sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-25 08:09:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[misc] Add upload URL signing and rate limiting (#7502)

Browse Source
This commit is contained in:
Bethuel Mmbaga
2026-09-24 17:34:58 +03:00
committed by GitHub
parent 94106b57ab
commit 0a128cea6f
11 changed files with 488 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
management/server/http/middleware/rate_limiter.go
+25 -6
View File
@@ -14,12 +14,14 @@ import (
"golang.org/x/time/rate"
"github.com/netbirdio/netbird/shared/management/http/util"
"github.com/netbirdio/netbird/trustedproxy"
)
const (
RateLimitingEnabledEnv = "NB_API_RATE_LIMITING_ENABLED"
RateLimitingBurstEnv = "NB_API_RATE_LIMITING_BURST"
RateLimitingRPMEnv = "NB_API_RATE_LIMITING_RPM"
RateLimitingEnabledEnv = "NB_API_RATE_LIMITING_ENABLED"
RateLimitingBurstEnv = "NB_API_RATE_LIMITING_BURST"
RateLimitingRPMEnv = "NB_API_RATE_LIMITING_RPM"
RateLimitingTrustedProxiesEnv = "NB_API_RATE_LIMITING_TRUSTED_PROXIES"
defaultAPIRPM = 6
defaultAPIBurst = 500
@@ -35,6 +37,9 @@ type RateLimiterConfig struct {
CleanupInterval time.Duration
// LimiterTTL defines how long a limiter should be kept after last use (age threshold for removal)
LimiterTTL time.Duration
// TrustedProxies lists the upstream proxies whose forwarding headers may be
// believed. Empty means requests are keyed by their direct peer address.
TrustedProxies *trustedproxy.List
}
// DefaultRateLimiterConfig returns a default configuration
@@ -76,11 +81,18 @@ func RateLimiterConfigFromEnv() (cfg *RateLimiterConfig, enabled bool) {
burst = defaultAPIBurst
}
trusted, err := trustedproxy.Parse(os.Getenv(RateLimitingTrustedProxiesEnv))
if err != nil {
log.Warnf("parsing %s env var: %v, trusting no proxies", RateLimitingTrustedProxiesEnv, err)
trusted = nil
}
return &RateLimiterConfig{
RequestsPerMinute: float64(rpm),
Burst: burst,
CleanupInterval: 6 * time.Hour,
LimiterTTL: 24 * time.Hour,
TrustedProxies: trusted,
}, os.Getenv(RateLimitingEnabledEnv) == "true"
}
@@ -250,7 +262,7 @@ func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler {
next.ServeHTTP(w, r)
return
}
clientIP := getClientIP(r)
clientIP := getClientIP(r, rl.config.TrustedProxies)
if !rl.Allow(clientIP) {
util.WriteErrorResponse("rate limit exceeded, please try again later", http.StatusTooManyRequests, w)
return
@@ -259,8 +271,15 @@ func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler {
})
}
// getClientIP extracts the client IP address from the request.
func getClientIP(r *http.Request) string {
// getClientIP extracts the client IP address from the request. Forwarding headers
// are used only when the request arrives from a trusted proxy.
