From 0a128cea6fae8bfdda618797e4a9c251118a07c0 Mon Sep 17 00:00:00 2001 From: Bethuel Mmbaga Date: Thu, 24 Sep 2026 17:34:58 +0300 Subject: [PATCH] [misc] Add upload URL signing and rate limiting (#7502) --- .../server/http/middleware/rate_limiter.go | 31 +++- .../http/middleware/rate_limiter_test.go | 49 +++++- upload-server/server/local.go | 51 ++++-- upload-server/server/local_test.go | 46 ++++-- upload-server/server/ratelimit.go | 31 ++++ upload-server/server/ratelimit_test.go | 60 +++++++ upload-server/server/s3.go | 6 +- upload-server/server/s3_test.go | 2 +- upload-server/server/server.go | 21 ++- upload-server/server/signing.go | 90 +++++++++++ upload-server/server/signing_test.go | 148 ++++++++++++++++++ 11 files changed, 488 insertions(+), 47 deletions(-) create mode 100644 upload-server/server/ratelimit.go create mode 100644 upload-server/server/ratelimit_test.go create mode 100644 upload-server/server/signing.go create mode 100644 upload-server/server/signing_test.go diff --git a/management/server/http/middleware/rate_limiter.go b/management/server/http/middleware/rate_limiter.go index bfd44afee..6995e71bb 100644 --- a/management/server/http/middleware/rate_limiter.go +++ b/management/server/http/middleware/rate_limiter.go @@ -14,12 +14,14 @@ import ( "golang.org/x/time/rate" "github.com/netbirdio/netbird/shared/management/http/util" + "github.com/netbirdio/netbird/trustedproxy" ) const ( - RateLimitingEnabledEnv = "NB_API_RATE_LIMITING_ENABLED" - RateLimitingBurstEnv = "NB_API_RATE_LIMITING_BURST" - RateLimitingRPMEnv = "NB_API_RATE_LIMITING_RPM" + RateLimitingEnabledEnv = "NB_API_RATE_LIMITING_ENABLED" + RateLimitingBurstEnv = "NB_API_RATE_LIMITING_BURST" + RateLimitingRPMEnv = "NB_API_RATE_LIMITING_RPM" + RateLimitingTrustedProxiesEnv = "NB_API_RATE_LIMITING_TRUSTED_PROXIES" defaultAPIRPM = 6 defaultAPIBurst = 500 @@ -35,6 +37,9 @@ type RateLimiterConfig struct { CleanupInterval time.Duration // LimiterTTL defines how long a limiter should be kept after last use (age threshold for removal) LimiterTTL time.Duration + // TrustedProxies lists the upstream proxies whose forwarding headers may be + // believed. Empty means requests are keyed by their direct peer address. + TrustedProxies *trustedproxy.List } // DefaultRateLimiterConfig returns a default configuration @@ -76,11 +81,18 @@ func RateLimiterConfigFromEnv() (cfg *RateLimiterConfig, enabled bool) { burst = defaultAPIBurst } + trusted, err := trustedproxy.Parse(os.Getenv(RateLimitingTrustedProxiesEnv)) + if err != nil { + log.Warnf("parsing %s env var: %v, trusting no proxies", RateLimitingTrustedProxiesEnv, err) + trusted = nil + } + return &RateLimiterConfig{ RequestsPerMinute: float64(rpm), Burst: burst, CleanupInterval: 6 * time.Hour, LimiterTTL: 24 * time.Hour, + TrustedProxies: trusted, }, os.Getenv(RateLimitingEnabledEnv) == "true" } @@ -250,7 +262,7 @@ func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler { next.ServeHTTP(w, r) return } - clientIP := getClientIP(r) + clientIP := getClientIP(r, rl.config.TrustedProxies) if !rl.Allow(clientIP) { util.WriteErrorResponse("rate limit exceeded, please try again later", http.StatusTooManyRequests, w) return @@ -259,8 +271,15 @@ func (rl *APIRateLimiter) Middleware(next http.Handler) http.Handler { }) } -// getClientIP extracts the client IP address from the request. -func getClientIP(r *http.Request) string { +// getClientIP extracts the client IP address from the request. Forwarding headers +// are used only when the request arrives from a trusted proxy. +func getClientIP(r *http.Request, trusted *trustedproxy.List) string { + if !trusted.Empty() { + if addr := trusted.ResolveClientIP(r.RemoteAddr, r.Header.Get("X-Forwarded-For")); addr.IsValid() { + return addr.String() + } + } + ip, _, err := net.SplitHostPort(r.RemoteAddr) if err != nil { return r.RemoteAddr diff --git a/management/server/http/middleware/rate_limiter_test.go b/management/server/http/middleware/rate_limiter_test.go index 4b97d1874..c647030c7 100644 --- a/management/server/http/middleware/rate_limiter_test.go +++ b/management/server/http/middleware/rate_limiter_test.go @@ -9,6 +9,9 @@ import ( "time" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/netbirdio/netbird/trustedproxy" ) func TestAPIRateLimiter_Allow(t *testing.T) { @@ -134,7 +137,7 @@ func TestGetClientIP(t *testing.T) { t.Run(tc.name, func(t *testing.T) { req := httptest.NewRequest(http.MethodGet, "/test", nil) req.RemoteAddr = tc.remoteAddr - assert.Equal(t, tc.expected, getClientIP(req)) + assert.Equal(t, tc.expected, getClientIP(req, nil)) }) } } @@ -327,3 +330,47 @@ func TestRateLimiterConfigFromEnv(t *testing.T) { assert.Equal(t, float64(defaultAPIRPM), cfg.RequestsPerMinute, "non-positive rpm must fall back to default") assert.Equal(t, defaultAPIBurst, cfg.Burst, "non-positive burst must fall back to default") } + +func TestGetClientIP_TrustedProxies(t *testing.T) { + trusted, err := trustedproxy.Parse("10.0.0.0/8") + require.NoError(t, err) + + tests := []struct { + name string + list *trustedproxy.List + remoteAddr string + xff string + expected string + }{ + { + name: "no trusted proxies ignores the header", + remoteAddr: "10.0.0.1:5555", + xff: "1.1.1.1, 2.2.2.2", + expected: "10.0.0.1", + }, + { + name: "behind a trusted proxy uses the right-most untrusted hop", + list: trusted, + remoteAddr: "10.0.0.1:5555", + xff: "1.1.1.1, 2.2.2.2", + expected: "2.2.2.2", + }, + { + name: "a caller reaching us directly cannot forge the header", + list: trusted, + remoteAddr: "203.0.113.5:5555", + xff: "1.1.1.1", + expected: "203.0.113.5", + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/test", nil) + req.RemoteAddr = tc.remoteAddr + req.Header.Set("X-Forwarded-For", tc.xff) + + assert.Equal(t, tc.expected, getClientIP(req, tc.list)) + }) + } +} diff --git a/upload-server/server/local.go b/upload-server/server/local.go index f7ca50011..7db2740f9 100644 --- a/upload-server/server/local.go +++ b/upload-server/server/local.go @@ -8,9 +8,12 @@ import ( "os" "path/filepath" "strings" + "time" log "github.com/sirupsen/logrus" + "github.com/netbirdio/netbird/management/server/http/middleware" + "github.com/netbirdio/netbird/upload-server/types" ) @@ -20,11 +23,12 @@ const ( ) type local struct { - url string - dir string + url string + dir string + signer *signer } -func configureLocalHandlers(mux *http.ServeMux) error { +func configureLocalHandlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error { envURL, ok := os.LookupEnv("SERVER_URL") if !ok { return fmt.Errorf("SERVER_URL environment variable is required") @@ -44,11 +48,17 @@ func configureLocalHandlers(mux *http.ServeMux) error { dir = envDir } - l := &local{ - url: envURL, - dir: dir, + uploadSigner, err := newSigner() + if err != nil { + return err } - mux.HandleFunc(types.GetURLPath, l.handlerGetUploadURL) + + l := &local{ + url: envURL, + dir: dir, + signer: uploadSigner, + } + mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(l.handlerGetUploadURL))) mux.HandleFunc(putURLPath+putHandler, l.handlePutRequest) return nil @@ -80,10 +90,11 @@ func (l *local) getUploadURL(objectKey string) (string, error) { return "", fmt.Errorf("failed to parse upload URL: %w", err) } newURL := parsedUploadURL.JoinPath(parsedUploadURL.Path, putURLPath, objectKey) + newURL.RawQuery = l.signer.sign(objectKey, time.Now()).Encode() return newURL.String(), nil } -const maxUploadSize = 150 << 20 +const maxUploadSize = 50 << 20 func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) { if r.Method != http.MethodPut { @@ -91,13 +102,6 