tegwick
ca0cb75729
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
296 lines
10 KiB
Go
296 lines
10 KiB
Go
// Package decisionpep authenticates the producer's decision record for one
|
|
// current request. It never evaluates policy, caches a verdict, or discovers trust.
|
|
package decisionpep
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/netkingdom/access-engine/internal/sign"
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
|
)
|
|
|
|
var ErrRefused = errors.New("authenticated decision refused")
|
|
|
|
const nonceKey = "decisionpep_request_nonce"
|
|
|
|
const JSONProfile = "lossless-json-v1"
|
|
const provenanceMode = "standalone/lossless-json-v1"
|
|
const maxBytes = 2 << 20
|
|
|
|
// Admission is public, independently admitted owner configuration. TokenFile is
|
|
// only a path to a private rotating caller credential, never a literal token.
|
|
type Admission struct {
|
|
Endpoint string `json:"endpoint"`
|
|
CAFile string `json:"ca_file"`
|
|
TokenFile string `json:"token_file"`
|
|
Keys map[string]string `json:"keys"`
|
|
Evaluator string `json:"evaluator"`
|
|
PolicyPackage string `json:"policy_package"`
|
|
PolicyVersion string `json:"policy_version"`
|
|
PolicyDigest string `json:"policy_digest"`
|
|
RegistryDigest string `json:"registry_digest"`
|
|
CallerPrincipal string `json:"caller_principal"`
|
|
CallerAudience string `json:"caller_audience"`
|
|
MaxTTL string `json:"max_ttl"`
|
|
MaxClockSkew string `json:"max_clock_skew"`
|
|
}
|
|
|
|
type Client struct {
|
|
admission Admission
|
|
keys map[string]ed25519.PublicKey
|
|
http *http.Client
|
|
maxTTL, skew time.Duration
|
|
now func() time.Time
|
|
}
|
|
|
|
// Load reads a current independently admitted file. No trust is bootstrapped
|
|
// from a PDP response, token contents, discovery endpoint, or environment value.
|
|
func Load(path string) (*Client, error) {
|
|
raw, err := readFile(path, false)
|
|
if err != nil {
|
|
return nil, ErrRefused
|
|
}
|
|
var a Admission
|
|
d := json.NewDecoder(bytes.NewReader(raw))
|
|
d.DisallowUnknownFields()
|
|
if d.Decode(&a) != nil {
|
|
return nil, ErrRefused
|
|
}
|
|
if _, err = d.Token(); err != io.EOF {
|
|
return nil, ErrRefused
|
|
}
|
|
return New(a)
|
|
}
|
|
|
|
func New(a Admission) (*Client, error) {
|
|
u, err := url.Parse(a.Endpoint)
|
|
if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.Path != "/v1/check" || u.RawQuery != "" || u.Fragment != "" {
|
|
return nil, ErrRefused
|
|
}
|
|
if !filepath.IsAbs(a.CAFile) || !filepath.IsAbs(a.TokenFile) || a.Evaluator == "" || a.PolicyPackage == "" || a.PolicyVersion == "" || a.CallerPrincipal == "" || a.CallerAudience == "" {
|
|
return nil, ErrRefused
|
|
}
|
|
if !validDigest(a.PolicyDigest) || !validDigest(a.RegistryDigest) || len(a.Keys) == 0 {
|
|
return nil, ErrRefused
|
|
}
|
|
ttl, err := time.ParseDuration(a.MaxTTL)
|
|
if err != nil || ttl <= 0 {
|
|
return nil, ErrRefused
|
|
}
|
|
skew, err := time.ParseDuration(a.MaxClockSkew)
|
|
if err != nil || skew < 0 || skew > ttl {
|
|
return nil, ErrRefused
|
|
}
|
|
ca, err := readFile(a.CAFile, false)
|
|
if err != nil {
|
|
return nil, ErrRefused
|
|
}
|
|
roots := x509.NewCertPool()
|
|
if !roots.AppendCertsFromPEM(ca) {
|
|
return nil, ErrRefused
|
|
}
|
|
keys := map[string]ed25519.PublicKey{}
|
|
for kid, value := range a.Keys {
|
|
b, e := base64.RawURLEncoding.Strict().DecodeString(value)
|
|
if e != nil || kid == "" || len(b) != ed25519.PublicKeySize {
|
|
return nil, ErrRefused
|
|
}
|
|
keys[kid] = append(ed25519.PublicKey(nil), b...)