func getClientIP(r *http.Request, trusted *trustedproxy.List) string {
if !trusted.Empty() {
if addr := trusted.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For")); addr.IsValid() {
return addr.String()
}
}
ip, _, err := net.SplitHostPort(r.RemoteAddr)
if err != nil {
return r.RemoteAddr
management/server/http/middleware/rate_limiter_test.go
+48 -1
View File
@@ -9,6 +9,9 @@ import (
"time"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/trustedproxy"
)
func TestAPIRateLimiter_Allow(t *testing.T) {
@@ -134,7 +137,7 @@ func TestGetClientIP(t *testing.T) {
t.Run(tc.name, func(t *testing.T) {
req := httptest.NewRequest(http.MethodGet, "/test", nil)
req.RemoteAddr = tc.remoteAddr
assert.Equal(t, tc.expected, getClientIP(req))
assert.Equal(t, tc.expected, getClientIP(req, nil))
})
}
}
@@ -327,3 +330,47 @@ func TestRateLimiterConfigFromEnv(t *testing.T) {
assert.Equal(t, float64(defaultAPIRPM), cfg.RequestsPerMinute, "non-positive rpm must fall back to default")
assert.Equal(t, defaultAPIBurst, cfg.Burst, "non-positive burst must fall back to default")
}
func TestGetClientIP_TrustedProxies(t *testing.T) {
trusted, err := trustedproxy.Parse("10.0.0.0/8")
require.NoError(t, err)
tests := []struct {
name string
list *trustedproxy.List
remoteAddr string
xff string
expected string
}{
{
name: "no trusted proxies ignores the header",
remoteAddr: "10.0.0.1:5555",
xff: "1.1.1.1, 2.2.2.2",
expected: "10.0.0.1",
},
{
name: "behind a trusted proxy uses the right-most untrusted hop",
list: trusted,
remoteAddr: "10.0.0.1:5555",
xff: "1.1.1.1, 2.2.2.2",
expected: "2.2.2.2",
},
{
name: "a caller reaching us directly cannot forge the header",
list: trusted,
remoteAddr: "203.0.113.5:5555",
xff: "1.1.1.1",
expected: "203.0.113.5",
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
req := httptest.NewRequest(http.MethodGet, "/test", nil)
req.RemoteAddr = tc.remoteAddr
req.Header.Set("X-Forwarded-For", tc.xff)
assert.Equal(t, tc.expected, getClientIP(req, tc.list))
})
}
}
upload-server/server/local.go
+34 -17
View File
@@ -8,9 +8,12 @@ import (
"os"
"path/filepath"
"strings"
"time"
log "github.com/sirupsen/logrus"
"github.com/netbirdio/netbird/management/server/http/middleware"
"github.com/netbirdio/netbird/upload-server/types"
)
@@ -20,11 +23,12 @@ const (
)
type local struct {
url string
dir string
url string
dir string
signer *signer
}
func configureLocalHandlers(mux *http.ServeMux) error {
func configureLocalHandlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error {
envURL, ok := os.LookupEnv("SERVER_URL")
if !ok {
return fmt.Errorf("SERVER_URL environment variable is required")
@@ -44,11 +48,17 @@ func configureLocalHandlers(mux *http.ServeMux) error {
dir = envDir
}
l := &local{
url: envURL,
dir: dir,
uploadSigner, err := newSigner()
if err != nil {
return err
}
mux.HandleFunc(types.GetURLPath, l.handlerGetUploadURL)
l := &local{
url: envURL,
dir: dir,
signer: uploadSigner,
}
mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(l.handlerGetUploadURL)))
mux.HandleFunc(putURLPath+putHandler, l.handlePutRequest)
return nil
@@ -80,10 +90,11 @@ func (l *local) getUploadURL(objectKey string) (string, error) {
return "", fmt.Errorf("failed to parse upload URL: %w", err)
}
newURL := parsedUploadURL.JoinPath(parsedUploadURL.Path, putURLPath, objectKey)
newURL.RawQuery = l.signer.sign(objectKey, time.Now()).Encode()
return newURL.String(), nil
}
const maxUploadSize = 150 << 20
const maxUploadSize = 50 << 20
func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
if r.Method != http.MethodPut {
@@ -91,13 +102,6 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
return
}
r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
body, err := io.ReadAll(r.Body)
