1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
7 #include <boost/utility/string_view.hpp>
8 #include <boost/container/static_vector.hpp>
9 #include <boost/algorithm/string/predicate.hpp>
10 #include <boost/algorithm/string.hpp>
12 #include "rgw_swift_auth.h"
15 #include "common/ceph_crypto.h"
16 #include "common/Clock.h"
18 #include "include/random.h"
20 #include "rgw_client_io.h"
21 #include "rgw_http_client.h"
22 #include "include/str_list.h"
24 #define dout_context g_ceph_context
25 #define dout_subsys ceph_subsys_rgw
27 #define DEFAULT_SWIFT_PREFIX "/swift"
29 using namespace ceph::crypto
;
36 /* TempURL: applier */
37 void TempURLApplier::modify_request_state(const DoutPrefixProvider
* dpp
, req_state
* s
) const /* in/out */
39 bool inline_exists
= false;
40 const std::string
& filename
= s
->info
.args
.get("filename");
42 s
->info
.args
.get("inline", &inline_exists
);
44 s
->content_disp
.override
= "inline";
45 } else if (!filename
.empty()) {
47 url_encode(filename
, fenc
);
48 s
->content_disp
.override
= "attachment; filename=\"" + fenc
+ "\"";
51 url_encode(s
->object
.name
, fenc
);
52 s
->content_disp
.fallback
= "attachment; filename=\"" + fenc
+ "\"";
55 ldpp_dout(dpp
, 20) << "finished applying changes to req_state for TempURL: "
56 << " content_disp override " << s
->content_disp
.override
57 << " content_disp fallback " << s
->content_disp
.fallback
63 bool TempURLEngine::is_applicable(const req_state
* const s
) const noexcept
65 return s
->info
.args
.exists("temp_url_sig") ||
66 s
->info
.args
.exists("temp_url_expires");
69 void TempURLEngine::get_owner_info(const DoutPrefixProvider
* dpp
, const req_state
* const s
,
70 RGWUserInfo
& owner_info
) const
72 /* We cannot use req_state::bucket_name because it isn't available
73 * now. It will be initialized in RGWHandler_REST_SWIFT::postauth_init(). */
74 const string
& bucket_name
= s
->init_state
.url_bucket
;
76 /* TempURL requires that bucket and object names are specified. */
77 if (bucket_name
.empty() || s
->object
.empty()) {
81 /* TempURL case is completely different than the Keystone auth - you may
82 * get account name only through extraction from URL. In turn, knowledge
83 * about account is neccessary to obtain its bucket tenant. Without that,
84 * the access would be limited to accounts with empty tenant. */
86 if (!s
->account_name
.empty()) {
90 const rgw_user
uid(s
->account_name
);
91 if (uid
.tenant
.empty()) {
92 const rgw_user
tenanted_uid(uid
.id
, uid
.id
);
94 if (rgw_get_user_info_by_uid(store
, tenanted_uid
, uinfo
) >= 0) {
96 bucket_tenant
= uinfo
.user_id
.tenant
;
101 if (!found
&& rgw_get_user_info_by_uid(store
, uid
, uinfo
) < 0) {
104 bucket_tenant
= uinfo
.user_id
.tenant
;
108 /* Need to get user info of bucket owner. */
109 RGWBucketInfo bucket_info
;
110 int ret
= store
->get_bucket_info(*s
->sysobj_ctx
,
111 bucket_tenant
, bucket_name
,
112 bucket_info
, nullptr);
117 ldpp_dout(dpp
, 20) << "temp url user (bucket owner): " << bucket_info
.owner
120 if (rgw_get_user_info_by_uid(store
, bucket_info
.owner
, owner_info
) < 0) {
125 std::string
TempURLEngine::convert_from_iso8601(std::string expires
) const
127 /* Swift's TempURL allows clients to send the expiration as ISO8601-
128 * compatible strings. Though, only plain UNIX timestamp are taken
