auth.go

// Copyright 2019 Huawei Technologies Co.,Ltd.
// Licensed under the Apache License, Version 2.0 (the "License"); you may not use
// this file except in compliance with the License.  You may obtain a copy of the
// License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software distributed
// under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
// CONDITIONS OF ANY KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations under the License.

package obs

import (
	"fmt"
	"net/url"
	"sort"
	"strings"
	"time"
)

func (obsClient ObsClient) doAuthTemporary(method, bucketName, objectKey, policy string, params map[string]string,
	headers map[string][]string, expires int64) (requestUrl string, err error) {

	sh := obsClient.GetSecurity()
	if sh.AK == "" || sh.SK == "" {
		doLog(LEVEL_WARN, "No ak/sk provided, skip to construct authorization")
	} else {
		if sh.SecurityToken != "" {
			params[HEADER_STS_TOKEN_AMZ] = sh.SecurityToken
		}
	}

	if policy != "" {
		objectKey = ""
	}

	requestUrl, canonicalizedUrl := obsClient.conf.formatUrls(bucketName, objectKey, params, true)
	parsedRequestUrl, err := url.Parse(requestUrl)
	if err != nil {
		return "", err
	}
	encodeHeaders(headers)
	hostName := parsedRequestUrl.Host

	isV4 := obsClient.conf.signature == SignatureV4
	prepareHostAndDate(headers, hostName, isV4)

	if sh.AK != "" && sh.SK != "" {
		if isV4 {
			date, parseDateFormatErr := time.Parse(RFC1123_FORMAT, headers[HEADER_DATE_CAMEL][0])
			if parseDateFormatErr != nil {
				doLog(LEVEL_WARN, "Parse date format failed, %s", parseDateFormatErr.Error())
			}
			delete(headers, HEADER_DATE_CAMEL)
			shortDate := date.Format(SHORT_DATE_FORMAT)
			longDate := date.Format(LONG_DATE_FORMAT)

			signedHeaders, _headers := getSignedHeaders(headers)

			credential, scope := getCredential(sh.AK, obsClient.conf.region, shortDate)
			params[PARAM_ALGORITHM_AMZ_CAMEL] = V4_HASH_PREFIX
			params[PARAM_CREDENTIAL_AMZ_CAMEL] = credential
			params[PARAM_DATE_AMZ_CAMEL] = longDate
			params[PARAM_EXPIRES_AMZ_CAMEL] = Int64ToString(expires)
			params[PARAM_SIGNEDHEADERS_AMZ_CAMEL] = strings.Join(signedHeaders, ";")

			requestUrl, canonicalizedUrl = obsClient.conf.formatUrls(bucketName, objectKey, params, true)
			var parseErr error
			parsedRequestUrl, parseErr = url.Parse(requestUrl)
			if parseErr != nil {
				doLog(LEVEL_WARN, "Parse url format failed, %s", parseErr.Error())
			}
			stringToSign := getV4StringToSign(method, canonicalizedUrl, parsedRequestUrl.RawQuery, scope, longDate, UNSIGNED_PAYLOAD, signedHeaders, _headers)
			signature := getSignature(stringToSign, sh.SK, obsClient.conf.region, shortDate)

			requestUrl += fmt.Sprintf("&%s=%s", PARAM_SIGNATURE_AMZ_CAMEL, UrlEncode(signature, false))

		} else {
			originDate := headers[HEADER_DATE_CAMEL][0]
			date, parseErr := time.Parse(RFC1123_FORMAT, originDate)
			if parseErr != nil {
				doLog(LEVEL_WARN, "Parse date format failed, %s", parseErr.Error())
			}
			expires += date.Unix()

			if policy == "" {
				headers[HEADER_DATE_CAMEL] = []string{Int64ToString(expires)}
			} else {
				policy = Base64Encode(StringToBytes(policy))
				headers[HEADER_DATE_CAMEL] = []string{policy}
				canonicalizedUrl = ""
			}

