267 lines
8.1 KiB
Rust
267 lines
8.1 KiB
Rust
//! Types for verifying requests with Actix Web
|
|
|
|
use crate::{Config, PrepareVerifyError, SignatureVerify};
|
|
use actix_web::{
|
|
dev::{MessageBody, Payload, Service, ServiceRequest, ServiceResponse, Transform},
|
|
http::StatusCode,
|
|
Error, FromRequest, HttpMessage, HttpRequest, HttpResponse, ResponseError,
|
|
};
|
|
use futures::future::{err, ok, ready, Ready};
|
|
use log::{debug, warn};
|
|
use std::{
|
|
future::Future,
|
|
pin::Pin,
|
|
task::{Context, Poll},
|
|
};
|
|
|
|
#[derive(Clone, Debug)]
|
|
/// A marker type that can be used to guard routes when the signature middleware is set to
|
|
/// 'optional'
|
|
pub struct SignatureVerified(String);
|
|
|
|
impl SignatureVerified {
|
|
/// Return the Key ID used to verify the request
|
|
///
|
|
/// It might be important for an application to verify that the payload being processed indeed
|
|
/// belongs to the owner of the key used to sign the request.
|
|
pub fn key_id(&self) -> &str {
|
|
&self.0
|
|
}
|
|
}
|
|
|
|
#[derive(Clone, Debug)]
|
|
/// The Verify signature middleware
|
|
///
|
|
/// ```rust,ignore
|
|
/// let middleware = VerifySignature::new(MyVerifier::new(), Config::default())
|
|
/// .authorization()
|
|
/// .optional();
|
|
///
|
|
/// HttpServer::new(move || {
|
|
/// App::new()
|
|
/// .wrap(middleware.clone())
|
|
/// .route("/protected", web::post().to(|_: SignatureVerified| "Verified Authorization Header"))
|
|
/// .route("/unprotected", web::post().to(|| "No verification required"))
|
|
/// })
|
|
/// ```
|
|
pub struct VerifySignature<T>(T, Config, HeaderKind, bool);
|
|
|
|
#[derive(Clone, Debug)]
|
|
#[doc(hidden)]
|
|
pub struct VerifyMiddleware<T, S>(S, Config, HeaderKind, bool, T);
|
|
|
|
#[derive(Copy, Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
|
|
enum HeaderKind {
|
|
Authorization,
|
|
Signature,
|
|
}
|
|
|
|
#[derive(Clone, Debug, thiserror::Error)]
|
|
#[error("Failed to verify http signature")]
|
|
#[doc(hidden)]
|
|
pub struct VerifyError;
|
|
|
|
impl<T> VerifySignature<T>
|
|
where
|
|
T: SignatureVerify,
|
|
{
|
|
/// Create a new middleware for verifying HTTP Signatures. A type implementing
|
|
/// [`SignatureVerify`] is required, as well as a Config
|
|
///
|
|
/// By default, this middleware expects to verify Signature headers, and requires the presence
|
|
/// of the header
|
|
pub fn new(verify_signature: T, config: Config) -> Self {
|
|
VerifySignature(verify_signature, config, HeaderKind::Signature, false)
|
|
}
|
|
|
|
/// Verify Authorization headers instead of Signature headers
|
|
pub fn authorization(self) -> Self {
|
|
VerifySignature(self.0, self.1, HeaderKind::Authorization, self.3)
|
|
}
|
|
|
|
/// Mark the presence of a Signature or Authorization header as optional
|
|
///
|
|
/// If a header is present, it will be verified, but if there is not one present, the request
|
|
/// is passed through. This can be used to set a global middleware, and then guard each route
|
|
/// handler with the [`SignatureVerified`] type.