129 * for the HMAC calculations. We need to make the conversion. */
131 if (!parse_iso8601(expires
.c_str(), &date_t
, nullptr, true)) {
132 return std::move(expires
);
134 return std::to_string(internal_timegm(&date_t
));
138 bool TempURLEngine::is_expired(const std::string
& expires
) const
141 const utime_t now
= ceph_clock_now();
142 const uint64_t expiration
= (uint64_t)strict_strtoll(expires
.c_str(),
145 dout(5) << "failed to parse temp_url_expires: " << err
<< dendl
;
149 if (expiration
<= (uint64_t)now
.sec()) {
150 dout(5) << "temp url expired: " << expiration
<< " <= " << now
.sec() << dendl
;
157 bool TempURLEngine::is_disallowed_header_present(const req_info
& info
) const
159 static const auto headers
= {
160 "HTTP_X_OBJECT_MANIFEST",
163 return std::any_of(std::begin(headers
), std::end(headers
),
164 [&info
](const char* header
) {
165 return info
.env
->exists(header
);
169 std::string
extract_swift_subuser(const std::string
& swift_user_name
)
171 size_t pos
= swift_user_name
.find(':');
172 if (std::string::npos
== pos
) {
173 return swift_user_name
;
175 return swift_user_name
.substr(pos
+ 1);
179 class TempURLEngine::SignatureHelper
182 static constexpr uint32_t output_size
=
183 CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
* 2 + 1;
185 unsigned char dest
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
]; // 20
186 char dest_str
[output_size
];
189 SignatureHelper() = default;
191 const char* calc(const std::string
& key
,
192 const boost::string_view
& method
,
193 const boost::string_view
& path
,
194 const std::string
& expires
) {
196 using ceph::crypto::HMACSHA1
;
197 using UCHARPTR
= const unsigned char*;
199 HMACSHA1
hmac((UCHARPTR
) key
.c_str(), key
.size());
200 hmac
.Update((UCHARPTR
) method
.data(), method
.size());
201 hmac
.Update((UCHARPTR
) "\n", 1);
202 hmac
.Update((UCHARPTR
) expires
.c_str(), expires
.size());
203 hmac
.Update((UCHARPTR
) "\n", 1);
204 hmac
.Update((UCHARPTR
) path
.data(), path
.size());
207 buf_to_hex((UCHARPTR
) dest
, sizeof(dest
), dest_str
);
212 bool is_equal_to(const std::string
& rhs
) const {
213 /* never allow out-of-range exception */
214 if (rhs
.size() < (output_size
- 1)) {
217 return rhs
.compare(0 /* pos */, output_size
, dest_str
) == 0;
220 }; /* TempURLEngine::SignatureHelper */
222 class TempURLEngine::PrefixableSignatureHelper
223 : private TempURLEngine::SignatureHelper
{
224 using base_t
= SignatureHelper
;
226 const boost::string_view decoded_uri
;
227 const boost::string_view object_name
;
228 boost::string_view no_obj_uri
;
230 const boost::optional
<const std::string
&> prefix
;
233 PrefixableSignatureHelper(const std::string
& _decoded_uri
,
234 const std::string
& object_name
,
235 const boost::optional
<const std::string
&> prefix
)
236 : decoded_uri(_decoded_uri
),
237 object_name(object_name
),
239 /* Transform: v1/acct/cont/obj - > v1/acct/cont/
241 * NOTE(rzarzynski): we really want to substr() on boost::string_view,
242 * not std::string. Otherwise we would end with no_obj_uri referencing
245 decoded_uri
.substr(0, decoded_uri
.length() - object_name
.length());
248 const char* calc(const std::string
& key
,
249 const boost::string_view
& method
,
250 const boost::string_view
& path
,