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) { return } - r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize) - body, err := io.ReadAll(r.Body) - if err != nil { - http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge) - return - } - uploadDir := r.PathValue("dir") if uploadDir == "" { http.Error(w, "missing dir path", http.StatusBadRequest) @@ -109,6 +113,19 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) { return } + if err := l.signer.verify(uploadDir+"/"+uploadFile, r.URL.Query(), time.Now()); err != nil { + http.Error(w, "unauthorized", http.StatusUnauthorized) + log.Warnf("Rejected upload of %s/%s: %v", uploadDir, uploadFile, err) + return + } + + r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize) + body, err := io.ReadAll(r.Body) + if err != nil { + http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge) + return + } + cleanBase := filepath.Clean(l.dir) + string(filepath.Separator) dirPath := filepath.Clean(filepath.Join(l.dir, uploadDir)) @@ -125,14 +142,14 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) { return } - if err = os.MkdirAll(dirPath, 0750); err != nil { + if err = os.MkdirAll(dirPath, 0o750); err != nil { http.Error(w, "failed to create upload dir", http.StatusInternalServerError) log.Errorf("Failed to create upload dir: %v", err) return } flags := os.O_WRONLY | os.O_CREATE | os.O_EXCL - f, err := os.OpenFile(filePath, flags, 0600) + f, err := os.OpenFile(filePath, flags, 0o600) if err != nil { if os.IsExist(err) { http.Error(w, "file already exists", http.StatusConflict) diff --git a/upload-server/server/local_test.go b/upload-server/server/local_test.go index 64b8fd228..3504087e9 100644 --- a/upload-server/server/local_test.go +++ b/upload-server/server/local_test.go @@ -8,19 +8,28 @@ import ( "os" "path/filepath" "testing" + "time" "github.com/stretchr/testify/require" "github.com/netbirdio/netbird/upload-server/types" ) +const testSigningKey = "test-signing-key-with-enough-length" + +func signedQuery(t *testing.T, objectKey string) string { + t.Helper() + s := &signer{key: []byte(testSigningKey)} + return s.sign(objectKey, time.Now()).Encode() +} + func Test_LocalHandlerGetUploadURL(t *testing.T) { mockURL := "http://localhost:8080" t.Setenv("SERVER_URL", mockURL) t.Setenv("STORE_DIR", t.TempDir()) mux := http.NewServeMux() - err := configureLocalHandlers(mux) + err := configureLocalHandlers(mux, newTestRateLimiter(t)) require.NoError(t, err) req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil) @@ -37,7 +46,6 @@ func Test_LocalHandlerGetUploadURL(t *testing.T) { require.Contains(t, response.URL, "test-file/") require.NotEmpty(t, response.Key) require.Contains(t, response.Key, "test-file/") - } func Test_LocalHandlePutRequest(t *testing.T) { @@ -45,13 +53,15 @@ func Test_LocalHandlePutRequest(t *testing.T) { mockURL := "http://localhost:8080" t.Setenv("SERVER_URL", mockURL) t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) mux := http.NewServeMux() - err := configureLocalHandlers(mux) + err := configureLocalHandlers(mux, newTestRateLimiter(t)) require.NoError(t, err) fileContent := []byte("test file content") - req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/test.txt", bytes.NewReader(fileContent)) + req := httptest.NewRequest(http.MethodPut, + putURLPath+"/uploads/test.txt?"+signedQuery(t, "uploads/test.txt"), bytes.NewReader(fileContent)) rec := httptest.NewRecorder() mux.ServeHTTP(rec, req) @@ -69,13 +79,16 @@ func Test_LocalHandlePutRequest_PathTraversal(t *testing.T) { mockURL := "http://localhost:8080" t.Setenv("SERVER_URL", mockURL) t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) mux := http.NewServeMux() - err := configureLocalHandlers(mux) + err := configureLocalHandlers(mux, newTestRateLimiter(t)) require.NoError(t, err) fileContent := []byte("malicious content") - req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd", bytes.NewReader(fileContent)) + req := httptest.NewRequest(http.MethodPut, + putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd?"