|
|
}
|
|
transport := &http.Transport{Proxy: nil, TLSClientConfig: &tls.Config{RootCAs: roots, MinVersion: tls.VersionTLS12}, DisableKeepAlives: true}
|
|
client := &http.Client{Transport: transport, Timeout: 10 * time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return ErrRefused }}
|
|
return &Client{admission: a, keys: keys, http: client, maxTTL: ttl, skew: skew, now: time.Now}, nil
|
|
}
|
|
|
|
func validDigest(value string) bool {
|
|
if !strings.HasPrefix(value, "sha256:") || len(value) != 71 {
|
|
return false
|
|
}
|
|
_, e := hex.DecodeString(value[7:])
|
|
return e == nil && strings.ToLower(value) == value
|
|
}
|
|
|
|
func readFile(path string, private bool) ([]byte, error) {
|
|
if !filepath.IsAbs(path) {
|
|
return nil, ErrRefused
|
|
}
|
|
f, e := os.Open(path)
|
|
if e != nil {
|
|
return nil, ErrRefused
|
|
}
|
|
defer f.Close()
|
|
info, e := f.Stat()
|
|
if e != nil || !info.Mode().IsRegular() || info.Mode().Perm()&0022 != 0 {
|
|
return nil, ErrRefused
|
|
}
|
|
if private && info.Mode().Perm()&0007 != 0 {
|
|
return nil, ErrRefused
|
|
}
|
|
b, e := io.ReadAll(io.LimitReader(f, maxBytes+1))
|
|
if e != nil || len(b) > maxBytes {
|
|
return nil, ErrRefused
|
|
}
|
|
return b, nil
|
|
}
|
|
|
|
// Check sends exactly one request with a cryptographically fresh nonce. The
|
|
// returned envelope is the producer's authenticated typed interpretation.
|
|
// Callers must execute only the request's exact operation and honor their own
|
|
// execution boundary; a login decision is never a later resource decision.
|
|
func (c *Client) Check(ctx context.Context, request api.CheckRequest) (api.DecisionEnvelope, error) {
|
|
refuse := func() (api.DecisionEnvelope, error) { return api.DecisionEnvelope{}, ErrRefused }
|
|
if c == nil || request.Purpose != "" || request.Tenant == "" || request.Subject.ID == "" || request.Subject.Type == "" || request.Resource.ID == "" || request.Resource.Type == "" || request.Resource.System == "" || request.Action == "" {
|
|
return refuse()
|
|
}
|
|
if request.Subject.Tenant != request.Tenant || request.Resource.Tenant != request.Tenant {
|
|
return refuse()
|
|
}
|
|
if request.PolicyVersion != "" && request.PolicyVersion != c.admission.PolicyVersion {
|
|
return refuse()
|
|
}
|
|
// Use the producer's typed representation and preserve numeric lexemes. A
|
|
// producer that rounds before hashing fails this join rather than weakening it.
|
|
raw, err := json.Marshal(request)
|
|
if err != nil {
|
|
return refuse()
|
|
}
|
|
decoder := json.NewDecoder(bytes.NewReader(raw))
|
|
decoder.UseNumber()
|
|
if decoder.Decode(&request) != nil {
|
|
return refuse()
|
|
}
|
|
if request.Context == nil {
|
|
request.Context = map[string]any{}
|
|
}
|
|
if _, exists := request.Context[nonceKey]; exists {
|
|
return refuse()
|
|
}
|
|
nonce := make([]byte, 32)
|
|
if _, err = rand.Read(nonce); err != nil {
|
|
return refuse()
|
|
}
|
|
request.Context[nonceKey] = hex.EncodeToString(nonce)
|
|
request.Context["decisionpep_json_profile"] = JSONProfile
|
|
request.ID = hex.EncodeToString(nonce)
|
|
request.PolicyVersion = c.admission.PolicyVersion
|
|
raw, err = json.Marshal(request)
|
|
if err != nil || len(raw) > maxBytes {
|
|
return refuse()
|
|
}
|
|
token, err := readFile(c.admission.TokenFile, true)
|
|
if err != nil {
|
|
return refuse()
|
|
}
|
|
value := strings.TrimSpace(string(token))
|
|
if value == "" || strings.ContainsAny(value, " \t\r\n") {
|
|
return refuse()
|
|
}
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.admission.Endpoint, bytes.NewReader(raw))
|
|
if err != nil {
|
|
return refuse()
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Access-Engine-JSON-Profile", JSONProfile)
|
|