251 const std::string
& expires
) {
253 return base_t::calc(key
, method
, path
, expires
);
255 const auto prefixed_path
= \
256 string_cat_reserve("prefix:", no_obj_uri
, *prefix
);
257 return base_t::calc(key
, method
, prefixed_path
, expires
);
261 bool is_equal_to(const std::string
& rhs
) const {
262 bool is_auth_ok
= base_t::is_equal_to(rhs
);
264 if (prefix
&& is_auth_ok
) {
265 const auto prefix_uri
= string_cat_reserve(no_obj_uri
, *prefix
);
266 is_auth_ok
= boost::algorithm::starts_with(decoded_uri
, prefix_uri
);
271 }; /* TempURLEngine::PrefixableSignatureHelper */
273 TempURLEngine::result_t
274 TempURLEngine::authenticate(const DoutPrefixProvider
* dpp
, const req_state
* const s
) const
276 if (! is_applicable(s
)) {
277 return result_t::deny();
280 /* NOTE(rzarzynski): RGWHTTPArgs::get(), in contrast to RGWEnv::get(),
281 * never returns nullptr. If the requested parameter is absent, we will
282 * get the empty string. */
283 const std::string
& temp_url_sig
= s
->info
.args
.get("temp_url_sig");
284 const std::string
& temp_url_expires
= \
285 convert_from_iso8601(s
->info
.args
.get("temp_url_expires"));
287 if (temp_url_sig
.empty() || temp_url_expires
.empty()) {
288 return result_t::deny();
291 /* Though, for prefixed tempurls we need to differentiate between empty
292 * prefix and lack of prefix. Empty prefix means allowance for whole
294 const boost::optional
<const std::string
&> temp_url_prefix
= \
295 s
->info
.args
.get_optional("temp_url_prefix");
297 RGWUserInfo owner_info
;
299 get_owner_info(dpp
, s
, owner_info
);
301 ldpp_dout(dpp
, 5) << "cannot get user_info of account's owner" << dendl
;
302 return result_t::reject();
305 if (owner_info
.temp_url_keys
.empty()) {
306 ldpp_dout(dpp
, 5) << "user does not have temp url key set, aborting" << dendl
;
307 return result_t::reject();
310 if (is_expired(temp_url_expires
)) {
311 ldpp_dout(dpp
, 5) << "temp url link expired" << dendl
;
312 return result_t::reject(-EPERM
);
315 if (is_disallowed_header_present(s
->info
)) {
316 ldout(cct
, 5) << "temp url rejected due to disallowed header" << dendl
;
317 return result_t::reject(-EINVAL
);
320 /* We need to verify two paths because of compliance with Swift, Tempest
321 * and old versions of RadosGW. The second item will have the prefix
322 * of Swift API entry point removed. */
324 /* XXX can we search this ONCE? */
325 const size_t pos
= g_conf()->rgw_swift_url_prefix
.find_last_not_of('/') + 1;
326 const boost::string_view ref_uri
= s
->decoded_uri
;
327 const std::array
<boost::string_view
, 2> allowed_paths
= {
329 ref_uri
.substr(pos
+ 1)
332 /* Account owner calculates the signature also against a HTTP method. */
333 boost::container::static_vector
<boost::string_view
, 3> allowed_methods
;
334 if (strcmp("HEAD", s
->info
.method
) == 0) {
335 /* HEAD requests are specially handled. */
336 /* TODO: after getting a newer boost (with static_vector supporting
337 * initializers lists), get back to the good notation:
338 * allowed_methods = {"HEAD", "GET", "PUT" };
339 * Just for now let's use emplace_back to construct the vector. */
340 allowed_methods
.emplace_back("HEAD");
341 allowed_methods
.emplace_back("GET");
342 allowed_methods
.emplace_back("PUT");
343 } else if (strlen(s
->info
.method
) > 0) {
