middleware_check_HMAC_signature.go

package main

import "net/http"

import (
	"crypto/hmac"
	"crypto/sha1"
	"encoding/base64"
	"github.com/Sirupsen/logrus"
	"github.com/gorilla/context"
	"math"
	"net/url"
	"sort"
	"strings"
	"time"
)

// Test key: 53ac07777cbb8c2d530000021a42331a43bd45555d5c923bdb36fc8a

// TODO: change these to real values
const DateHeaderSpec string = "Date"
const HMACClockSkewLimitInMs float64 = 300

// HMACMiddleware will check if the request has a signature, and if the request is allowed through
type HMACMiddleware struct {
	TykMiddleware
}

func (hm HMACMiddleware) authorizationError(w http.ResponseWriter, r *http.Request) {
	log.WithFields(logrus.Fields{
		"path":   r.URL.Path,
		"origin": r.RemoteAddr,
	}).Info("Authorisation field missing or malformed")

	handler := ErrorHandler{hm.TykMiddleware}
	handler.HandleError(w, r, "Authorisation field missing, malformed or invalid", 400)
}

// New creates a new HttpHandler for the alice middleware package, key implementation is here https://web-payments.org/specs/ED/http-signatures/2014-02-01/
func (hm HMACMiddleware) New() func(http.Handler) http.Handler {
	aliceHandler := func(h http.Handler) http.Handler {
		thisHandler := func(w http.ResponseWriter, r *http.Request) {

			log.Debug("HMAC middleware activated")

			authHeaderValue := r.Header.Get("Authorization")
			if authHeaderValue == "" {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Got auth header")

			if r.Header.Get(DateHeaderSpec) == "" {
				log.Debug("Date missing")
				hm.authorizationError(w, r)
				return
			}

			isOutOftime := hm.checkClockSkew(r.Header.Get(DateHeaderSpec))
			if isOutOftime == false {
				log.WithFields(logrus.Fields{
					"path":   r.URL.Path,
					"origin": r.RemoteAddr,
				}).Info("Date is out of allowed range.")

				handler := ErrorHandler{hm.TykMiddleware}
				handler.HandleError(w, r, "Date is out of allowed range.", 400)
				return
			}

			log.Debug("Got date")

			// Extract the keyId:
			splitTypes := strings.Split(authHeaderValue, " ")
			if len(splitTypes) != 2 {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Found two fields")

			if strings.ToLower(splitTypes[0]) != "signature" {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Found signature value field")

			splitValues := strings.Split(splitTypes[1], ",")
			if len(splitValues) != 3 {
				log.Debug("Comma length is wrong - got: ", splitValues)
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Found 2 commas - getting elements of signature")

			// extract the keyId, algorithm and signature
			keyId := ""
			algorithm := ""
			signature := ""
			for _, v := range splitValues {
				splitKeyValuePair := strings.Split(v, "=")
				if len(splitKeyValuePair) != 2 {
					hm.authorizationError(w, r)
					log.Debug("Equals length is wrong - got: ", splitKeyValuePair)
					return
				}
				if strings.ToLower(splitKeyValuePair[0]) == "keyid" {
					keyId = strings.Trim(splitKeyValuePair[1], "\"")
				}
				if strings.ToLower(splitKeyValuePair[0]) == "algorithm" {
					algorithm = strings.Trim(splitKeyValuePair[1], "\"")
				}
				if strings.ToLower(splitKeyValuePair[0]) == "signature" {
					signature = strings.Trim(splitKeyValuePair[1], "\"")
				}
			}

			log.Debug("Extracted values... checking validity")

			// None may be empty
			if keyId == "" || algorithm == "" || signature == "" {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Key is valid: ", keyId)
			log.Debug("algo is valid: ", algorithm)
			log.Debug("signature isn't empty: ", signature)

			// Check if API key valid
			keyExists, thisSessionState := authManager.IsKeyAuthorised(keyId)
			if !keyExists {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Found key in session store")

