client_auth.go

// Copyright 2015 The etcd Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package v2http

import (
	"encoding/json"
	"net/http"
	"path"
	"strings"

	"github.com/CloudcadeSF/etcd/etcdserver/api"
	"github.com/CloudcadeSF/etcd/etcdserver/api/v2auth"
	"github.com/CloudcadeSF/etcd/etcdserver/api/v2http/httptypes"

	"go.uber.org/zap"
)

type authHandler struct {
	lg                    *zap.Logger
	sec                   v2auth.Store
	cluster               api.Cluster
	clientCertAuthEnabled bool
}

func hasWriteRootAccess(lg *zap.Logger, sec v2auth.Store, r *http.Request, clientCertAuthEnabled bool) bool {
	if r.Method == "GET" || r.Method == "HEAD" {
		return true
	}
	return hasRootAccess(lg, sec, r, clientCertAuthEnabled)
}

func userFromBasicAuth(lg *zap.Logger, sec v2auth.Store, r *http.Request) *v2auth.User {
	username, password, ok := r.BasicAuth()
	if !ok {
		if lg != nil {
			lg.Warn("malformed basic auth encoding")
		} else {
			plog.Warningf("auth: malformed basic auth encoding")
		}
		return nil
	}
	user, err := sec.GetUser(username)
	if err != nil {
		return nil
	}

	ok = sec.CheckPassword(user, password)
	if !ok {
		if lg != nil {
			lg.Warn("incorrect password", zap.String("user-name", username))
		} else {
			plog.Warningf("auth: incorrect password for user: %s", username)
		}
		return nil
	}
	return &user
}

func userFromClientCertificate(lg *zap.Logger, sec v2auth.Store, r *http.Request) *v2auth.User {
	if r.TLS == nil {
		return nil
	}

	for _, chains := range r.TLS.VerifiedChains {
		for _, chain := range chains {
			if lg != nil {
				lg.Debug("found common name", zap.String("common-name", chain.Subject.CommonName))
			} else {
				plog.Debugf("auth: found common name %s.\n", chain.Subject.CommonName)
			}
			user, err := sec.GetUser(chain.Subject.CommonName)
			if err == nil {
				if lg != nil {
					lg.Debug(
						"authenticated a user via common name",
						zap.String("user-name", user.User),
						zap.String("common-name", chain.Subject.CommonName),
					)
				} else {
					plog.Debugf("auth: authenticated user %s by cert common name.", user.User)
				}
				return &user
			}
		}
	}
	return nil
}

func hasRootAccess(lg *zap.Logger, sec v2auth.Store, r *http.Request, clientCertAuthEnabled bool) bool {
	if sec == nil {
		// No store means no auth available, eg, tests.
		return true
	}
	if !sec.AuthEnabled() {
		return true
	}

	var rootUser *v2auth.User
	if r.Header.Get("Authorization") == "" && clientCertAuthEnabled {
		rootUser = userFromClientCertificate(lg, sec, r)
		if rootUser == nil {
			return false
		}
	} else {
		rootUser = userFromBasicAuth(lg, sec, r)
		if rootUser == nil {
			return false
		}
	}

	for _, role := range rootUser.Roles {
		if role == v2auth.RootRoleName {
			return true
		}
	}

	if lg != nil {
		lg.Warn(
			"a user does not have root role for resource",
			zap.String("root-user", rootUser.User),
			zap.String("root-role-name", v2auth.RootRoleName),
			zap.String("resource-path", r.URL.Path),
		)
	} else {
		plog.Warningf("auth: user %s does not have the %s role for resource %s.", rootUser.User, v2auth.RootRoleName, r.URL.Path)
	}
	return false
}

func hasKeyPrefixAccess(lg *zap.Logger, sec v2auth.Store, r *http.Request, key string, recursive, clientCertAuthEnabled bool) bool {
	if sec == nil {
		// No store means no auth available, eg, tests.
		return true
	}
	if !sec.AuthEnabled() {
		return true
	}

	var user *v2auth.User
	if r.Header.Get("Authorization") == "" {
		if clientCertAuthEnabled {
			user = userFromClientCertificate(lg, sec, r)
		}
		if user == nil {
			return hasGuestAccess(lg, sec, r, key)
		}
	} else {
		user = userFromBasicAuth(lg, sec, r)
		if user == nil {
			return false
		}
	}

