Implement authorization support

pkg/api/minioapi/minioapi.go

@@ -23,10 +23,13 @@ import (
 	"log"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/gorilla/mux"
 	mstorage "github.com/minio-io/minio/pkg/storage"
+	"github.com/minio-io/minio/pkg/utils/config"
+	"github.com/minio-io/minio/pkg/utils/crypto/signers"
 )
 
 type contentType int
@@ -44,6 +47,11 @@ type minioApi struct {
 	storage mstorage.Storage
 }
 
+type vHandler struct {
+	conf    config.Config
+	handler http.Handler
+}
+
 // No encoder interface exists, so we create one.
 type encoder interface {
 	Encode(v interface{}) error
@@ -54,6 +62,11 @@ func HttpHandler(storage mstorage.Storage) http.Handler {
 	var api = minioApi{}
 	api.storage = storage
 
+	var conf = config.Config{}
+	if err := conf.SetupConfig(); err != nil {
+		log.Fatal(err)
+	}
+
 	// Re-direct /path to /path/
 	mux.StrictSlash(true)
 	mux.HandleFunc("/", api.listBucketsHandler).Methods("GET")
@@ -63,7 +76,50 @@ func HttpHandler(storage mstorage.Storage) http.Handler {
 	mux.HandleFunc("/{bucket}/{object:.*}", api.headObjectHandler).Methods("HEAD")
 	mux.HandleFunc("/{bucket}/{object:.*}", api.putObjectHandler).Methods("PUT")
 
-	return ignoreUnimplementedResources(mux)
+	return validateHandler(conf, ignoreUnimplementedResources(mux))
+}
+
+// grab AccessKey from authorization header
+func stripAccessKey(r *http.Request) string {
+	fields := strings.Fields(r.Header.Get("Authorization"))
+	if len(fields) < 2 {
+		return ""
+	}
+	splits := strings.Split(fields[1], ":")
+	if len(splits) < 2 {
+		return ""
+	}
+	return splits[0]
+}
+
+func validateHandler(conf config.Config, h http.Handler) http.Handler {
+	return vHandler{conf, h}
+}
+
+func (h vHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	accessKey := stripAccessKey(r)
+	if accessKey != "" {
+		if err := h.conf.ReadConfig(); err != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+		} else {
+			user := h.conf.GetKey(accessKey)
+			ok, err := signers.ValidateRequest(user, r)
+			if ok {
+				h.handler.ServeHTTP(w, r)
+			} else {
+				w.WriteHeader(http.StatusUnauthorized)
+				w.Write([]byte(err.Error()))
+			}
+		}
+	} else {
+		//No access key found, handle this more appropriately
+		//TODO: Remove this after adding tests to support signature
+		//request
+		h.handler.ServeHTTP(w, r)
+		//Add this line, to reply back for invalid requests
+		//w.WriteHeader(http.StatusUnauthorized)
+		//w.Write([]byte("Authorization header malformed")
+	}
 }
 
 func ignoreUnimplementedResources(h http.Handler) http.Handler {

pkg/utils/config/config.go

@@ -55,6 +55,14 @@ func (c *Config) IsUserExists(username string) bool {
 	return false
 }
 
+func (c *Config) GetKey(accessKey string) User {
+	value, ok := c.Users[accessKey]
+	if !ok {
+		return User{}
+	}
+	return value
+}
+
 func (c *Config) GetUser(username string) User {
 	for _, user := range c.Users {
 		if user.Name == username {

pkg/utils/crypto/keys/common.go

@@ -8,3 +8,21 @@ const (
 func isalnum(c byte) bool {
 	return '0' <= c && c <= '9' || 'A' <= c && c <= 'Z' || 'a' <= c && c <= 'z'
 }
+
+func ValidateAccessKey(key []byte) bool {
+	for _, char := range key {
+		if isalnum(char) {
+			continue
+		}
+		switch char {
+		case '-':
+		case '.':
+		case '_':
+		case '~':
+			continue
+		default:
+			return false
+		}
+	}
+	return true
+}