344 allowed_methods
.emplace_back(s
->info
.method
);
347 /* Need to try each combination of keys, allowed path and methods. */
348 PrefixableSignatureHelper sig_helper
{
354 for (const auto& kv
: owner_info
.temp_url_keys
) {
355 const int temp_url_key_num
= kv
.first
;
356 const string
& temp_url_key
= kv
.second
;
358 if (temp_url_key
.empty()) {
362 for (const auto& path
: allowed_paths
) {
363 for (const auto& method
: allowed_methods
) {
364 const char* const local_sig
= sig_helper
.calc(temp_url_key
, method
,
365 path
, temp_url_expires
);
367 ldpp_dout(dpp
, 20) << "temp url signature [" << temp_url_key_num
368 << "] (calculated): " << local_sig
371 if (sig_helper
.is_equal_to(temp_url_sig
)) {
372 auto apl
= apl_factory
->create_apl_turl(cct
, s
, owner_info
);
373 return result_t::grant(std::move(apl
));
375 ldpp_dout(dpp
, 5) << "temp url signature mismatch: " << local_sig
376 << " != " << temp_url_sig
<< dendl
;
382 return result_t::reject();
387 bool ExternalTokenEngine::is_applicable(const std::string
& token
) const noexcept
391 } else if (g_conf()->rgw_swift_auth_url
.empty()) {
398 ExternalTokenEngine::result_t
399 ExternalTokenEngine::authenticate(const DoutPrefixProvider
* dpp
,
400 const std::string
& token
,
401 const req_state
* const s
) const
403 if (! is_applicable(token
)) {
404 return result_t::deny();
407 std::string auth_url
= g_conf()->rgw_swift_auth_url
;
408 if (auth_url
.back() != '/') {
409 auth_url
.append("/");
412 auth_url
.append("token");
413 char url_buf
[auth_url
.size() + 1 + token
.length() + 1];
414 sprintf(url_buf
, "%s/%s", auth_url
.c_str(), token
.c_str());
416 RGWHTTPHeadersCollector
validator(cct
, "GET", url_buf
, { "X-Auth-Groups", "X-Auth-Ttl" });
418 ldpp_dout(dpp
, 10) << "rgw_swift_validate_token url=" << url_buf
<< dendl
;
420 int ret
= validator
.process();
425 std::string swift_user
;
427 std::vector
<std::string
> swift_groups
;
428 get_str_vec(validator
.get_header_value("X-Auth-Groups"),
431 if (0 == swift_groups
.size()) {
432 return result_t::deny(-EPERM
);
434 swift_user
= std::move(swift_groups
[0]);
436 } catch (const std::out_of_range
&) {
437 /* The X-Auth-Groups header isn't present in the response. */
438 return result_t::deny(-EPERM
);
441 if (swift_user
.empty()) {
442 return result_t::deny(-EPERM
);
445 ldpp_dout(dpp
, 10) << "swift user=" << swift_user
<< dendl
;
447 RGWUserInfo tmp_uinfo
;
448 ret
= rgw_get_user_info_by_swift(store
, swift_user
, tmp_uinfo
);
450 ldpp_dout(dpp
, 0) << "NOTICE: couldn't map swift user" << dendl
;
454 auto apl
= apl_factory
->create_apl_local(cct
, s
, tmp_uinfo
,
455 extract_swift_subuser(swift_user
),
457 return result_t::grant(std::move(apl
));
460 static int build_token(const string
& swift_user
,
462 const uint64_t nonce
,
463 const utime_t
& expiration
,
467 encode(swift_user
, bl
);
469 encode(expiration
, bl
);
471 bufferptr
p(CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
);
473 char buf
[bl
.length() * 2 + 1];
474 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(), buf
);
475 dout(20) << "build_token token=" << buf
<< dendl
;
477 char k
[CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
];
478 // FIPS zeroization audit 20191116: this memset is not intended to
479 // wipe out a secret after use.