+signedQuery(t, "uploads/../../etc/passwd"), + bytes.NewReader(fileContent)) rec := httptest.NewRecorder() mux.ServeHTTP(rec, req) @@ -90,11 +103,13 @@ func Test_LocalHandlePutRequest_DirTraversal(t *testing.T) { mockDir := t.TempDir() t.Setenv("SERVER_URL", "http://localhost:8080") t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) - l := &local{url: "http://localhost:8080", dir: mockDir} + l := &local{url: "http://localhost:8080", dir: mockDir, signer: &signer{key: []byte(testSigningKey)}} body := bytes.NewReader([]byte("bad")) - req := httptest.NewRequest(http.MethodPut, putURLPath+"/x/evil.txt", body) + req := httptest.NewRequest(http.MethodPut, + putURLPath+"/x/evil.txt?"+signedQuery(t, "../../../tmp/evil.txt"), body) req.SetPathValue("dir", "../../../tmp") req.SetPathValue("file", "evil.txt") @@ -111,17 +126,20 @@ func Test_LocalHandlePutRequest_DuplicateFile(t *testing.T) { mockDir := t.TempDir() t.Setenv("SERVER_URL", "http://localhost:8080") t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) mux := http.NewServeMux() - err := configureLocalHandlers(mux) + err := configureLocalHandlers(mux, newTestRateLimiter(t)) require.NoError(t, err) - req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("first"))) + req := httptest.NewRequest(http.MethodPut, + putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("first"))) rec := httptest.NewRecorder() mux.ServeHTTP(rec, req) require.Equal(t, http.StatusOK, rec.Code) - req = httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("second"))) + req = httptest.NewRequest(http.MethodPut, + putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("second"))) rec = httptest.NewRecorder() mux.ServeHTTP(rec, req) require.Equal(t, http.StatusConflict, rec.Code) @@ -135,13 +153,15 @@ func Test_LocalHandlePutRequest_BodyTooLarge(t *testing.T) { mockDir := t.TempDir() t.Setenv("SERVER_URL", "http://localhost:8080") t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) mux := http.NewServeMux() - err := configureLocalHandlers(mux) + err := configureLocalHandlers(mux, newTestRateLimiter(t)) require.NoError(t, err) largeBody := make([]byte, maxUploadSize+1) - req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/big.txt", bytes.NewReader(largeBody)) + req := httptest.NewRequest(http.MethodPut, + putURLPath+"/dir/big.txt?"+signedQuery(t, "dir/big.txt"), bytes.NewReader(largeBody)) rec := httptest.NewRecorder() mux.ServeHTTP(rec, req) diff --git a/upload-server/server/ratelimit.go b/upload-server/server/ratelimit.go new file mode 100644 index 000000000..081cf89c1 --- /dev/null +++ b/upload-server/server/ratelimit.go @@ -0,0 +1,31 @@ +package server + +import ( + "os" + + log "github.com/sirupsen/logrus" + + "github.com/netbirdio/netbird/management/server/http/middleware" +) + +const defaultUploadBurst = 100 + +func newRateLimiter() *middleware.APIRateLimiter { + cfg, enabled := middleware.RateLimiterConfigFromEnv() + if os.Getenv(middleware.RateLimitingBurstEnv) == "" { + cfg.Burst = defaultUploadBurst + } + + // Rate limiting is enabled by default unless explicitly disabled + if os.Getenv(middleware.RateLimitingEnabledEnv) == "" { + enabled = true + } + + limiter := middleware.NewAPIRateLimiter(cfg) + limiter.SetEnabled(enabled) + + log.Infof("Upload URL rate limiting: enabled=%t rate=%.0f/min burst=%d trusted_proxies=%q", + limiter.Enabled(), cfg.RequestsPerMinute, cfg.Burst, os.Getenv(middleware.RateLimitingTrustedProxiesEnv)) + + return limiter +} diff --git a/upload-server/server/ratelimit_test.go b/upload-server/server/ratelimit_test.go new file mode 100644 index 