|
| 1 | +/* |
| 2 | + * This is free and unencumbered software released into the public domain. |
| 3 | + * |
| 4 | + * Anyone is free to copy, modify, publish, use, compile, sell, or |
| 5 | + * distribute this software, either in source code form or as a compiled |
| 6 | + * binary, for any purpose, commercial or non-commercial, and by any |
| 7 | + * means. |
| 8 | + * |
| 9 | + * In jurisdictions that recognize copyright laws, the author or authors |
| 10 | + * of this software dedicate any and all copyright interest in the |
| 11 | + * software to the public domain. We make this dedication for the benefit |
| 12 | + * of the public at large and to the detriment of our heirs and |
| 13 | + * successors. We intend this dedication to be an overt act of |
| 14 | + * relinquishment in perpetuity of all present and future rights to this |
| 15 | + * software under copyright law. |
| 16 | + * |
| 17 | + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, |
| 18 | + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF |
| 19 | + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. |
| 20 | + * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR |
| 21 | + * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, |
| 22 | + * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR |
| 23 | + * OTHER DEALINGS IN THE SOFTWARE. |
| 24 | + * |
| 25 | + * For more information, please refer to <http://unlicense.org/> |
| 26 | + */ |
| 27 | + |
| 28 | +package net.adamcin.httpsig.api; |
| 29 | + |
| 30 | +import java.util.Collection; |
| 31 | +import java.util.Date; |
| 32 | +import java.util.GregorianCalendar; |
| 33 | +import java.util.Iterator; |
| 34 | +import java.util.Map; |
| 35 | +import java.util.Set; |
| 36 | +import java.util.TimeZone; |
| 37 | + |
| 38 | +/** |
| 39 | + * The Server-Side component of the protocol which verifies {@link Authorization} headers using SSH Public Keys |
| 40 | + */ |
| 41 | +public final class DefaultVerifier implements Verifier { |
| 42 | + public static final long DEFAULT_SKEW = 300000L; |
| 43 | + |
| 44 | + private final Keychain keychain; |
| 45 | + private final KeyId keyId; |
| 46 | + private final long skew; |
| 47 | + |
| 48 | + public DefaultVerifier(Keychain keychain) { |
| 49 | + this(keychain, null, DEFAULT_SKEW); |
| 50 | + } |
| 51 | + |
| 52 | + public DefaultVerifier(Keychain keychain, KeyId keyId) { |
| 53 | + this(keychain, keyId, DEFAULT_SKEW); |
| 54 | + } |
| 55 | + |
| 56 | + public DefaultVerifier(Keychain keychain, KeyId keyId, long skew) { |
| 57 | + this.keychain = keychain != null ? new KeychainGuard(keychain) : new KeychainGuard(new DefaultKeychain()); |
| 58 | + this.keyId = new CanVerifyId(keyId != null ? keyId : Constants.DEFAULT_KEY_IDENTIFIER); |
| 59 | + this.skew = skew; |
| 60 | + } |
| 61 | + |
| 62 | + public Keychain getKeychain() { |
| 63 | + return keychain; |
| 64 | + } |
| 65 | + |
| 66 | + /** |
| 67 | + * {@inheritDoc} |
| 68 | + */ |
| 69 | + public long getSkew() { |
| 70 | + return skew; |
| 71 | + } |
| 72 | + |
| 73 | + /** |
| 74 | + * @deprecated will remove to make the class immutable. use constructor overload instead. |
| 75 | + * @param skew new server skew in milliseconds |
| 76 | + */ |
| 77 | + public void setSkew(long skew) { |
| 78 | + // this is now a no-op. |
| 79 | + } |
| 80 | + |
| 81 | + /** |
| 82 | + * {@inheritDoc} |
| 83 | + */ |
| 84 | + public Key selectKey(Authorization authorization) { |
| 85 | + return keychain.toMap(this.keyId).get(authorization.getKeyId()); |
| 86 | + } |
| 87 | + |
| 88 | + /** |
| 89 | + * {@inheritDoc} |
| 90 | + */ |
| 91 | + public boolean verify(Challenge challenge, RequestContent requestContent, Authorization authorization) { |
| 92 | + return verifyWithResult(challenge, requestContent, authorization) == VerifyResult.SUCCESS; |
| 93 | + } |
| 94 | + |
| 95 | + /** |
| 96 | + * {@inheritDoc} |
| 97 | + */ |
| 98 | + public VerifyResult verifyWithResult(Challenge challenge, RequestContent requestContent, Authorization authorization) { |