pkg/utils/crypto/signers/signers.go

@@ -1,191 +1,155 @@
 package signers
 
-//import (
+import (
-//	"bytes"
+	"bytes"
-//	"crypto/hmac"
+	"crypto/hmac"
-//	"crypto/sha1"
+	"crypto/sha1"
-//	"encoding/base64"
+	"encoding/base64"
-//	"fmt"
+	"fmt"
-//	"io"
+	"io"
-//	"net/http"
+	"net/http"
-//	"net/url"
+	"net/url"
-//	"sort"
+	"sort"
-//	"strings"
+	"strings"
-//
+	"time"
-//	"github.com/minio-io/minio/pkg/utils/database"
+
-//)
+	"github.com/minio-io/minio/pkg/utils/config"
-//
+)
-//func ValidateAccessKey(key []byte) bool {
+
-//	for _, char := range key {
+func SignRequest(user config.User, req *http.Request) {
-//		if isalnum(char) {
+	if date := req.Header.Get("Date"); date == "" {
-//			continue
+		req.Header.Set("Date", time.Now().UTC().Format(http.TimeFormat))
-//		}
+	}
-//		switch char {
+	hm := hmac.New(sha1.New, []byte(user.SecretKey))
-//		case '-':
+	ss := getStringToSign(req)
-//		case '.':
+	io.WriteString(hm, ss)
-//		case '_':
+
-//		case '~':
+	authHeader := new(bytes.Buffer)
-//			continue
+	fmt.Fprintf(authHeader, "AWS %s:", user.AccessKey)
-//		default:
+	encoder := base64.NewEncoder(base64.StdEncoding, authHeader)
-//			return false
+	encoder.Write(hm.Sum(nil))
-//		}
+	encoder.Close()
-//	}
+	req.Header.Set("Authorization", authHeader.String())
-//	return true
+}
-//}
+
-//
+// This package implements verification side of Object API Signature request
-//func getAccessID() {
+func ValidateRequest(user config.User, req *http.Request) (bool, error) {
-//}
+	if date := req.Header.Get("Date"); date == "" {
-//
+		return false, fmt.Errorf("Date should be set")
-//func getSecretID() {
+	}
-//}
+	hm := hmac.New(sha1.New, []byte(user.SecretKey))
-//
+	ss := getStringToSign(req)
-//// This package implements verification side of Object API Signature request
+	io.WriteString(hm, ss)
-//func ValidateRequest(req *http.Request) (bool, error) {
+
-//	if date := req.Header.Get("Date"); date == "" {
+	authHeader := new(bytes.Buffer)
-//		return false, fmt.Errorf("Date should be set")
+	fmt.Fprintf(authHeader, "AWS %s:", user.AccessKey)
-//	}
+	encoder := base64.NewEncoder(base64.StdEncoding, authHeader)
-//	hm := hmac.New(sha1.New, []byte(SecretAccessKey))
+	encoder.Write(hm.Sum(nil))
-//	ss := getStringToSign(req)
+	encoder.Close()
-//	io.WriteString(hm, ss)
+
-//	authHeader := new(bytes.Buffer)
+	if req.Header.Get("Authorization") != authHeader.String() {
-//	if req.Header.Get("User-Agent") == "Minio" {
+		return false, fmt.Errorf("Authorization header mismatch")
-//		fmt.Fprintf(authHeader, "MINIO %s:", AccessKey)
+	}
-//	} else {
+	return true, nil
-//		fmt.Fprintf(authHeader, "AWS %s:", AccessKey)
+}
-//	}
+
-//	encoder := base64.NewEncoder(base64.StdEncoding, authHeader)
+// From the Amazon docs:
-//	encoder.Write(hm.Sum(nil))
-//	defer encoder.Close()
-//	if req.Header.Get("Authorization") != authHeader.String() {
-//		return false, fmt.Errorf("Authorization header mismatch")
-//	}
-//	return true, nil
-//}
-//
-//// From the Amazon docs:
-////
-//// StringToSign = HTTP-Verb + "\n" +
-//// 	 Content-MD5 + "\n" +
-////	 Content-Type + "\n" +
-////	 Date + "\n" +
-////	 CanonicalizedAmzHeaders +