	writeAccess := r.Method != "GET" && r.Method != "HEAD"
	for _, roleName := range user.Roles {
		role, err := sec.GetRole(roleName)
		if err != nil {
			continue
		}
		if recursive {
			if role.HasRecursiveAccess(key, writeAccess) {
				return true
			}
		} else if role.HasKeyAccess(key, writeAccess) {
			return true
		}
	}

	if lg != nil {
		lg.Warn(
			"invalid access for user on key",
			zap.String("user-name", user.User),
			zap.String("key", key),
		)
	} else {
		plog.Warningf("auth: invalid access for user %s on key %s.", user.User, key)
	}
	return false
}

func hasGuestAccess(lg *zap.Logger, sec v2auth.Store, r *http.Request, key string) bool {
	writeAccess := r.Method != "GET" && r.Method != "HEAD"
	role, err := sec.GetRole(v2auth.GuestRoleName)
	if err != nil {
		return false
	}
	if role.HasKeyAccess(key, writeAccess) {
		return true
	}

	if lg != nil {
		lg.Warn(
			"invalid access for a guest role on key",
			zap.String("role-name", v2auth.GuestRoleName),
			zap.String("key", key),
		)
	} else {
		plog.Warningf("auth: invalid access for unauthenticated user on resource %s.", key)
	}
	return false
}

func writeNoAuth(lg *zap.Logger, w http.ResponseWriter, r *http.Request) {
	herr := httptypes.NewHTTPError(http.StatusUnauthorized, "Insufficient credentials")
	if err := herr.WriteTo(w); err != nil {
		if lg != nil {
			lg.Debug(
				"failed to write v2 HTTP error",
				zap.String("remote-addr", r.RemoteAddr),
				zap.Error(err),
			)
		} else {
			plog.Debugf("error writing HTTPError (%v) to %s", err, r.RemoteAddr)
		}
	}
}

func handleAuth(mux *http.ServeMux, sh *authHandler) {
	mux.HandleFunc(authPrefix+"/roles", authCapabilityHandler(sh.baseRoles))
	mux.HandleFunc(authPrefix+"/roles/", authCapabilityHandler(sh.handleRoles))
	mux.HandleFunc(authPrefix+"/users", authCapabilityHandler(sh.baseUsers))
	mux.HandleFunc(authPrefix+"/users/", authCapabilityHandler(sh.handleUsers))
	mux.HandleFunc(authPrefix+"/enable", authCapabilityHandler(sh.enableDisable))
}

func (sh *authHandler) baseRoles(w http.ResponseWriter, r *http.Request) {
	if !allowMethod(w, r.Method, "GET") {
		return
	}
	if !hasRootAccess(sh.lg, sh.sec, r, sh.clientCertAuthEnabled) {
		writeNoAuth(sh.lg, w, r)
		return
	}

	w.Header().Set("X-Etcd-Cluster-ID", sh.cluster.ID().String())
	w.Header().Set("Content-Type", "application/json")

	roles, err := sh.sec.AllRoles()
	if err != nil {
		writeError(sh.lg, w, r, err)
		return
	}
	if roles == nil {
		roles = make([]string, 0)
	}

	err = r.ParseForm()
	if err != nil {
		writeError(sh.lg, w, r, err)
		return
	}

	var rolesCollections struct {
		Roles []v2auth.Role `json:"roles"`
	}
	for _, roleName := range roles {
		var role v2auth.Role
		role, err = sh.sec.GetRole(roleName)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}
		rolesCollections.Roles = append(rolesCollections.Roles, role)
	}
	err = json.NewEncoder(w).Encode(rolesCollections)

	if err != nil {
		if sh.lg != nil {
			sh.lg.Warn(
				"failed to encode base roles",
				zap.String("url", r.URL.String()),
				zap.Error(err),
			)
		} else {
			plog.Warningf("baseRoles error encoding on %s", r.URL)
		}
		writeError(sh.lg, w, r, err)
		return
	}
}

func (sh *authHandler) handleRoles(w http.ResponseWriter, r *http.Request) {
	subpath := path.Clean(r.URL.Path[len(authPrefix):])
	// Split "/roles/rolename/command".
	// First item is an empty string, second is "roles"
	pieces := strings.Split(subpath, "/")
	if len(pieces) == 2 {
		sh.baseRoles(w, r)
		return
	}
	if len(pieces) != 3 {
		writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid path"))
		return
	}
	sh.forRole(w, r, pieces[2])
}

