swift_url = g_conf->rgw_swift_url;
 530   string swift_prefix = g_conf->rgw_swift_url_prefix;
 531   string tenant_path;
 532
 533   /*
 534    * We did not allow an empty Swift prefix before, but we want it now.
 535    * So, we take rgw_swift_url_prefix = "/" to yield the empty prefix.
 536    * The rgw_swift_url_prefix = "" is the default and yields "/swift"
 537    * in a backwards-compatible way.
 538    */
 539   if (swift_prefix.size() == 0) {
 540     swift_prefix = DEFAULT_SWIFT_PREFIX;
 541   } else if (swift_prefix == "/") {
 542     swift_prefix.clear();
 543   } else {
 544     if (swift_prefix[0] != '/') {
 545       swift_prefix.insert(0, "/");
 546     }
 547   }
 548
 549   if (swift_url.size() == 0) {
 550     bool add_port = false;
 551     const char *server_port = s->info.env->get("SERVER_PORT_SECURE");
 552     const char *protocol;
 553     if (server_port) {
 554       add_port = (strcmp(server_port, "443") != 0);
 555       protocol = "https";
 556     } else {
 557       server_port = s->info.env->get("SERVER_PORT");
 558       add_port = (strcmp(server_port, "80") != 0);
 559       protocol = "http";
 560     }
 561     const char *host = s->info.env->get("HTTP_HOST");
 562     if (!host) {
 563       dout(0) << "NOTICE: server is misconfigured, missing rgw_swift_url_prefix or rgw_swift_url, HTTP_HOST is not set" << dendl;
 564       ret = -EINVAL;
 565       goto done;
 566     }
 567     swift_url = protocol;
 568     swift_url.append("://");
 569     swift_url.append(host);
 570     if (add_port && !strchr(host, ':')) {
 571       swift_url.append(":");
 572       swift_url.append(server_port);
 573     }
 574   }
 575
 576   if (!key || !user)
 577     goto done;
 578
 579   user_str = user;
 580
 581   if ((ret = rgw_get_user_info_by_swift(store, user_str, info)) < 0)
 582   {
 583     ret = -EACCES;
 584     goto done;
 585   }
 586
 587   siter = info.swift_keys.find(user_str);
 588   if (siter == info.swift_keys.end()) {
 589     ret = -EPERM;
 590     goto done;
 591   }
 592   swift_key = &siter->second;
 593
 594   if (swift_key->key.compare(key) != 0) {
 595     dout(0) << "NOTICE: RGW_SWIFT_Auth_Get::execute(): bad swift key" << dendl;
 596     ret = -EPERM;
 597     goto done;
 598   }
 599
 600   if (!g_conf->rgw_swift_tenant_name.empty()) {
 601     tenant_path = "/AUTH_";
 602     tenant_path.append(g_conf->rgw_swift_tenant_name);
 603   } else if (g_conf->rgw_swift_account_in_url) {
 604     tenant_path = "/AUTH_";
 605     tenant_path.append(info.user_id.to_str());
 606   }
 607
 608   dump_header(s, "X-Storage-Url", swift_url + swift_prefix + "/v1" +
 609               tenant_path);
 610
 611   using rgw::auth::swift::encode_token;
 612   if ((ret = encode_token(s->cct, swift_key->id, swift_key->key, bl)) < 0)
 613     goto done;
 614
 615   {
 616     static constexpr size_t PREFIX_LEN = sizeof("AUTH_rgwtk") - 1;
 617     char token_val[PREFIX_LEN + bl.length() * 2 + 1];
 618
 619     snprintf(token_val, PREFIX_LEN + 1, "AUTH_rgwtk");
 620     buf_to_hex((const unsigned char *)bl.c_str(), bl.length(),
 621                token_val + PREFIX_LEN);
 622
 623     dump_header(s, "X-Storage-Token", token_val);
 624     dump_header(s, "X-Auth-Token", token_val);
 625   }
 626
 627   ret = STATUS_NO_CONTENT;
 628
 629 done:
 630   set_req_state_err(s, ret);
 631   dump_errno(s);
 632   end_header(s);
 633 }
 634
 635 int RGWHandler_SWIFT_Auth::init(RGWRados *store, struct req_state *state,
 636                                 rgw::io::BasicClient *cio)
 637 {
 638   state->dialect = "swift-auth";
 639   state->formatter = new JSONFormatter;
 640   state->format = RGW_FORMAT_JSON;
 641
 642   return RGWHandler::init(store, state, cio);
 643 }
 644
 645 int RGWHandler_SWIFT_Auth::authorize()
 646 {
 647   return 0;
 648 }
 649
 650 RGWOp *RGWHandler_SWIFT_Auth::op_get()
 651 {
 652   return new RGW_SWIFT_Auth_Get;
 653 }
 654