-////	 CanonicalizedResource;
-//func getStringToSign(req *http.Request) string {
-//	buf := new(bytes.Buffer)
-//	buf.WriteString(req.Method)
-//	buf.WriteByte('\n')
-//	buf.WriteString(req.Header.Get("Content-MD5"))
-//	buf.WriteByte('\n')
-//	buf.WriteString(req.Header.Get("Content-Type"))
-//	buf.WriteByte('\n')
-//	if req.Header.Get("x-amz-date") == "" {
-//		buf.WriteString(req.Header.Get("Date"))
-//	}
-//	buf.WriteByte('\n')
-//	writeCanonicalizedAmzHeaders(buf, req)
-//	writeCanonicalizedResource(buf, req)
-//	return buf.String()
-//}
-//
-//func hasPrefixCaseInsensitive(s, pfx string) bool {
-//	if len(pfx) > len(s) {
-//		return false
-//	}
-//	shead := s[:len(pfx)]
-//	if shead == pfx {
-//		return true
-//	}
-//	shead = strings.ToLower(shead)
-//	return shead == pfx || shead == strings.ToLower(pfx)
-//}
-//
-//func writeCanonicalizedAmzHeaders(buf *bytes.Buffer, req *http.Request) {
-//	amzHeaders := make([]string, 0)
-//	vals := make(map[string][]string)
-//	for k, vv := range req.Header {
-//		if hasPrefixCaseInsensitive(k, "x-amz-") {
-//			lk := strings.ToLower(k)
-//			amzHeaders = append(amzHeaders, lk)
-//			vals[lk] = vv
-//		}
-//	}
-//	sort.Strings(amzHeaders)
-//	for _, k := range amzHeaders {
-//		buf.WriteString(k)
-//		buf.WriteByte(':')
-//		for idx, v := range vals[k] {
-//			if idx > 0 {
-//				buf.WriteByte(',')
-//			}
-//			if strings.Contains(v, "\n") {
-//				// TODO: "Unfold" long headers that
-//				// span multiple lines (as allowed by
-//				// RFC 2616, section 4.2) by replacing
-//				// the folding white-space (including
-//				// new-line) by a single space.
-//				buf.WriteString(v)
-//			} else {
-//				buf.WriteString(v)
-//			}
-//		}
-//		buf.WriteByte('\n')
-//	}
-//}
-//
-//// Must be sorted:
-//var subResList = []string{"acl", "lifecycle", "location", "logging", "notification", "partNumber", "policy", "requestPayment", "torrent", "uploadId", "uploads", "versionId", "versioning", "versions", "website"}
-//
-//// From the Amazon docs:
-////
-//// CanonicalizedResource = [ "/" + Bucket ] +
-//// 	  <HTTP-Request-URI, from the protocol name up to the query string> +
-//// 	  [ sub-resource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
-//func writeCanonicalizedResource(buf *bytes.Buffer, req *http.Request) {
-//	bucket := getBucketFromHostname(req)
-//	if bucket != "" {
-//		buf.WriteByte('/')
-//		buf.WriteString(bucket)
-//	}
-//	buf.WriteString(req.URL.Path)
-//	if req.URL.RawQuery != "" {
-//		n := 0
-//		vals, _ := url.ParseQuery(req.URL.RawQuery)
-//		for _, subres := range subResList {
-//			if vv, ok := vals[subres]; ok && len(vv) > 0 {
-//				n++
-//				if n == 1 {
-//					buf.WriteByte('?')
-//				} else {
-//					buf.WriteByte('&')
-//				}
-//				buf.WriteString(subres)
-//				if len(vv[0]) > 0 {
-//					buf.WriteByte('=')
-//					buf.WriteString(url.QueryEscape(vv[0]))
-//				}
-//			}
-//		}
-//	}
-//}
 //
-//// hasDotSuffix reports whether s ends with "." + suffix.
+// StringToSign = HTTP-Verb + "\n" +
-//func hasDotSuffix(s string, suffix string) bool {
+// 	 Content-MD5 + "\n" +
-//	return len(s) >= len(suffix)+1 && strings.HasSuffix(s, suffix) && s[len(s)-len(suffix)-1] == '.'