if err != nil {
http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
return
}
uploadDir := r.PathValue("dir")
if uploadDir == "" {
http.Error(w, "missing dir path", http.StatusBadRequest)
@@ -109,6 +113,19 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
return
}
if err := l.signer.verify(uploadDir+"/"+uploadFile, r.URL.Query(), time.Now()); err != nil {
http.Error(w, "unauthorized", http.StatusUnauthorized)
log.Warnf("Rejected upload of %s/%s: %v", uploadDir, uploadFile, err)
return
}
r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
body, err := io.ReadAll(r.Body)
if err != nil {
http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
return
}
cleanBase := filepath.Clean(l.dir) + string(filepath.Separator)
dirPath := filepath.Clean(filepath.Join(l.dir, uploadDir))
@@ -125,14 +142,14 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
return
}
if err = os.MkdirAll(dirPath, 0750); err != nil {
if err = os.MkdirAll(dirPath, 0o750); err != nil {
http.Error(w, "failed to create upload dir", http.StatusInternalServerError)
log.Errorf("Failed to create upload dir: %v", err)
return
}
flags := os.O_WRONLY | os.O_CREATE | os.O_EXCL
f, err := os.OpenFile(filePath, flags, 0600)
f, err := os.OpenFile(filePath, flags, 0o600)
if err != nil {
if os.IsExist(err) {
http.Error(w, "file already exists", http.StatusConflict)
upload-server/server/local_test.go
+33 -13
View File
@@ -8,19 +8,28 @@ import (
"os"
"path/filepath"
"testing"
"time"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/upload-server/types"
)
const testSigningKey = "test-signing-key-with-enough-length"
func signedQuery(t *testing.T, objectKey string) string {
t.Helper()
s := &signer{key: []byte(testSigningKey)}
return s.sign(objectKey, time.Now()).Encode()
}
func Test_LocalHandlerGetUploadURL(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", t.TempDir())
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
@@ -37,7 +46,6 @@ func Test_LocalHandlerGetUploadURL(t *testing.T) {
require.Contains(t, response.URL, "test-file/")
require.NotEmpty(t, response.Key)
require.Contains(t, response.Key, "test-file/")
}
func Test_LocalHandlePutRequest(t *testing.T) {
@@ -45,13 +53,15 @@ func Test_LocalHandlePutRequest(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
fileContent := []byte("test file content")
req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/test.txt", bytes.NewReader(fileContent))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/uploads/test.txt?"+signedQuery(t, "uploads/test.txt"), bytes.NewReader(fileContent))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
@@ -69,13 +79,16 @@ func Test_LocalHandlePutRequest_PathTraversal(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
fileContent := []byte("malicious content")
req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd", bytes.NewReader(fileContent))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd?"+signedQuery(t, "uploads/../../etc/passwd"),
bytes.NewReader(fileContent))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
@@ -90,11 +103,13 @@ func Test_LocalHandlePutRequest_DirTraversal(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
l := &local{url: "http://localhost:8080", dir: mockDir}
l := &local{url: "http://localhost:8080", dir: mockDir, signer: &signer{key: []byte(testSigningKey)}}
body := bytes.NewReader([]byte("bad"))
req := httptest.NewRequest(http.MethodPut, putURLPath+"/x/evil.txt", body)
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/x/evil.txt?"+signedQuery(t, "../../../tmp/evil.txt"), body)
req.SetPathValue("dir", "../../../tmp")
req.SetPathValue("file", "evil.txt")