req.Header.Set("Authorization", "Bearer "+value)
|
|
started := c.now().UTC()
|
|
response, err := c.http.Do(req)
|
|
if err != nil {
|
|
return refuse()
|
|
}
|
|
defer response.Body.Close()
|
|
if response.StatusCode != http.StatusOK {
|
|
return refuse()
|
|
}
|
|
body, err := io.ReadAll(io.LimitReader(response.Body, maxBytes+1))
|
|
if err != nil || len(body) > maxBytes {
|
|
return refuse()
|
|
}
|
|
envelope, err := sign.DecodeEnvelope(body)
|
|
if err != nil || sign.Verify(envelope, c.keys) != nil {
|
|
return refuse()
|
|
}
|
|
if c.validate(envelope, request, started, c.now().UTC()) != nil {
|
|
return refuse()
|
|
}
|
|
return envelope, nil
|
|
}
|
|
|
|
func (c *Client) validate(e api.DecisionEnvelope, r api.CheckRequest, started, now time.Time) error {
|
|
p := e.Provenance
|
|
b := e.Binding
|
|
l := e.Lifetime
|
|
if e.ID == "" || e.ContractVersion != api.DecisionRecordContractV1 || e.Effect != api.DecisionEffectAllow || e.RequestID != r.ID || len(e.Obligations) != 0 || b == nil || l == nil {
|
|
return ErrRefused
|
|
}
|
|
if p.Evaluator != c.admission.Evaluator || p.Mode != provenanceMode || p.PolicyPackage != c.admission.PolicyPackage || p.PolicyVersion != c.admission.PolicyVersion || p.PolicyPackageDigest != c.admission.PolicyDigest || p.RegistrySnapshotDigest != c.admission.RegistryDigest || e.MatchedPolicyVersion != p.PolicyVersion {
|
|
return ErrRefused
|
|
}
|
|
if b.Purpose != "" || b.SubmittedRequestDigest != api.RequestDigest(r) || b.Tenant != r.Tenant || b.Action != r.Action || api.CanonicalDigest(b.Context) != api.CanonicalDigest(r.Context) {
|
|
return ErrRefused
|
|
}
|
|
if !sameSubject(b.Subject, r.Subject) || !sameResource(b.Resource, r.Resource) || !sameSubject(e.Subject, b.Subject) || !sameResource(e.Resource, b.Resource) {
|
|
return ErrRefused
|
|
}
|
|
evaluated := api.CheckRequest{Tenant: b.Tenant, Subject: b.Subject, Action: b.Action, Resource: b.Resource, Context: b.Context, Purpose: b.Purpose}
|
|
if b.RequestDigest != api.RequestDigest(evaluated) {
|
|
return ErrRefused
|
|
}
|
|
for k, v := range api.InputClaimDigests(r) {
|
|
if p.InputClaimDigests[k] != v {
|
|
return ErrRefused
|
|
}
|
|
}
|
|
caller := p.Caller
|
|
if caller == nil || caller.Mode != "enforce" || caller.Principal != c.admission.CallerPrincipal || caller.Audience != c.admission.CallerAudience {
|
|
return ErrRefused
|
|
}
|
|
callerEnd, err := time.Parse(time.RFC3339Nano, caller.NotAfter)
|
|
if err != nil || !now.Before(callerEnd) {
|
|
return ErrRefused
|
|
}
|
|
decision, err := time.Parse(time.RFC3339Nano, p.DecisionTime)
|
|
if err != nil || decision.Before(started.Add(-c.skew)) || decision.After(now.Add(c.skew)) {
|
|
return ErrRefused
|
|
}
|
|
begin, err := time.Parse(time.RFC3339Nano, l.NotBefore)
|
|
if err != nil || begin.After(now) {
|
|
return ErrRefused
|
|
}
|
|
end, err := time.Parse(time.RFC3339Nano, l.ExpiresAt)
|
|
if err != nil || !now.Before(end) || !end.After(begin) || end.Sub(begin) > c.maxTTL || end.After(callerEnd) {
|
|
return ErrRefused
|
|
}
|
|
ttl, err := time.ParseDuration(l.TTL)
|
|
if err != nil || l.Kind != api.DecisionLifetimeTTL || ttl <= 0 || ttl > c.maxTTL {
|
|
return ErrRefused
|
|
}
|
|
// Producer CompleteDecision uses its exact decision instant for both bounds.
|
|
// RFC3339 output can truncate subsecond precision, so do not invent lost time.
|
|
if !begin.Equal(decision) || end.Sub(begin) != ttl {
|
|
return ErrRefused
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func sameSubject(a, b api.SubjectRef) bool {
|
|
return a.ID == b.ID && a.Type == b.Type && a.Tenant == b.Tenant
|
|
}
|
|
func sameResource(a, b api.ResourceRef) bool {
|
|
return a.ID == b.ID && a.Type == b.Type && a.System == b.System && a.Tenant == b.Tenant
|
|
}
|