			stringToSign := getV2StringToSign(method, canonicalizedUrl, headers)
			signature := UrlEncode(Base64Encode(HmacSha1(StringToBytes(sh.SK), StringToBytes(stringToSign))), false)
			if strings.Index(requestUrl, "?") < 0 {
				requestUrl += "?"
			} else {
				requestUrl += "&"
			}
			delete(headers, HEADER_DATE_CAMEL)
			if policy == "" {
				requestUrl += fmt.Sprintf("AWSAccessKeyId=%s&Expires=%d&Signature=%s", UrlEncode(sh.AK, false),
					expires, signature)
			} else {
				requestUrl += fmt.Sprintf("AWSAccessKeyId=%s&Policy=%s&Signature=%s", UrlEncode(sh.AK, false),
					UrlEncode(policy, false), signature)
			}
		}
	}

	return
}

func (obsClient ObsClient) doAuth(method, bucketName, objectKey string, params map[string]string,
	headers map[string][]string, hostName string, needEncodeHeader, skipAuth bool) (requestUrl string, err error) {

	requestUrl, canonicalizedUrl := obsClient.conf.formatUrls(bucketName, objectKey, params, true)
	parsedRequestUrl, err := url.Parse(requestUrl)
	if err != nil {
		return "", err
	}

	delete(headers, HEADER_AUTH_CAMEL)
	delete(headers, HEADER_STS_TOKEN_AMZ)

	if needEncodeHeader {
		encodeHeaders(headers)
	}

	if hostName == "" {
		hostName = parsedRequestUrl.Host
	}

	isV4 := obsClient.conf.signature == SignatureV4
	prepareHostAndDate(headers, hostName, isV4)

	if skipAuth {
		return
	}

	sh := obsClient.GetSecurity()
	if sh.AK == "" || sh.SK == "" {
		doLog(LEVEL_WARN, "No ak/sk provided, skip to construct authorization")
	} else {
		if sh.SecurityToken != "" {
			headers[HEADER_STS_TOKEN_AMZ] = []string{sh.SecurityToken}
		}
		var authorization string
		if isV4 {
			headers[HEADER_CONTENT_SHA256_AMZ] = []string{EMPTY_CONTENT_SHA256}
			ret := v4Auth(sh.AK, sh.SK, obsClient.conf.region, method, canonicalizedUrl, parsedRequestUrl.RawQuery, headers)
			authorization = fmt.Sprintf("%s Credential=%s,SignedHeaders=%s,Signature=%s", V4_HASH_PREFIX, ret["Credential"], ret["SignedHeaders"], ret["Signature"])
		} else {
			ret := v2Auth(sh.AK, sh.SK, method, canonicalizedUrl, headers)
			authorization = fmt.Sprintf("%s %s:%s", V2_HASH_PREFIX, sh.AK, ret["Signature"])
		}
		headers[HEADER_AUTH_CAMEL] = []string{authorization}
	}

	return
}

func prepareHostAndDate(headers map[string][]string, hostName string, isV4 bool) {
	headers[HEADER_HOST_CAMEL] = []string{hostName}
	var requestDate string
	if date, ok := headers[HEADER_DATE_AMZ]; ok {
		flag := false
		if len(date) == 1 {
			if isV4 {
				if t, err := time.Parse(LONG_DATE_FORMAT, date[0]); err == nil {
					requestDate = FormatUtcToRfc1123(t)
					flag = true
				}
			} else {
				if strings.HasSuffix(date[0], "GMT") {
					requestDate = date[0]
					flag = true
				}
			}
		}
		if !flag {
			delete(headers, HEADER_DATE_AMZ)
		}
	}

	if requestDate == "" {
		requestDate = FormatUtcToRfc1123(time.Now().UTC())
	}

	headers[HEADER_DATE_CAMEL] = []string{requestDate}
}

func encodeHeaders(headers map[string][]string) {
	for key, values := range headers {
		for index, value := range values {
			values[index] = UrlEncode(value, true)
		}
		headers[key] = values
	}
}

func attachHeaders(headers map[string][]string) string {
	length := len(headers)
	_headers := make(map[string][]string, length)
	keys := make([]string, 0, length)