| 99 | + if (challenge == null) { |
| 100 | + throw new IllegalArgumentException("challenge cannot be null"); |
| 101 | + } |
| 102 | + |
| 103 | + if (requestContent == null) { |
| 104 | + throw new IllegalArgumentException("requestContent cannot be null"); |
| 105 | + } |
| 106 | + |
| 107 | + if (authorization == null) { |
| 108 | + throw new IllegalArgumentException("authorization cannot be null"); |
| 109 | + } |
| 110 | + |
| 111 | + // verify that all headers required by the challenge are declared by the authorization |
| 112 | + for (String header : challenge.getHeaders()) { |
| 113 | + if (!header.startsWith(":") && !authorization.getHeaders().contains(header)) { |
| 114 | + return VerifyResult.CHALLENGE_NOT_SATISFIED; |
| 115 | + } |
| 116 | + } |
| 117 | + |
| 118 | + // verify that all headers declared by the authorization are present in the request |
| 119 | + for (String header : authorization.getHeaders()) { |
| 120 | + if (requestContent.getHeaderValues(header).isEmpty()) { |
| 121 | + return VerifyResult.INCOMPLETE_REQUEST; |
| 122 | + } |
| 123 | + } |
| 124 | + |
| 125 | + // if date is declared by the authorization, verify that its value is within $skew of the current time |
| 126 | + if (authorization.getHeaders().contains(Constants.HEADER_DATE) && skew >= 0) { |
| 127 | + Date requestTime = requestContent.getDateGMT(); |
| 128 | + Date currentTime = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime(); |
| 129 | + Date past = new Date(currentTime.getTime() - skew); |
| 130 | + Date future = new Date(currentTime.getTime() + skew); |
| 131 | + if (requestTime.before(past) || requestTime.after(future)) { |
| 132 | + return VerifyResult.EXPIRED_DATE_HEADER; |
| 133 | + } |
| 134 | + } |
| 135 | + |
| 136 | + Key key = selectKey(authorization); |
| 137 | + if (key == null) { |
| 138 | + return VerifyResult.KEY_NOT_FOUND; |
| 139 | + } |
| 140 | + |
| 141 | + if (key.verify(authorization.getAlgorithm(), |
| 142 | + requestContent.getContent(authorization.getHeaders(), Constants.CHARSET), |
| 143 | + authorization.getSignatureBytes())) { |
| 144 | + return VerifyResult.SUCCESS; |
| 145 | + } else { |
| 146 | + return VerifyResult.FAILED_KEY_VERIFY; |
| 147 | + } |
| 148 | + } |
| 149 | + |
| 150 | + private static class CanVerifyId implements KeyId { |
| 151 | + private KeyId delegatee; |
| 152 | + |
| 153 | + private CanVerifyId(KeyId delegatee) { |
| 154 | + this.delegatee = delegatee; |
| 155 | + } |
| 156 | + |
| 157 | + public String getId(Key key) { |
| 158 | + if (key != null && key.canVerify()) { |
| 159 | + return delegatee.getId(key); |
| 160 | + } |
| 161 | + return null; |
| 162 | + } |
| 163 | + } |
| 164 | + |
| 165 | + /** |
| 166 | + * Guards a Keychain from modification via reflection (not enough for JAAS?) |
| 167 | + */ |
| 168 | + private static class KeychainGuard implements Keychain { |
| 169 | + private final Keychain keychain; |
| 170 | + |
| 171 | + private KeychainGuard(Keychain keychain) { |
| 172 | + this.keychain = keychain; |
| 173 | + } |
| 174 | + |
| 175 | + public Set<Algorithm> getAlgorithms() { |
| 176 | + return keychain.getAlgorithms(); |
| 177 | + } |
| 178 | + |
| 179 | + public Keychain filterAlgorithms(Collection<Algorithm> algorithms) { |
| 180 | + return new KeychainGuard(keychain.filterAlgorithms(algorithms)); |
| 181 | + } |
| 182 | + |
| 183 | + public Keychain discard() { |
| 184 | + return new KeychainGuard(keychain.discard()); |
| 185 | + } |
| 186 | + |
| 187 | + public Key currentKey() { |
| 188 | + return keychain.currentKey(); |
| 189 | + } |
| 190 | + |
| 191 | + public Map<String, Key> toMap(KeyId keyId) { |
| 192 | + return keychain.toMap(keyId); |
| 193 | + } |
| 194 | + |
| 195 | + public boolean isEmpty() { |
| 196 | + return keychain.isEmpty(); |
| 197 | + } |
| 198 | + |
| 199 | + public Iterator<Key> iterator() { |
| 200 | + return keychain.iterator(); |
| 201 | + } |
| 202 | + } |
| 203 | +} |
0 commit comments