			// Set session state on context, we will need it later
			context.Set(r, SessionData, thisSessionState)
			context.Set(r, AuthHeaderValue, keyId)

			if thisSessionState.HmacSecret == "" || thisSessionState.HMACEnabled == false {
				log.WithFields(logrus.Fields{
					"path":   r.URL.Path,
					"origin": r.RemoteAddr,
				}).Info("API Requires HMAC signature, session missing HMACSecret or HMAC not enabled for key")

				handler := ErrorHandler{hm.TykMiddleware}
				handler.HandleError(w, r, "This key is invalid", 400)
				return
			}

			log.Debug("Sessionstate is HMAC enabled")

			ourSignature := hm.generateSignatureFromRequest(r, thisSessionState.HmacSecret)
			log.Debug("Our Signature: ", ourSignature)

			compareTo, err := url.QueryUnescape(signature)

			if err != nil {
				hm.authorizationError(w, r)
				return
			}

			log.Debug("Request Signature: ", compareTo)
			if ourSignature != compareTo {
				log.WithFields(logrus.Fields{
					"path":   r.URL.Path,
					"origin": r.RemoteAddr,
				}).Info("Request signature is invalid")

				handler := ErrorHandler{hm.TykMiddleware}
				handler.HandleError(w, r, "Request signature is invalid", 400)
				return
			}

			log.Debug("Signature matches")

			// Everything seems in order let the request through
			h.ServeHTTP(w, r)
		}
		return http.HandlerFunc(thisHandler)
	}
	return aliceHandler
}

func (hm HMACMiddleware) parseFormParams(values url.Values) string {
	kvValues := map[string]string{}
	keys := []string{}

	log.Debug("Parsing header values")

	for k, v := range values {
		log.Debug("Form parser - processing key: ", k)
		log.Debug("Form parser - processing value: ", v)
		encodedKey := url.QueryEscape(k)
		encodedVals := []string{}
		for _, raw_value := range v {
			encodedVals = append(encodedVals, url.QueryEscape(raw_value))
		}
		joined_vals := strings.Join(encodedVals, "|")
		kvPair := encodedKey + "=" + joined_vals
		kvValues[k] = kvPair
		keys = append(keys, k)
	}

	// sort the keys in alphabetical order
	sort.Strings(keys)
	sortedKvs := []string{}

	// Put the prepared key value params in order according to above sort
	for _, sk := range keys {
		sortedKvs = append(sortedKvs, kvValues[sk])
	}

	// Join the kv's up as per spec
	prepared_params := strings.Join(sortedKvs, "&")

	return prepared_params
}

// Generates our signature - based on: https://web-payments.org/specs/ED/http-signatures/2014-02-01/#page-3 HMAC signing
func (hm HMACMiddleware) generateSignatureFromRequest(r *http.Request, secret string) string {
	//method := strings.ToUpper(r.Method)
	//base_url := url.QueryEscape(r.URL.RequestURI())

	date_header := url.QueryEscape(r.Header.Get(DateHeaderSpec))

	// Not using form params for now, just date string
	//params := url.QueryEscape(hm.parseFormParams(r.Form))

	// Prep the signature string
	signatureString := strings.ToLower(DateHeaderSpec) + ":" + date_header

	log.Debug("Signature string before encoding: ", signatureString)

	// Encode it
	key := []byte(secret)
	h := hmac.New(sha1.New, key)
	h.Write([]byte(signatureString))

	encodedString := base64.StdEncoding.EncodeToString(h.Sum(nil))
	log.Debug("Encoded signature string: ", encodedString)
	log.Debug("URL Encoded: ", url.QueryEscape(encodedString))

	// Return as base64
	return encodedString
}

func (hm HMACMiddleware) checkClockSkew(dateHeaderValue string) bool {
	// Reference layout for parsing time: "Mon Jan 2 15:04:05 MST 2006"

	refDate := "Mon, 02 Jan 2006 15:04:05 MST"

	tim, err := time.Parse(refDate, dateHeaderValue)

	if err != nil {
		log.Error("Date parsing failed")
		return false
	}

	inSec := tim.UnixNano()
	now := time.Now().UnixNano()

	diff := now - inSec

	in_ms := diff / 1000000
	if math.Abs(float64(in_ms)) > HMACClockSkewLimitInMs {
		log.Debug("Difference is: ", math.Abs(float64(in_ms)))
		return false
	}

	return true
}