480 memset(k
, 0, sizeof(k
));
481 const char *s
= key
.c_str();
482 for (int i
= 0; i
< (int)key
.length(); i
++, s
++) {
483 k
[i
% CEPH_CRYPTO_HMACSHA1_DIGESTSIZE
] |= *s
;
485 calc_hmac_sha1(k
, sizeof(k
), bl
.c_str(), bl
.length(), p
.c_str());
486 ::ceph::crypto::zeroize_for_security(k
, sizeof(k
));
494 static int encode_token(CephContext
*cct
, string
& swift_user
, string
& key
,
497 const auto nonce
= ceph::util::generate_random_number
<uint64_t>();
499 utime_t expiration
= ceph_clock_now();
500 expiration
+= cct
->_conf
->rgw_swift_token_expiration
;
502 return build_token(swift_user
, key
, nonce
, expiration
, bl
);
506 /* AUTH_rgwtk (signed token): engine */
507 bool SignedTokenEngine::is_applicable(const std::string
& token
) const noexcept
512 return token
.compare(0, 10, "AUTH_rgwtk") == 0;
516 SignedTokenEngine::result_t
517 SignedTokenEngine::authenticate(const DoutPrefixProvider
* dpp
,
518 const std::string
& token
,
519 const req_state
* const s
) const
521 if (! is_applicable(token
)) {
522 return result_t::deny(-EPERM
);
525 /* Effective token string is the part after the prefix. */
526 const std::string etoken
= token
.substr(strlen("AUTH_rgwtk"));
527 const size_t etoken_len
= etoken
.length();
529 if (etoken_len
& 1) {
530 ldpp_dout(dpp
, 0) << "NOTICE: failed to verify token: odd token length="
531 << etoken_len
<< dendl
;
535 ceph::bufferptr
p(etoken_len
/2);
536 int ret
= hex_to_buf(etoken
.c_str(), p
.c_str(), etoken_len
);
541 ceph::bufferlist tok_bl
;
546 std::string swift_user
;
549 auto iter
= tok_bl
.cbegin();
552 decode(swift_user
, iter
);
554 decode(expiration
, iter
);
555 } catch (buffer::error
& err
) {
556 ldpp_dout(dpp
, 0) << "NOTICE: failed to decode token" << dendl
;
560 const utime_t now
= ceph_clock_now();
561 if (expiration
< now
) {
562 ldpp_dout(dpp
, 0) << "NOTICE: old timed out token was used now=" << now
563 << " token.expiration=" << expiration
565 return result_t::deny(-EPERM
);
568 RGWUserInfo user_info
;
569 ret
= rgw_get_user_info_by_swift(store
, swift_user
, user_info
);
574 ldpp_dout(dpp
, 10) << "swift_user=" << swift_user
<< dendl
;
576 const auto siter
= user_info
.swift_keys
.find(swift_user
);
577 if (siter
== std::end(user_info
.swift_keys
)) {
578 return result_t::deny(-EPERM
);
581 const auto swift_key
= siter
->second
;
583 bufferlist local_tok_bl
;
584 ret
= build_token(swift_user
, swift_key
.key
, nonce
, expiration
, local_tok_bl
);
589 if (local_tok_bl
.length() != tok_bl
.length()) {
590 ldpp_dout(dpp
, 0) << "NOTICE: tokens length mismatch:"
591 << " tok_bl.length()=" << tok_bl
.length()
592 << " local_tok_bl.length()=" << local_tok_bl
.length()
594 return result_t::deny(-EPERM
);
597 if (memcmp(local_tok_bl
.c_str(), tok_bl
.c_str(),
598 local_tok_bl
.length()) != 0) {
599 char buf
[local_tok_bl
.length() * 2 + 1];
601 buf_to_hex(reinterpret_cast<const unsigned char *>(local_tok_bl
.c_str()),
602 local_tok_bl
.length(), buf
);
604 ldpp_dout(dpp
, 0) << "NOTICE: tokens mismatch tok=" << buf
<< dendl
;
605 return result_t::deny(-EPERM
);
608 auto apl
= apl_factory
->create_apl_local(cct
, s
, user_info
,
609 extract_swift_subuser(swift_user
),
611 return result_t::grant(std::move(apl
));
614 } /* namespace swift */
615 } /* namespace auth */
616 } /* namespace rgw */
619 void RGW_SWIFT_Auth_Get::execute()
623 const char *key
= s
->info
.env
->get("HTTP_X_AUTH_KEY");
624 const char *user
= s
->info
.env
->get("HTTP_X_AUTH_USER");
626 s
->prot_flags
|= RGW_REST_SWIFT
;
631 RGWAccessKey
*swift_key
;
632 map
<string
, RGWAccessKey
>::iterator siter
;
634 string swift_url
= g_conf()->rgw_swift_url
;
635 string swift_prefix
= g_conf()->rgw_swift_url_prefix
;
639 * We did not allow an empty Swift prefix before, but we want it now.