func (sh *authHandler) forRole(w http.ResponseWriter, r *http.Request, role string) {
	if !allowMethod(w, r.Method, "GET", "PUT", "DELETE") {
		return
	}
	if !hasRootAccess(sh.lg, sh.sec, r, sh.clientCertAuthEnabled) {
		writeNoAuth(sh.lg, w, r)
		return
	}
	w.Header().Set("X-Etcd-Cluster-ID", sh.cluster.ID().String())
	w.Header().Set("Content-Type", "application/json")

	switch r.Method {
	case "GET":
		data, err := sh.sec.GetRole(role)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}
		err = json.NewEncoder(w).Encode(data)
		if err != nil {
			if sh.lg != nil {
				sh.lg.Warn(
					"failed to encode a role",
					zap.String("url", r.URL.String()),
					zap.Error(err),
				)
			} else {
				plog.Warningf("forRole error encoding on %s", r.URL)
			}
			return
		}
		return

	case "PUT":
		var in v2auth.Role
		err := json.NewDecoder(r.Body).Decode(&in)
		if err != nil {
			writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid JSON in request body."))
			return
		}
		if in.Role != role {
			writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Role JSON name does not match the name in the URL"))
			return
		}

		var out v2auth.Role

		// create
		if in.Grant.IsEmpty() && in.Revoke.IsEmpty() {
			err = sh.sec.CreateRole(in)
			if err != nil {
				writeError(sh.lg, w, r, err)
				return
			}
			w.WriteHeader(http.StatusCreated)
			out = in
		} else {
			if !in.Permissions.IsEmpty() {
				writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Role JSON contains both permissions and grant/revoke"))
				return
			}
			out, err = sh.sec.UpdateRole(in)
			if err != nil {
				writeError(sh.lg, w, r, err)
				return
			}
			w.WriteHeader(http.StatusOK)
		}

		err = json.NewEncoder(w).Encode(out)
		if err != nil {
			if sh.lg != nil {
				sh.lg.Warn(
					"failed to encode a role",
					zap.String("url", r.URL.String()),
					zap.Error(err),
				)
			} else {
				plog.Warningf("forRole error encoding on %s", r.URL)
			}
			return
		}
		return

	case "DELETE":
		err := sh.sec.DeleteRole(role)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}
	}
}

type userWithRoles struct {
	User  string        `json:"user"`
	Roles []v2auth.Role `json:"roles,omitempty"`
}

type usersCollections struct {
	Users []userWithRoles `json:"users"`
}

func (sh *authHandler) baseUsers(w http.ResponseWriter, r *http.Request) {
	if !allowMethod(w, r.Method, "GET") {
		return
	}
	if !hasRootAccess(sh.lg, sh.sec, r, sh.clientCertAuthEnabled) {
		writeNoAuth(sh.lg, w, r)
		return
	}
	w.Header().Set("X-Etcd-Cluster-ID", sh.cluster.ID().String())
	w.Header().Set("Content-Type", "application/json")

	users, err := sh.sec.AllUsers()
	if err != nil {
		writeError(sh.lg, w, r, err)
		return
	}
	if users == nil {
		users = make([]string, 0)
	}

	err = r.ParseForm()
	if err != nil {
		writeError(sh.lg, w, r, err)
		return
	}

	ucs := usersCollections{}
	for _, userName := range users {
		var user v2auth.User
		user, err = sh.sec.GetUser(userName)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}

		uwr := userWithRoles{User: user.User}
		for _, roleName := range user.Roles {
			var role v2auth.Role
			role, err = sh.sec.GetRole(roleName)
			if err != nil {
				continue
			}
			uwr.Roles = append(uwr.Roles, role)
		}

		ucs.Users = append(ucs.Users, uwr)
	}
	err = json.NewEncoder(w).Encode(ucs)

	if err != nil {
		if sh.lg != nil {
			sh.lg.Warn(
				"failed to encode users",
				zap.String("url", r.URL.String()),
				zap.Error(err),
			)
		} else {
			plog.Warningf("baseUsers error encoding on %s", r.URL)
		}
		writeError(sh.lg, w, r, err)
		return
	}
}

func (sh *authHandler) handleUsers(w http.ResponseWriter, r *http.Request) {
	subpath := path.Clean(r.URL.Path[len(authPrefix):])
	// Split "/users/username".
	// First item is an empty string, second is "users"
	pieces := strings.Split(subpath, "/")
	if len(pieces) == 2 {
		sh.baseUsers(w, r)
		return
	}
	if len(pieces) != 3 {
		writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid path"))
		return
	}
	sh.forUser(w, r, pieces[2])
}

