2015-01-06 06:20:04 +08:00
|
|
|
package security
|
|
|
|
|
|
|
|
import (
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"net"
|
|
|
|
"net/http"
|
2015-11-23 01:31:39 +08:00
|
|
|
"strings"
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2016-06-03 09:09:14 +08:00
|
|
|
"github.com/chrislusf/seaweedfs/weed/glog"
|
2015-01-06 06:20:04 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
ErrUnauthorized = errors.New("unauthorized token")
|
|
|
|
)
|
|
|
|
|
|
|
|
/*
|
|
|
|
Guard is to ensure data access security.
|
|
|
|
There are 2 ways to check access:
|
|
|
|
1. white list. It's checking request ip address.
|
|
|
|
2. JSON Web Token(JWT) generated from secretKey.
|
|
|
|
The jwt can come from:
|
|
|
|
1. url parameter jwt=...
|
|
|
|
2. request header "Authorization"
|
|
|
|
3. cookie with the name "jwt"
|
|
|
|
|
|
|
|
The white list is checked first because it is easy.
|
|
|
|
Then the JWT is checked.
|
|
|
|
|
|
|
|
The Guard will also check these claims if provided:
|
|
|
|
1. "exp" Expiration Time
|
|
|
|
2. "nbf" Not Before
|
|
|
|
|
|
|
|
Generating JWT:
|
|
|
|
1. use HS256 to sign
|
|
|
|
2. optionally set "exp", "nbf" fields, in Unix time,
|
|
|
|
the number of seconds elapsed since January 1, 1970 UTC.
|
|
|
|
|
|
|
|
Referenced:
|
|
|
|
https://github.com/pkieltyka/jwtauth/blob/master/jwtauth.go
|
|
|
|
|
|
|
|
*/
|
|
|
|
type Guard struct {
|
|
|
|
whiteList []string
|
2015-02-08 07:35:28 +08:00
|
|
|
SecretKey Secret
|
2015-01-06 06:20:04 +08:00
|
|
|
|
|
|
|
isActive bool
|
|
|
|
}
|
|
|
|
|
|
|
|
func NewGuard(whiteList []string, secretKey string) *Guard {
|
2015-02-08 07:35:28 +08:00
|
|
|
g := &Guard{whiteList: whiteList, SecretKey: Secret(secretKey)}
|
|
|
|
g.isActive = len(g.whiteList) != 0 || len(g.SecretKey) != 0
|
2015-01-06 06:20:04 +08:00
|
|
|
return g
|
|
|
|
}
|
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
func (g *Guard) WhiteList(f func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
|
2015-01-06 06:20:04 +08:00
|
|
|
if !g.isActive {
|
|
|
|
//if no security needed, just skip all checkings
|
|
|
|
return f
|
|
|
|
}
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
2015-02-08 07:35:28 +08:00
|
|
|
if err := g.checkWhiteList(w, r); err != nil {
|
2015-01-06 06:20:04 +08:00
|
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
f(w, r)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
func (g *Guard) Secure(f func(w http.ResponseWriter, r *http.Request)) func(w http.ResponseWriter, r *http.Request) {
|
2015-01-06 06:20:04 +08:00
|
|
|
if !g.isActive {
|
2015-02-08 07:35:28 +08:00
|
|
|
//if no security needed, just skip all checkings
|
|
|
|
return f
|
|
|
|
}
|
|
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
if err := g.checkJwt(w, r); err != nil {
|
|
|
|
w.WriteHeader(http.StatusUnauthorized)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
f(w, r)
|
2015-01-06 06:20:04 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-11-23 01:31:39 +08:00
|
|
|
func GetActualRemoteHost(r *http.Request) (host string, err error) {
|
|
|
|
host = r.Header.Get("HTTP_X_FORWARDED_FOR")
|
|
|
|
if host == "" {
|
|
|
|
host = r.Header.Get("X-FORWARDED-FOR")
|
|
|
|
}
|
|
|
|
if strings.Contains(host, ",") {
|
|
|
|
host = host[0:strings.Index(host, ",")]
|
|
|
|
}
|
|
|
|
if host == "" {
|
|
|
|
host, _, err = net.SplitHostPort(r.RemoteAddr)
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
func (g *Guard) checkWhiteList(w http.ResponseWriter, r *http.Request) error {
|
|
|
|
if len(g.whiteList) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-11-23 01:31:39 +08:00
|
|
|
host, err := GetActualRemoteHost(r)
|
2015-02-08 07:35:28 +08:00
|
|
|
if err == nil {
|
|
|
|
for _, ip := range g.whiteList {
|
2015-09-05 15:00:13 +08:00
|
|
|
|
2015-10-20 13:03:18 +08:00
|
|
|
// If the whitelist entry contains a "/" it
|
|
|
|
// is a CIDR range, and we should check the
|
|
|
|
// remote host is within it
|
2016-04-15 05:42:19 +08:00
|
|
|
if strings.Contains(ip, "/") {
|
2015-10-20 13:03:18 +08:00
|
|
|
_, cidrnet, err := net.ParseCIDR(ip)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
remote := net.ParseIP(host)
|
|
|
|
if cidrnet.Contains(remote) {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
//
|
|
|
|
// Otherwise we're looking for a literal match.
|
|
|
|
//
|
2015-02-08 07:35:28 +08:00
|
|
|
if ip == host {
|
|
|
|
return nil
|
2015-01-06 06:20:04 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
glog.V(1).Infof("Not in whitelist: %s", r.RemoteAddr)
|
|
|
|
return fmt.Errorf("Not in whitelis: %s", r.RemoteAddr)
|
|
|
|
}
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
func (g *Guard) checkJwt(w http.ResponseWriter, r *http.Request) error {
|
|
|
|
if g.checkWhiteList(w, r) == nil {
|
|
|
|
return nil
|
|
|
|
}
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
if len(g.SecretKey) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
tokenStr := GetJwt(r)
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
if tokenStr == "" {
|
|
|
|
return ErrUnauthorized
|
|
|
|
}
|
2015-01-06 06:20:04 +08:00
|
|
|
|
2015-02-08 07:35:28 +08:00
|
|
|
// Verify the token
|
|
|
|
token, err := DecodeJwt(g.SecretKey, tokenStr)
|
|
|
|
if err != nil {
|
|
|
|
glog.V(1).Infof("Token verification error from %s: %v", r.RemoteAddr, err)
|
|
|
|
return ErrUnauthorized
|
|
|
|
}
|
|
|
|
if !token.Valid {
|
|
|
|
glog.V(1).Infof("Token invliad from %s: %v", r.RemoteAddr, tokenStr)
|
|
|
|
return ErrUnauthorized
|
2015-01-06 06:20:04 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
glog.V(1).Infof("No permission from %s", r.RemoteAddr)
|
|
|
|
return fmt.Errorf("No write permisson from %s", r.RemoteAddr)
|
|
|
|
}
|