640 * So, we take rgw_swift_url_prefix = "/" to yield the empty prefix.
641 * The rgw_swift_url_prefix = "" is the default and yields "/swift"
642 * in a backwards-compatible way.
644 if (swift_prefix
.size() == 0) {
645 swift_prefix
= DEFAULT_SWIFT_PREFIX
;
646 } else if (swift_prefix
== "/") {
647 swift_prefix
.clear();
649 if (swift_prefix
[0] != '/') {
650 swift_prefix
.insert(0, "/");
654 if (swift_url
.size() == 0) {
655 bool add_port
= false;
656 const char *server_port
= s
->info
.env
->get("SERVER_PORT_SECURE");
657 const char *protocol
;
659 add_port
= (strcmp(server_port
, "443") != 0);
662 server_port
= s
->info
.env
->get("SERVER_PORT");
663 add_port
= (strcmp(server_port
, "80") != 0);
666 const char *host
= s
->info
.env
->get("HTTP_HOST");
668 dout(0) << "NOTICE: server is misconfigured, missing rgw_swift_url_prefix or rgw_swift_url, HTTP_HOST is not set" << dendl
;
672 swift_url
= protocol
;
673 swift_url
.append("://");
674 swift_url
.append(host
);
675 if (add_port
&& !strchr(host
, ':')) {
676 swift_url
.append(":");
677 swift_url
.append(server_port
);
686 if ((ret
= rgw_get_user_info_by_swift(store
, user_str
, info
)) < 0)
692 siter
= info
.swift_keys
.find(user_str
);
693 if (siter
== info
.swift_keys
.end()) {
697 swift_key
= &siter
->second
;
699 if (swift_key
->key
.compare(key
) != 0) {
700 dout(0) << "NOTICE: RGW_SWIFT_Auth_Get::execute(): bad swift key" << dendl
;
705 if (!g_conf()->rgw_swift_tenant_name
.empty()) {
706 tenant_path
= "/AUTH_";
707 tenant_path
.append(g_conf()->rgw_swift_tenant_name
);
708 } else if (g_conf()->rgw_swift_account_in_url
) {
709 tenant_path
= "/AUTH_";
710 tenant_path
.append(info
.user_id
.to_str());
713 dump_header(s
, "X-Storage-Url", swift_url
+ swift_prefix
+ "/v1" +
716 using rgw::auth::swift::encode_token
;
717 if ((ret
= encode_token(s
->cct
, swift_key
->id
, swift_key
->key
, bl
)) < 0)
721 static constexpr size_t PREFIX_LEN
= sizeof("AUTH_rgwtk") - 1;
722 char token_val
[PREFIX_LEN
+ bl
.length() * 2 + 1];
724 snprintf(token_val
, PREFIX_LEN
+ 1, "AUTH_rgwtk");
725 buf_to_hex((const unsigned char *)bl
.c_str(), bl
.length(),
726 token_val
+ PREFIX_LEN
);
728 dump_header(s
, "X-Storage-Token", token_val
);
729 dump_header(s
, "X-Auth-Token", token_val
);
732 ret
= STATUS_NO_CONTENT
;
735 set_req_state_err(s
, ret
);
740 int RGWHandler_SWIFT_Auth::init(RGWRados
*store
, struct req_state
*state
,
741 rgw::io::BasicClient
*cio
)
743 state
->dialect
= "swift-auth";
744 state
->formatter
= new JSONFormatter
;
745 state
->format
= RGW_FORMAT_JSON
;
747 return RGWHandler::init(store
, state
, cio
);
750 int RGWHandler_SWIFT_Auth::authorize(const DoutPrefixProvider
*dpp
)
755 RGWOp
*RGWHandler_SWIFT_Auth::op_get()
757 return new RGW_SWIFT_Auth_Get
;