000000000..8414a1c09 --- /dev/null +++ b/upload-server/server/ratelimit_test.go @@ -0,0 +1,60 @@ +package server + +import ( + "net/http" + "net/http/httptest" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/netbirdio/netbird/management/server/http/middleware" + "github.com/netbirdio/netbird/upload-server/types" +) + +func newTestRateLimiter(t *testing.T) *middleware.APIRateLimiter { + t.Helper() + + limiter := newRateLimiter() + t.Cleanup(limiter.Stop) + + return limiter +} + +func getUploadURL(t *testing.T, mux *http.ServeMux) int { + t.Helper() + + req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil) + req.Header.Set(types.ClientHeader, types.ClientHeaderValue) + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + + return rec.Code +} + +func Test_GetUploadURLIsRateLimited(t *testing.T) { + t.Setenv(middleware.RateLimitingBurstEnv, "2") + t.Setenv(middleware.RateLimitingRPMEnv, "1") + mux, _ := newLocalMux(t) + + require.Equal(t, http.StatusOK, getUploadURL(t, mux)) + require.Equal(t, http.StatusOK, getUploadURL(t, mux)) + require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux)) +} + +func Test_RateLimitingIsOnByDefault(t *testing.T) { + t.Setenv(middleware.RateLimitingEnabledEnv, "") + t.Setenv(middleware.RateLimitingBurstEnv, "1") + mux, _ := newLocalMux(t) + + require.Equal(t, http.StatusOK, getUploadURL(t, mux)) + require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux)) +} + +func Test_RateLimitingCanBeDisabled(t *testing.T) { + t.Setenv(middleware.RateLimitingEnabledEnv, "false") + t.Setenv(middleware.RateLimitingBurstEnv, "1") + mux, _ := newLocalMux(t) + + require.Equal(t, http.StatusOK, getUploadURL(t, mux)) + require.Equal(t, http.StatusOK, getUploadURL(t, mux)) +} diff --git a/upload-server/server/s3.go b/upload-server/server/s3.go index c0976acb5..ffc5df01f 100644 --- a/upload-server/server/s3.go +++ b/upload-server/server/s3.go @@ -12,6 +12,8 @@ import ( "github.com/aws/aws-sdk-go-v2/service/s3" log "github.com/sirupsen/logrus" + "github.com/netbirdio/netbird/management/server/http/middleware" + "github.com/netbirdio/netbird/upload-server/types" ) @@ -21,7 +23,7 @@ type sThree struct { presignClient *s3.PresignClient } -func configureS3Handlers(mux *http.ServeMux) error { +func configureS3Handlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error { bucket := os.Getenv(bucketVar) region, ok := os.LookupEnv("AWS_REGION") if !ok { @@ -40,7 +42,7 @@ func configureS3Handlers(mux *http.ServeMux) error { bucket: bucket, presignClient: s3.NewPresignClient(client), } - mux.HandleFunc(types.GetURLPath, handler.handlerGetUploadURL) + mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(handler.handlerGetUploadURL))) return nil } diff --git a/upload-server/server/s3_test.go b/upload-server/server/s3_test.go index 110b1b780..cba65c8c8 100644 --- a/upload-server/server/s3_test.go +++ b/upload-server/server/s3_test.go @@ -90,7 +90,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) { t.Setenv(bucketVar, bucketName) mux := http.NewServeMux() - err = configureS3Handlers(mux) + err = configureS3Handlers(mux, newTestRateLimiter(t)) require.NoError(t, err) req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil) diff --git a/upload-server/server/server.go b/upload-server/server/server.go index 29ef72732..607c5bdad 100644 --- a/upload-server/server/server.go +++ b/upload-server/server/server.go @@ -10,6 +10,7 @@ import ( "github.com/google/uuid" log "github.com/sirupsen/logrus" + "github.com/netbirdio/netbird/management/server/http/middleware" "github.com/netbirdio/netbird/upload-server/types" ) @@ -19,7 +20,8 @@ const ( ) type Server struct { - srv *http.Server + srv *http.Server + limiter *middleware.APIRateLimiter } func NewServer() *Server { @@ -29,7 +31,7 @@ func NewServer() *Server { address = "0.0.0.0:8080" } mux := http.NewServeMux() - err := configureMux(mux) + limiter, err := configureMux(mux) if err != nil { log.Fatalf("Failed to configure server: %v", err) } @@ -38,7 +40,8 @@ func NewServer() *Server { }) return &Server{ - srv: &http.Server{Addr: address, Handler: mux}, + srv: &http.Server{Addr: address, Handler: mux}, + limiter: limiter, } } @@ -48,6 +51,9 @@ func (s *Server) Start() error { } func (s *Server) Stop() error { + if s.limiter != nil { + s.limiter.Stop() + } if s.srv != nil { log.Infof("Stopping upload server on %s", s.srv.Addr) ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) @@ -57,13 +63,14 @@ func (s *Server) Stop() error { return nil } -func configureMux(mux *http.ServeMux) error { +func configureMux(mux *http.ServeMux) (*middleware.APIRateLimiter, error) { + limiter := newRateLimiter() + _, ok := os.LookupEnv(bucketVar) if ok { - return configureS3Handlers(mux) - } else { - return configureLocalHandlers(mux) + return limiter, configureS3Handlers(mux, limiter) } + return limiter, configureLocalHandlers(mux, limiter) } func getObjectKey(w http.ResponseWriter, r *http.Request) string { diff --git a/upload-server/server/signing.go b/upload-server/server/signing.go new file mode 100644 index 000000000..86ee785b2 --- /dev/null +++ b/upload-server/server/signing.go @@ -0,0 +1,90 @@ +package server + +import ( + "crypto/hmac" + "crypto/rand" + "crypto/sha256" + "encoding/hex" + "fmt" + "net/url" + "os" + "strconv" + "time" + + log "github.com/sirupsen/logrus" +) + +const ( + signingKeyVar = "NB_UPLOAD_SIGNING_KEY" + + // signatureTTL matches the expiry the S3 backend puts on its presigned URLs. + signatureTTL = 15 * time.Minute + + expiryParam = "exp" + signatureParam = "sig" + + minSigningKeyLen = 32 +) + +type signer struct { + key []byte +} + +func newSigner() (*signer, error) { + if env, ok := os.LookupEnv(signingKeyVar); ok { + if env == "" { + return nil, fmt.Errorf("%s is set but empty", signingKeyVar) + } + if len(env) < minSigningKeyLen { + return nil, fmt.Errorf("%s must be at least %d bytes", signingKeyVar, minSigningKeyLen) + } + return &signer{key: []byte(env)}, nil + } + + key := make([]byte, 32) + if _, err := rand.Read(key); err != nil { + return nil, fmt.Errorf("generate signing key: %w", err) + } + log.Infof("%s not set, generated an ephemeral upload signing key", signingKeyVar) + + return &signer{key: key}, nil +} + +// sign returns the query parameters that authorize an upload of objectKey. +func (s *signer) sign(objectKey string, now time.Time) url.Values { + exp := now.Add(signatureTTL).Unix() + + v := url.Values{} + v.Set(expiryParam, strconv.FormatInt(exp, 10)) + v.Set(signatureParam, hex.EncodeToString(s.signature(objectKey, exp))) + + return v +} + +// verify reports whether query carries a still-valid signature over objectKey. +func (s *signer) verify(objectKey string, query url.Values, now time.Time) error { + exp, err := strconv.ParseInt(query.Get(expiryParam), 10, 64) + if err != nil { + return fmt.Errorf("malformed %s parameter", expiryParam) + } + + got, err := hex.DecodeString(query.Get(signatureParam)) + if err != nil { + return fmt.Errorf("malformed %s parameter", signatureParam) + } + + if !hmac.Equal(got, s.signature(objectKey, exp)) { + return fmt.Errorf("signature mismatch") + } + if now.Unix() >= exp { + return fmt.Errorf("upload URL expired") + } + + return nil +} + +func (s *signer) signature(objectKey string, exp int64) []byte { + mac := hmac.New(sha256.New, s.key) + fmt.Fprintf(mac, "%s\n%d", objectKey, exp) + return mac.Sum(nil) +} diff --git a/upload-server/server/signing_test.go b/upload-server/server/signing_test.go new file mode 100644 index 000000000..2fdd4aa3f --- /dev/null +++ b/upload-server/server/signing_test.go @@ -0,0 +1,148 @@ +package server + +import ( + "bytes" + "encoding/json" + "net/http" + "net/http/httptest" + "net/url" + "os" + "path/filepath" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/netbirdio/netbird/upload-server/types" +) + +func newLocalMux(t *testing.T) (*http.ServeMux, string) { + t.Helper() + + mockDir := t.TempDir() + t.Setenv("SERVER_URL", "http://localhost:8080") + t.Setenv("STORE_DIR", mockDir) + t.Setenv(signingKeyVar, testSigningKey) + + mux := http.NewServeMux() + require.NoError(t, configureLocalHandlers(mux, newTestRateLimiter(t))) + + return mux, mockDir +} + +func Test_LocalUploadURLRoundTrip(t *testing.T) { + mux, mockDir := newLocalMux(t) + + getReq := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil) + getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue) + getRec := httptest.NewRecorder() + mux.ServeHTTP(getRec, getReq) + require.Equal(t, http.StatusOK, getRec.Code) + + var response types.GetURLResponse + require.NoError(t, json.Unmarshal(getRec.Body.Bytes(), &response)) + + minted, err := url.Parse(response.URL) + require.NoError(t, err) + require.NotEmpty(t, minted.Query().Get(signatureParam)) + + content := []byte("bundle") + putRec := httptest.NewRecorder() + mux.ServeHTTP(putRec, httptest.NewRequest(http.MethodPut, minted.RequestURI(), bytes.NewReader(content))) + require.Equal(t, http.StatusOK, putRec.Code) + + written, err := os.ReadFile(filepath.Join(mockDir, response.Key)) + require.NoError(t, err) + require.Equal(t, content, written) +} + +func Test_LocalHandlePutRequest_RejectsUnauthorized(t *testing.T) { + expired := &signer{key: []byte(testSigningKey)} + + tests := []struct { + name string + query string + }{ + { + name: "no signature", + query: "", + }, + { + name: "tampered signature", + query: "exp=99999999999&sig=deadbeef", + }, + { + name: "malformed signature", + query: "exp=99999999999&sig=not-hex", + }, + { + // A signature is only good for the key it was minted for, so a URL + // handed out for one bundle cannot be replayed against another. + name: "signature for a different object", + query: signedQuery(t, "dir/other.txt"), + }, + { + name: "signature expiring this second", + query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL)).Encode(), + }, + { + name: "expired signature", + query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL-time.Minute)).Encode(), + }, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + mux, mockDir := newLocalMux(t) + + target := putURLPath + "/dir/file.txt" + if tc.query != "" { + target += "?" + tc.query + } + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPut, target, bytes.NewReader([]byte("payload")))) + + require.Equal(t, http.StatusUnauthorized, rec.Code) + + _, err := os.Stat(filepath.Join(mockDir, "dir", "file.txt")) + require.True(t, os.IsNotExist(err), "unauthorized upload should not be written") + }) + } +} + +func Test_SignerRejectsForeignKey(t *testing.T) { + minted := (&signer{key: []byte("one key")}).sign("dir/file.txt", time.Now()) + + err := (&signer{key: []byte("another key")}).verify("dir/file.txt", minted, time.Now()) + require.Error(t, err) +} + +func Test_NewSignerGeneratesEphemeralKey(t *testing.T) { + // Registers the restore hook, then clears the value for this test only. + t.Setenv(signingKeyVar, "") + os.Unsetenv(signingKeyVar) + + first, err := newSigner() + require.NoError(t, err) + second, err := newSigner() + require.NoError(t, err) + + require.NotEqual(t, first.key, second.key) + require.Len(t, first.key, 32) +} + +func Test_NewSignerRejectsEmptyKey(t *testing.T) { + t.Setenv(signingKeyVar, "") + + _, err := newSigner() + require.Error(t, err) +} + +func Test_NewSignerRejectsShortKey(t *testing.T) { + t.Setenv(signingKeyVar, strings.Repeat("a", minSigningKeyLen-1)) + + _, err := newSigner() + require.Error(t, err) +}