+//	 Content-Type + "\n" +
-//}
+//	 Date + "\n" +
+//	 CanonicalizedAmzHeaders +
+//	 CanonicalizedResource;
+func getStringToSign(req *http.Request) string {
+	buf := new(bytes.Buffer)
+	buf.WriteString(req.Method)
+	buf.WriteByte('\n')
+	buf.WriteString(req.Header.Get("Content-MD5"))
+	buf.WriteByte('\n')
+	buf.WriteString(req.Header.Get("Content-Type"))
+	buf.WriteByte('\n')
+	if req.Header.Get("x-amz-date") == "" {
+		buf.WriteString(req.Header.Get("Date"))
+	}
+	buf.WriteByte('\n')
+	writeCanonicalizedAmzHeaders(buf, req)
+	writeCanonicalizedResource(buf, req)
+	return buf.String()
+}
+
+func hasPrefixCaseInsensitive(s, pfx string) bool {
+	if len(pfx) > len(s) {
+		return false
+	}
+	shead := s[:len(pfx)]
+	if shead == pfx {
+		return true
+	}
+	shead = strings.ToLower(shead)
+	return shead == pfx || shead == strings.ToLower(pfx)
+}
+
+func writeCanonicalizedAmzHeaders(buf *bytes.Buffer, req *http.Request) {
+	amzHeaders := make([]string, 0)
+	vals := make(map[string][]string)
+	for k, vv := range req.Header {
+		if hasPrefixCaseInsensitive(k, "x-amz-") {
+			lk := strings.ToLower(k)
+			amzHeaders = append(amzHeaders, lk)
+			vals[lk] = vv
+		}
+	}
+	sort.Strings(amzHeaders)
+	for _, k := range amzHeaders {
+		buf.WriteString(k)
+		buf.WriteByte(':')
+		for idx, v := range vals[k] {
+			if idx > 0 {
+				buf.WriteByte(',')
+			}
+			if strings.Contains(v, "\n") {
+				// TODO: "Unfold" long headers that
+				// span multiple lines (as allowed by
+				// RFC 2616, section 4.2) by replacing
+				// the folding white-space (including
+				// new-line) by a single space.
+				buf.WriteString(v)
+			} else {
+				buf.WriteString(v)
+			}
+		}
+		buf.WriteByte('\n')
+	}
+}
+
+// Must be sorted:
+var subResList = []string{"acl", "lifecycle", "location", "logging", "notification", "partNumber", "policy", "requestPayment", "torrent", "uploadId", "uploads", "versionId", "versioning", "versions", "website"}
+
+// From the Amazon docs:
 //
-//func getBucketFromHostname(req *http.Request) string {
+// CanonicalizedResource = [ "/" + Bucket ] +
-//	host := req.Host
+// 	  <HTTP-Request-URI, from the protocol name up to the query string> +
-//	if host == "" {
+// 	  [ sub-resource, if present. For example "?acl", "?location", "?logging", or "?torrent"];
-//		host = req.URL.Host
+func writeCanonicalizedResource(buf *bytes.Buffer, req *http.Request) {
-//	}
+	buf.WriteString(req.URL.Path)
-//	if host == "s3.amazonaws.com" {
+	if req.URL.RawQuery != "" {
-//		return ""
+		n := 0
-//	}
+		vals, _ := url.ParseQuery(req.URL.RawQuery)
-//	if hostSuffix := "s3.amazonaws.com"; hasDotSuffix(host, hostSuffix) {
+		for _, subres := range subResList {
-//		return host[:len(host)-len(hostSuffix)-1]
+			if vv, ok := vals[subres]; ok && len(vv) > 0 {
-//	}
+				n++
-//	if lastColon := strings.LastIndex(host, ":"); lastColon != -1 {
+				if n == 1 {
-//		return host[:lastColon]
+					buf.WriteByte('?')
-//	}
+				} else {
-//	return host
+					buf.WriteByte('&')
-//}
+				}
+				buf.WriteString(subres)
+				if len(vv[0]) > 0 {
+					buf.WriteByte('=')
+					buf.WriteString(url.QueryEscape(vv[0]))
+				}
+			}
+		}
+	}
+}