func (sh *authHandler) forUser(w http.ResponseWriter, r *http.Request, user string) {
	if !allowMethod(w, r.Method, "GET", "PUT", "DELETE") {
		return
	}
	if !hasRootAccess(sh.lg, sh.sec, r, sh.clientCertAuthEnabled) {
		writeNoAuth(sh.lg, w, r)
		return
	}
	w.Header().Set("X-Etcd-Cluster-ID", sh.cluster.ID().String())
	w.Header().Set("Content-Type", "application/json")

	switch r.Method {
	case "GET":
		u, err := sh.sec.GetUser(user)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}

		err = r.ParseForm()
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}

		uwr := userWithRoles{User: u.User}
		for _, roleName := range u.Roles {
			var role v2auth.Role
			role, err = sh.sec.GetRole(roleName)
			if err != nil {
				writeError(sh.lg, w, r, err)
				return
			}
			uwr.Roles = append(uwr.Roles, role)
		}
		err = json.NewEncoder(w).Encode(uwr)

		if err != nil {
			if sh.lg != nil {
				sh.lg.Warn(
					"failed to encode roles",
					zap.String("url", r.URL.String()),
					zap.Error(err),
				)
			} else {
				plog.Warningf("forUser error encoding on %s", r.URL)
			}
			return
		}
		return

	case "PUT":
		var u v2auth.User
		err := json.NewDecoder(r.Body).Decode(&u)
		if err != nil {
			writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "Invalid JSON in request body."))
			return
		}
		if u.User != user {
			writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "User JSON name does not match the name in the URL"))
			return
		}

		var (
			out     v2auth.User
			created bool
		)

		if len(u.Grant) == 0 && len(u.Revoke) == 0 {
			// create or update
			if len(u.Roles) != 0 {
				out, err = sh.sec.CreateUser(u)
			} else {
				// if user passes in both password and roles, we are unsure about his/her
				// intention.
				out, created, err = sh.sec.CreateOrUpdateUser(u)
			}

			if err != nil {
				writeError(sh.lg, w, r, err)
				return
			}
		} else {
			// update case
			if len(u.Roles) != 0 {
				writeError(sh.lg, w, r, httptypes.NewHTTPError(http.StatusBadRequest, "User JSON contains both roles and grant/revoke"))
				return
			}
			out, err = sh.sec.UpdateUser(u)
			if err != nil {
				writeError(sh.lg, w, r, err)
				return
			}
		}

		if created {
			w.WriteHeader(http.StatusCreated)
		} else {
			w.WriteHeader(http.StatusOK)
		}

		out.Password = ""

		err = json.NewEncoder(w).Encode(out)
		if err != nil {
			if sh.lg != nil {
				sh.lg.Warn(
					"failed to encode a user",
					zap.String("url", r.URL.String()),
					zap.Error(err),
				)
			} else {
				plog.Warningf("forUser error encoding on %s", r.URL)
			}
			return
		}
		return

	case "DELETE":
		err := sh.sec.DeleteUser(user)
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}
	}
}

type enabled struct {
	Enabled bool `json:"enabled"`
}

func (sh *authHandler) enableDisable(w http.ResponseWriter, r *http.Request) {
	if !allowMethod(w, r.Method, "GET", "PUT", "DELETE") {
		return
	}
	if !hasWriteRootAccess(sh.lg, sh.sec, r, sh.clientCertAuthEnabled) {
		writeNoAuth(sh.lg, w, r)
		return
	}
	w.Header().Set("X-Etcd-Cluster-ID", sh.cluster.ID().String())
	w.Header().Set("Content-Type", "application/json")
	isEnabled := sh.sec.AuthEnabled()
	switch r.Method {
	case "GET":
		jsonDict := enabled{isEnabled}
		err := json.NewEncoder(w).Encode(jsonDict)
		if err != nil {
			if sh.lg != nil {
				sh.lg.Warn(
					"failed to encode a auth state",
					zap.String("url", r.URL.String()),
					zap.Error(err),
				)
			} else {
				plog.Warningf("error encoding auth state on %s", r.URL)
			}
		}

	case "PUT":
		err := sh.sec.EnableAuth()
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}

	case "DELETE":
		err := sh.sec.DisableAuth()
		if err != nil {
			writeError(sh.lg, w, r, err)
			return
		}
	}
}