|
|
pub fn optional(self) -> Self {
|
|
VerifySignature(self.0, self.1, self.2, true)
|
|
}
|
|
}
|
|
|
|
impl<T, S, B> VerifyMiddleware<T, S>
|
|
where
|
|
T: SignatureVerify + 'static,
|
|
T::Future: 'static,
|
|
S: Service<Request = ServiceRequest, Response = ServiceResponse<B>, Error = Error> + 'static,
|
|
B: MessageBody + 'static,
|
|
{
|
|
fn handle(
|
|
&mut self,
|
|
req: ServiceRequest,
|
|
) -> Pin<Box<dyn Future<Output = Result<ServiceResponse<B>, Error>>>> {
|
|
let res = self.1.begin_verify(
|
|
req.method(),
|
|
req.uri().path_and_query(),
|
|
req.headers().clone(),
|
|
);
|
|
|
|
let unverified = match res {
|
|
Ok(unverified) => unverified,
|
|
Err(PrepareVerifyError::Expired) => {
|
|
warn!("Header is expired");
|
|
return Box::pin(err(VerifyError.into()));
|
|
}
|
|
Err(PrepareVerifyError::Missing) => {
|
|
debug!("Header is missing");
|
|
return Box::pin(err(VerifyError.into()));
|
|
}
|
|
Err(PrepareVerifyError::ParseField(field)) => {
|
|
debug!("Failed to parse field {}", field);
|
|
return Box::pin(err(VerifyError.into()));
|
|
}
|
|
Err(PrepareVerifyError::Header(e)) => {
|
|
debug!("Failed to parse header {}", e);
|
|
return Box::pin(err(VerifyError.into()));
|
|
}
|
|
Err(PrepareVerifyError::Required(req)) => {
|
|
debug!("Missing required headers, {:?}", req);
|
|
return Box::pin(err(VerifyError.into()));
|
|
}
|
|
};
|
|
|
|
let algorithm = unverified.algorithm().map(|a| a.clone());
|
|
let key_id = unverified.key_id().to_owned();
|
|
|
|
let f1 = unverified.verify(|signature, signing_string| {
|
|
self.4.signature_verify(
|
|
algorithm,
|
|
key_id.clone(),
|
|
signature.to_string(),
|
|
signing_string.to_string(),
|
|
)
|
|
});
|
|
|
|
req.extensions_mut().insert(SignatureVerified(key_id));
|
|
|
|
let f2 = self.0.call(req);
|
|
|
|
Box::pin(async move {
|
|
if f1.await? {
|
|
f2.await
|
|
} else {
|
|
warn!("Signature is invalid");
|
|
Err(VerifyError.into())
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
impl HeaderKind {
|
|
pub fn is_authorization(&self) -> bool {
|
|
HeaderKind::Authorization == *self
|
|
}
|
|
|
|
pub fn is_signature(&self) -> bool {
|
|
HeaderKind::Signature == *self
|
|
}
|
|
}
|
|
|
|
impl FromRequest for SignatureVerified {
|
|
type Error = VerifyError;
|
|
type Future = Ready<Result<Self, Self::Error>>;
|
|
type Config = ();
|
|
|
|
fn from_request(req: &HttpRequest, _: &mut Payload) -> Self::Future {
|
|
let res = req
|
|
.extensions()
|
|
.get::<Self>()
|
|
.map(|s| s.clone())
|
|
.ok_or(VerifyError);
|
|
|
|
if res.is_err() {
|
|
debug!("Failed to fetch SignatureVerified from request");
|
|
}
|
|
|
|
ready(res)
|
|
}
|
|
}
|
|
|
|
impl<T, S, B> Transform<S> for VerifySignature<T>
|
|
where
|
|
T: SignatureVerify + Clone + 'static,
|
|
S: Service<Request = ServiceRequest, Response = ServiceResponse<B>, Error = actix_web::Error>
|
|
+ 'static,
|
|
S::Error: 'static,
|
|
B: MessageBody + 'static,
|
|
{
|
|
type Request = ServiceRequest;
|
|
type Response = ServiceResponse<B>;
|
|
type Error = actix_web::Error;
|
|
type Transform = VerifyMiddleware<T, S>;
|
|
type InitError = ();
|
|
type Future = Ready<Result<Self::Transform, Self::InitError>>;
|
|
|
|
fn new_transform(&self, service: S) -> Self::Future {
|
|
ok(VerifyMiddleware(
|
|
service,
|
|
self.1.clone(),
|
|
self.2,
|
|
self.3,
|
|
self.0.clone(),
|
|
))
|
|
}
|
|
}
|
|
|
|
impl<T, S, B> Service for VerifyMiddleware<T, S>
|
|
where
|
|
T: SignatureVerify + Clone + 'static,
|
|
S: Service<Request = ServiceRequest, Response = ServiceResponse<B>, Error = actix_web::Error>
|
|
+ 'static,
|
|
S::Error: 'static,
|
|
B: MessageBody + 'static,
|
|
{
|
|
type Request = ServiceRequest;
|
|
type Response = ServiceResponse<B>;
|
|
type Error = actix_web::Error;
|
|
type Future = Pin<Box<dyn Future<Output = Result<Self::Response, Self::Error>>>>;
|
|
|
|
fn poll_ready(&mut self, cx: &mut Context) -> Poll<Result<(), Self::Error>> {
|
|
self.0.poll_ready(cx)
|
|
}
|
|
|
|
fn call(&mut self, req: ServiceRequest) -> Self::Future {
|
|
let authorization = req.headers().get("Authorization").is_some();
|
|
let signature = req.headers().get("Signature").is_some();
|
|
|
|
if authorization || signature {
|
|
if self.2.is_authorization() && authorization {
|
|
return self.handle(req);
|
|
}
|
|
|
|
if self.2.is_signature() && signature {
|
|
return self.handle(req);
|
|
}
|
|
|
|
debug!("Authorization or Signature headers are missing");
|
|
Box::pin(err(VerifyError.into()))
|
|
} else if self.3 {
|
|
debug!("Headers are missing but Optional is true, continuing");
|
|
Box::pin(self.0.call(req))
|
|
} else {
|
|
debug!("Authorization or Signature headers are missing");
|
|
Box::pin(err(VerifyError.into()))
|
|
}
|
|
}
|
|
}
|
|
|
|
impl ResponseError for VerifyError {
|
|
fn status_code(&self) -> StatusCode {
|
|
StatusCode::BAD_REQUEST
|
|
}
|
|
|
|
fn error_response(&self) -> HttpResponse {
|
|
HttpResponse::BadRequest().finish()
|
|
}
|
|
}
|