pkg/authorization/authz.go

package authorization

import (
	"bytes"
	"fmt"
	"io"
	"io/ioutil"
	"net/http"
	"strings"
)

// NewCtx creates new authZ context, it is used to store authorization information related to a specific docker
// REST http session
// A context provides two method:
// Authenticate Request:
// Call authZ plugins with current REST request and AuthN response
// Request contains full HTTP packet sent to the docker daemon
// https://docs.docker.com/reference/api/docker_remote_api/
//
// Authenticate Response:
// Call authZ plugins with full info about current REST request, REST response and AuthN response
// The response from this method may contains content that overrides the daemon response
// This allows authZ plugins to filter privileged content
//
// If multiple authZ plugins are specified, the block/allow decision is based on ANDing all plugin results
// For response manipulation, the response from each plugin is piped between plugins. Plugin execution order
// is determined according to daemon parameters
func NewCtx(authZPlugins []Plugin, user, userAuthNMethod, requestMethod, requestURI string) *Ctx {
	return &Ctx{
		plugins:         authZPlugins,
		user:            user,
		userAuthNMethod: userAuthNMethod,
		requestMethod:   requestMethod,
		requestURI:      requestURI,
	}
}

// Ctx stores a a single request-response interaction context
type Ctx struct {
	user            string
	userAuthNMethod string
	requestMethod   string
	requestURI      string
	plugins         []Plugin
	// authReq stores the cached request object for the current transaction
	authReq *Request
}

// AuthZRequest authorized the request to the docker daemon using authZ plugins
func (a *Ctx) AuthZRequest(w http.ResponseWriter, r *http.Request) error {
	var body []byte
	if sendBody(a.requestURI, r.Header) {
		var (
			err         error
			drainedBody io.ReadCloser
		)
		drainedBody, r.Body, err = drainBody(r.Body)
		if err != nil {
			return err
		}
		defer drainedBody.Close()
		body, err = ioutil.ReadAll(drainedBody)
		if err != nil {
			return err
		}
	}

	var h bytes.Buffer
	if err := r.Header.Write(&h); err != nil {
		return err
	}

	a.authReq = &Request{
		User:            a.user,
		UserAuthNMethod: a.userAuthNMethod,
		RequestMethod:   a.requestMethod,
		RequestURI:      a.requestURI,
		RequestBody:     body,
		RequestHeaders:  headers(r.Header)}

	for _, plugin := range a.plugins {
		authRes, err := plugin.AuthZRequest(a.authReq)
		if err != nil {
			return err
		}

		if authRes.Err != "" {
			return fmt.Errorf(authRes.Err)
		}

		if !authRes.Allow {
			return fmt.Errorf(authRes.Msg)
		}
	}

	return nil
}

// AuthZResponse authorized and manipulates the response from docker daemon using authZ plugins
func (a *Ctx) AuthZResponse(rm ResponseModifier, r *http.Request) error {
	a.authReq.ResponseStatusCode = rm.StatusCode()
	a.authReq.ResponseHeaders = headers(rm.Header())

	if sendBody(a.requestURI, rm.Header()) {
		a.authReq.ResponseBody = rm.RawBody()
	}

	for _, plugin := range a.plugins {
		authRes, err := plugin.AuthZResponse(a.authReq)
		if err != nil {
			return err
		}

		if authRes.Err != "" {
			return fmt.Errorf(authRes.Err)
		}

		if !authRes.Allow {
			return fmt.Errorf(authRes.Msg)
		}
	}

	rm.Flush()

	return nil
}

// drainBody dump the body, it reads the body data into memory and
// see go sources /go/src/net/http/httputil/dump.go
func drainBody(b io.ReadCloser) (io.ReadCloser, io.ReadCloser, error) {
	var buf bytes.Buffer
	if _, err := buf.ReadFrom(b); err != nil {
		return nil, nil, err
	}
	if err := b.Close(); err != nil {
		return nil, nil, err
	}
	return ioutil.NopCloser(&buf), ioutil.NopCloser(bytes.NewReader(buf.Bytes())), nil
}

// sendBody returns true when request/response body should be sent to AuthZPlugin
func sendBody(url string, header http.Header) bool {
	// Skip body for auth endpoint
	if strings.HasSuffix(url, "/auth") {
		return false
	}

	// body is sent only for text or json messages
	v := header.Get("Content-Type")
	return strings.HasPrefix(v, "text/") || v == "application/json"
}

// headers returns flatten version of the http headers excluding authorization
func headers(header http.Header) map[string]string {
	v := make(map[string]string, 0)
	for k, values := range header {
		// Skip authorization headers
		if strings.EqualFold(k, "Authorization") || strings.EqualFold(k, "X-Registry-Config") || strings.EqualFold(k, "X-Registry-Auth") {
			continue
		}
		for _, val := range values {
			v[k] = val
		}
	}
	return v
}