	for key, value := range headers {
		_key := strings.ToLower(strings.TrimSpace(key))
		if _key != "" {
			if _key == "content-md5" || _key == "content-type" || _key == "date" || strings.HasPrefix(_key, HEADER_PREFIX) {
				keys = append(keys, _key)
				_headers[_key] = value
			}
		} else {
			delete(headers, key)
		}
	}

	for _, interestedHeader := range interestedHeaders {
		if _, ok := _headers[interestedHeader]; !ok {
			_headers[interestedHeader] = []string{""}
			keys = append(keys, interestedHeader)
		}
	}

	if _, ok := _headers[HEADER_DATE_CAMEL]; ok {
		if _, ok := _headers[HEADER_DATE_AMZ]; ok {
			_headers[HEADER_DATE_CAMEL] = []string{""}
		} else if _, ok := headers[PARAM_DATE_AMZ_CAMEL]; ok {
			_headers[HEADER_DATE_CAMEL] = []string{""}
		}
	} else if _, ok := _headers[strings.ToLower(HEADER_DATE_CAMEL)]; ok {
		if _, ok := _headers[HEADER_DATE_AMZ]; ok {
			_headers[HEADER_DATE_CAMEL] = []string{""}
		} else if _, ok := headers[PARAM_DATE_AMZ_CAMEL]; ok {
			_headers[HEADER_DATE_CAMEL] = []string{""}
		}
	}

	sort.Strings(keys)

	stringToSign := make([]string, 0, len(keys))
	for _, key := range keys {
		var value string
		if strings.HasPrefix(key, HEADER_PREFIX) {
			if strings.HasPrefix(key, HEADER_PREFIX_META) {
				for index, v := range _headers[key] {
					value += strings.TrimSpace(v)
					if index != len(_headers[key])-1 {
						value += ","
					}
				}
			} else {
				value = strings.Join(_headers[key], ",")
			}
			value = fmt.Sprintf("%s:%s", key, value)
		} else {
			value = strings.Join(_headers[key], ",")
		}
		stringToSign = append(stringToSign, value)
	}
	return strings.Join(stringToSign, "\n")
}

func getV2StringToSign(method, canonicalizedUrl string, headers map[string][]string) string {
	stringToSign := strings.Join([]string{method, "\n", attachHeaders(headers), "\n", canonicalizedUrl}, "")
	doLog(LEVEL_DEBUG, "The v2 auth stringToSign:\n%s", stringToSign)
	return stringToSign
}

func v2Auth(ak, sk, method, canonicalizedUrl string, headers map[string][]string) map[string]string {
	stringToSign := getV2StringToSign(method, canonicalizedUrl, headers)
	return map[string]string{"Signature": Base64Encode(HmacSha1(StringToBytes(sk), StringToBytes(stringToSign)))}
}

func getScope(region, shortDate string) string {
	return fmt.Sprintf("%s/%s/%s/%s", shortDate, region, V4_SERVICE_NAME, V4_SERVICE_SUFFIX)
}

func getCredential(ak, region, shortDate string) (string, string) {
	scope := getScope(region, shortDate)
	return fmt.Sprintf("%s/%s", ak, scope), scope
}

func getV4StringToSign(method, canonicalizedUrl, queryUrl, scope, longDate, payload string, signedHeaders []string, headers map[string][]string) string {
	canonicalRequest := make([]string, 0, 10+len(signedHeaders)*4)
	canonicalRequest = append(canonicalRequest, method)
	canonicalRequest = append(canonicalRequest, "\n")
	canonicalRequest = append(canonicalRequest, canonicalizedUrl)
	canonicalRequest = append(canonicalRequest, "\n")
	canonicalRequest = append(canonicalRequest, queryUrl)
	canonicalRequest = append(canonicalRequest, "\n")

	for _, signedHeader := range signedHeaders {
		values, _ := headers[signedHeader]
		for _, value := range values {
			canonicalRequest = append(canonicalRequest, signedHeader)
			canonicalRequest = append(canonicalRequest, ":")
			canonicalRequest = append(canonicalRequest, value)
			canonicalRequest = append(canonicalRequest, "\n")
		}
	}
	canonicalRequest = append(canonicalRequest, "\n")
	canonicalRequest = append(canonicalRequest, strings.Join(signedHeaders, ";"))
	canonicalRequest = append(canonicalRequest, "\n")
	canonicalRequest = append(canonicalRequest, payload)