@@ -111,17 +126,20 @@ func Test_LocalHandlePutRequest_DuplicateFile(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("first")))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("first")))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
require.Equal(t, http.StatusOK, rec.Code)
req = httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("second")))
req = httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("second")))
rec = httptest.NewRecorder()
mux.ServeHTTP(rec, req)
require.Equal(t, http.StatusConflict, rec.Code)
@@ -135,13 +153,15 @@ func Test_LocalHandlePutRequest_BodyTooLarge(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
largeBody := make([]byte, maxUploadSize+1)
req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/big.txt", bytes.NewReader(largeBody))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/big.txt?"+signedQuery(t, "dir/big.txt"), bytes.NewReader(largeBody))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
upload-server/server/ratelimit.go
+31
View File
@@ -0,0 +1,31 @@
package server
import (
"os"
log "github.com/sirupsen/logrus"
"github.com/netbirdio/netbird/management/server/http/middleware"
)
const defaultUploadBurst = 100
func newRateLimiter() *middleware.APIRateLimiter {
cfg, enabled := middleware.RateLimiterConfigFromEnv()
if os.Getenv(middleware.RateLimitingBurstEnv) == "" {
cfg.Burst = defaultUploadBurst
}
// Rate limiting is enabled by default unless explicitly disabled
if os.Getenv(middleware.RateLimitingEnabledEnv) == "" {
enabled = true
}
limiter := middleware.NewAPIRateLimiter(cfg)
limiter.SetEnabled(enabled)
log.Infof("Upload URL rate limiting: enabled=%t rate=%.0f/min burst=%d trusted_proxies=%q",
limiter.Enabled(), cfg.RequestsPerMinute, cfg.Burst, os.Getenv(middleware.RateLimitingTrustedProxiesEnv))
return limiter
}
upload-server/server/ratelimit_test.go
+60
View File
@@ -0,0 +1,60 @@
package server
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/management/server/http/middleware"
"github.com/netbirdio/netbird/upload-server/types"
)
func newTestRateLimiter(t *testing.T) *middleware.APIRateLimiter {
t.Helper()
limiter := newRateLimiter()
t.Cleanup(limiter.Stop)
return limiter
}
func getUploadURL(t *testing.T, mux *http.ServeMux) int {
t.Helper()
req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
req.Header.Set(types.ClientHeader, types.ClientHeaderValue)
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
return rec.Code
}
func Test_GetUploadURLIsRateLimited(t *testing.T) {
t.Setenv(middleware.RateLimitingBurstEnv, "2")
t.Setenv(middleware.RateLimitingRPMEnv, "1")
mux, _ := newLocalMux(t)
require.Equal(t, http.StatusOK, getUploadURL(t, mux))
require.Equal(t, http.StatusOK, getUploadURL(t, mux))
require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
}
func Test_RateLimitingIsOnByDefault(t *testing.T) {
t.Setenv(middleware.RateLimitingEnabledEnv, "")
t.Setenv(middleware.RateLimitingBurstEnv, "1")
mux, _ := newLocalMux(t)
require.Equal(t, http.StatusOK, getUploadURL(t, mux))
require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
}
func Test_RateLimitingCanBeDisabled(t *testing.T) {
t.Setenv(middleware.RateLimitingEnabledEnv, "false")
t.Setenv(middleware.RateLimitingBurstEnv, "1")
mux, _ := newLocalMux(t)
require.Equal(t, http.StatusOK, getUploadURL(t, mux))
require.Equal(t, http.StatusOK, getUploadURL(t, mux))
}
upload-server/server/s3.go
+4 -2
View File
@@ -12,6 +12,8 @@ import (
"github.com/aws/aws-sdk-go-v2/service/s3"
log "github.com/sirupsen/logrus"
"github.com/netbirdio/netbird/management/server/http/middleware"
"github.com/netbirdio/netbird/upload-server/types"
)
@@ -21,7 +23,7 @@ type sThree struct {
presignClient *s3.PresignClient
}
func configureS3Handlers(mux *http.ServeMux) error {
func configureS3Handlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error {
bucket := os.Getenv(bucketVar)
region, ok := os.LookupEnv("AWS_REGION")
if !ok {
@@ -40,7 +42,7 @@ func configureS3Handlers(mux *http.ServeMux) error {
bucket: bucket,
presignClient: s3.NewPresignClient(client),
}
mux.HandleFunc(types.GetURLPath, handler.handlerGetUploadURL)
mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(handler.handlerGetUploadURL)))
return nil
}
upload-server/server/s3_test.go
+1 -1
View File
@@ -90,7 +90,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
t.Setenv(bucketVar, bucketName)
mux := http.NewServeMux()
err = configureS3Handlers(mux)
err = configureS3Handlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
upload-server/server/server.go
+14 -7
View File
@@ -10,6 +10,7 @@ import (
"github.com/google/uuid"
log "github.com/sirupsen/logrus"
"github.com/netbirdio/netbird/management/server/http/middleware"
"github.com/netbirdio/netbird/upload-server/types"
)
@@ -19,7 +20,8 @@ const (
)
type Server struct {
srv *http.Server
srv *http.Server
limiter *middleware.APIRateLimiter
}
func NewServer() *Server {
@@ -29,7 +31,7 @@ func NewServer() *Server {
address = "0.0.0.0:8080"
}
mux := http.NewServeMux()
err := configureMux(mux)
limiter, err := configureMux(mux)
if err != nil {
log.Fatalf("Failed to configure server: %v", err)
}
@@ -38,7 +40,8 @@ func NewServer() *Server {
})
return &Server{
srv: &http.Server{Addr: address, Handler: mux},
srv: &http.Server{Addr: address, Handler: mux},
limiter: limiter,
}
}
@@ -48,6 +51,9 @@ func (s *Server) Start() error {
}
func (s *Server) Stop() error {
if s.limiter != nil {
s.limiter.Stop()
}
if s.srv != nil {
log.Infof("Stopping upload server on %s", s.srv.Addr)
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -57,13 +63,14 @@ func (s *Server) Stop() error {
return nil
}
func configureMux(mux *http.ServeMux) error {
func configureMux(mux *http.ServeMux) (*middleware.APIRateLimiter, error) {
limiter := newRateLimiter()
_, ok := os.LookupEnv(bucketVar)
if ok {
return configureS3Handlers(mux)
} else {
return configureLocalHandlers(mux)
return limiter, configureS3Handlers(mux, limiter)
}
return limiter, configureLocalHandlers(mux, limiter)
}
func getObjectKey(w http.ResponseWriter, r *http.Request) string {
upload-server/server/signing.go
+90
View File
@@ -0,0 +1,90 @@
package server
import (
"crypto/hmac"
"crypto/rand"
"crypto/sha256"
"encoding/hex"
"fmt"
"net/url"
"os"
"strconv"
"time"
log "github.com/sirupsen/logrus"
)
const (
signingKeyVar = "NB_UPLOAD_SIGNING_KEY"
// signatureTTL matches the expiry the S3 backend puts on its presigned URLs.
signatureTTL = 15 * time.Minute
expiryParam = "exp"
signatureParam = "sig"
minSigningKeyLen = 32
)
type signer struct {
key []byte
}
func newSigner() (*signer, error) {
if env, ok := os.LookupEnv(signingKeyVar); ok {
if env == "" {
return nil, fmt.Errorf("%s is set but empty", signingKeyVar)
}
if len(env) < minSigningKeyLen {
return nil, fmt.Errorf("%s must be at least %d bytes", signingKeyVar, minSigningKeyLen)
}
return &signer{key: []byte(env)}, nil
}
key := make([]byte, 32)
if _, err := rand.Read(key); err != nil {
return nil, fmt.Errorf("generate signing key: %w", err)
}
log.Infof("%s not set, generated an ephemeral upload signing key", signingKeyVar)
return &signer{key: key}, nil
}
// sign returns the query parameters that authorize an upload of objectKey.
func (s *signer) sign(objectKey string, now time.Time) url.Values {
exp := now.Add(signatureTTL).Unix()
v := url.Values{}
v.Set(expiryParam, strconv.FormatInt(exp, 10))
v.Set(signatureParam, hex.EncodeToString(s.signature(objectKey, exp)))
return v
}
// verify reports whether query carries a still-valid signature over objectKey.