	_canonicalRequest := strings.Join(canonicalRequest, "")
	doLog(LEVEL_DEBUG, "The v4 auth canonicalRequest:\n%s", _canonicalRequest)

	stringToSign := make([]string, 0, 7)
	stringToSign = append(stringToSign, V4_HASH_PREFIX)
	stringToSign = append(stringToSign, "\n")
	stringToSign = append(stringToSign, longDate)
	stringToSign = append(stringToSign, "\n")
	stringToSign = append(stringToSign, scope)
	stringToSign = append(stringToSign, "\n")
	stringToSign = append(stringToSign, HexSha256(StringToBytes(_canonicalRequest)))

	_stringToSign := strings.Join(stringToSign, "")

	doLog(LEVEL_DEBUG, "The v4 auth stringToSign:\n%s", _stringToSign)
	return _stringToSign
}

func getSignedHeaders(headers map[string][]string) ([]string, map[string][]string) {
	length := len(headers)
	_headers := make(map[string][]string, length)
	signedHeaders := make([]string, 0, length)
	for key, value := range headers {
		_key := strings.ToLower(strings.TrimSpace(key))
		if _key != "" {
			signedHeaders = append(signedHeaders, _key)
			_headers[_key] = value
		} else {
			delete(headers, key)
		}
	}
	sort.Strings(signedHeaders)
	return signedHeaders, _headers
}

func getSignature(stringToSign, sk, region, shortDate string) string {
	key := HmacSha256(StringToBytes(V4_HASH_PRE+sk), StringToBytes(shortDate))
	key = HmacSha256(key, StringToBytes(region))
	key = HmacSha256(key, StringToBytes(V4_SERVICE_NAME))
	key = HmacSha256(key, StringToBytes(V4_SERVICE_SUFFIX))
	return Hex(HmacSha256(key, StringToBytes(stringToSign)))
}

func V4Auth(ak, sk, region, method, canonicalizedUrl, queryUrl string, headers map[string][]string) map[string]string {
	return v4Auth(ak, sk, region, method, canonicalizedUrl, queryUrl, headers)
}

func v4Auth(ak, sk, region, method, canonicalizedUrl, queryUrl string, headers map[string][]string) map[string]string {
	var t time.Time

	if val, ok := headers[HEADER_DATE_AMZ]; ok {
		var err error
		t, err = time.Parse(LONG_DATE_FORMAT, val[0])
		if err != nil {
			t = time.Now().UTC()
		}
	} else if val, ok := headers[PARAM_DATE_AMZ_CAMEL]; ok {
		var err error
		t, err = time.Parse(LONG_DATE_FORMAT, val[0])
		if err != nil {
			t = time.Now().UTC()
		}
	} else if val, ok := headers[HEADER_DATE_CAMEL]; ok {
		var err error
		t, err = time.Parse(RFC1123_FORMAT, val[0])
		if err != nil {
			t = time.Now().UTC()
		}
	} else if val, ok := headers[strings.ToLower(HEADER_DATE_CAMEL)]; ok {
		var err error
		t, err = time.Parse(RFC1123_FORMAT, val[0])
		if err != nil {
			t = time.Now().UTC()
		}
	} else {
		t = time.Now().UTC()
	}
	shortDate := t.Format(SHORT_DATE_FORMAT)
	longDate := t.Format(LONG_DATE_FORMAT)

	signedHeaders, _headers := getSignedHeaders(headers)

	credential, scope := getCredential(ak, region, shortDate)

	stringToSign := getV4StringToSign(method, canonicalizedUrl, queryUrl, scope, longDate, EMPTY_CONTENT_SHA256, signedHeaders, _headers)

	signature := getSignature(stringToSign, sk, region, shortDate)

	ret := make(map[string]string, 3)
	ret["Credential"] = credential
	ret["SignedHeaders"] = strings.Join(signedHeaders, ";")
	ret["Signature"] = signature
	return ret
}