func (s *signer) verify(objectKey string, query url.Values, now time.Time) error {
exp, err := strconv.ParseInt(query.Get(expiryParam), 10, 64)
if err != nil {
return fmt.Errorf("malformed %s parameter", expiryParam)
}
got, err := hex.DecodeString(query.Get(signatureParam))
if err != nil {
return fmt.Errorf("malformed %s parameter", signatureParam)
}
if !hmac.Equal(got, s.signature(objectKey, exp)) {
return fmt.Errorf("signature mismatch")
}
if now.Unix() >= exp {
return fmt.Errorf("upload URL expired")
}
return nil
}
func (s *signer) signature(objectKey string, exp int64) []byte {
mac := hmac.New(sha256.New, s.key)
fmt.Fprintf(mac, "%s\n%d", objectKey, exp)
return mac.Sum(nil)
}
upload-server/server/signing_test.go
+148
View File
@@ -0,0 +1,148 @@
package server
import (
"bytes"
"encoding/json"
"net/http"
"net/http/httptest"
"net/url"
"os"
"path/filepath"
"strings"
"testing"
"time"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/upload-server/types"
)
func newLocalMux(t *testing.T) (*http.ServeMux, string) {
t.Helper()
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
require.NoError(t, configureLocalHandlers(mux, newTestRateLimiter(t)))
return mux, mockDir
}
func Test_LocalUploadURLRoundTrip(t *testing.T) {
mux, mockDir := newLocalMux(t)
getReq := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
getRec := httptest.NewRecorder()
mux.ServeHTTP(getRec, getReq)
require.Equal(t, http.StatusOK, getRec.Code)
var response types.GetURLResponse
require.NoError(t, json.Unmarshal(getRec.Body.Bytes(), &response))
minted, err := url.Parse(response.URL)
require.NoError(t, err)
require.NotEmpty(t, minted.Query().Get(signatureParam))
content := []byte("bundle")
putRec := httptest.NewRecorder()
mux.ServeHTTP(putRec, httptest.NewRequest(http.MethodPut, minted.RequestURI(), bytes.NewReader(content)))
require.Equal(t, http.StatusOK, putRec.Code)
written, err := os.ReadFile(filepath.Join(mockDir, response.Key))
require.NoError(t, err)
require.Equal(t, content, written)
}
func Test_LocalHandlePutRequest_RejectsUnauthorized(t *testing.T) {
expired := &signer{key: []byte(testSigningKey)}
tests := []struct {
name string
query string
}{
{
name: "no signature",
query: "",
},
{
name: "tampered signature",
query: "exp=99999999999&sig=deadbeef",
},
{
name: "malformed signature",
query: "exp=99999999999&sig=not-hex",
},
{
// A signature is only good for the key it was minted for, so a URL
// handed out for one bundle cannot be replayed against another.
name: "signature for a different object",
query: signedQuery(t, "dir/other.txt"),
},
{
name: "signature expiring this second",
query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL)).Encode(),
},
{
name: "expired signature",
query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL-time.Minute)).Encode(),
},
}
for _, tc := range tests {
t.Run(tc.name, func(t *testing.T) {
mux, mockDir := newLocalMux(t)
target := putURLPath + "/dir/file.txt"
if tc.query != "" {
target += "?" + tc.query
}
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPut, target, bytes.NewReader([]byte("payload"))))
require.Equal(t, http.StatusUnauthorized, rec.Code)
_, err := os.Stat(filepath.Join(mockDir, "dir", "file.txt"))
require.True(t, os.IsNotExist(err), "unauthorized upload should not be written")
})
}
}
func Test_SignerRejectsForeignKey(t *testing.T) {
minted := (&signer{key: []byte("one key")}).sign("dir/file.txt", time.Now())
err := (&signer{key: []byte("another key")}).verify("dir/file.txt", minted, time.Now())
require.Error(t, err)
}
func Test_NewSignerGeneratesEphemeralKey(t *testing.T) {
// Registers the restore hook, then clears the value for this test only.
t.Setenv(signingKeyVar, "")
os.Unsetenv(signingKeyVar)
first, err := newSigner()
require.NoError(t, err)
second, err := newSigner()
require.NoError(t, err)
require.NotEqual(t, first.key, second.key)
require.Len(t, first.key, 32)
}
func Test_NewSignerRejectsEmptyKey(t *testing.T) {
t.Setenv(signingKeyVar, "")
_, err := newSigner()
require.Error(t, err)
}
func Test_NewSignerRejectsShortKey(t *testing.T) {
t.Setenv(signingKeyVar, strings.Repeat("a", minSigningKeyLen-1))
_, err := newSigner()
require.Error(t, err)
}