2017-05-23 18:56:10 +00:00
|
|
|
package security
|
|
|
|
|
|
|
|
import (
|
|
|
|
"github.com/portainer/portainer"
|
|
|
|
httperror "github.com/portainer/portainer/http/error"
|
|
|
|
|
|
|
|
"net/http"
|
|
|
|
"strings"
|
|
|
|
)
|
|
|
|
|
|
|
|
type (
|
|
|
|
// RequestBouncer represents an entity that manages API request accesses
|
|
|
|
RequestBouncer struct {
|
|
|
|
jwtService portainer.JWTService
|
2018-02-28 07:09:51 +00:00
|
|
|
userService portainer.UserService
|
2017-05-23 18:56:10 +00:00
|
|
|
teamMembershipService portainer.TeamMembershipService
|
2018-06-18 09:56:31 +00:00
|
|
|
endpointGroupService portainer.EndpointGroupService
|
2017-05-23 18:56:10 +00:00
|
|
|
authDisabled bool
|
|
|
|
}
|
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
// RequestBouncerParams represents the required parameters to create a new RequestBouncer instance.
|
|
|
|
RequestBouncerParams struct {
|
|
|
|
JWTService portainer.JWTService
|
|
|
|
UserService portainer.UserService
|
|
|
|
TeamMembershipService portainer.TeamMembershipService
|
|
|
|
EndpointGroupService portainer.EndpointGroupService
|
|
|
|
AuthDisabled bool
|
|
|
|
}
|
|
|
|
|
2017-05-23 18:56:10 +00:00
|
|
|
// RestrictedRequestContext is a data structure containing information
|
|
|
|
// used in RestrictedAccess
|
|
|
|
RestrictedRequestContext struct {
|
|
|
|
IsAdmin bool
|
|
|
|
IsTeamLeader bool
|
|
|
|
UserID portainer.UserID
|
|
|
|
UserMemberships []portainer.TeamMembership
|
|
|
|
}
|
|
|
|
)
|
|
|
|
|
|
|
|
// NewRequestBouncer initializes a new RequestBouncer
|
2018-06-18 09:56:31 +00:00
|
|
|
func NewRequestBouncer(parameters *RequestBouncerParams) *RequestBouncer {
|
2017-05-23 18:56:10 +00:00
|
|
|
return &RequestBouncer{
|
2018-06-18 09:56:31 +00:00
|
|
|
jwtService: parameters.JWTService,
|
|
|
|
userService: parameters.UserService,
|
|
|
|
teamMembershipService: parameters.TeamMembershipService,
|
|
|
|
endpointGroupService: parameters.EndpointGroupService,
|
|
|
|
authDisabled: parameters.AuthDisabled,
|
2017-05-23 18:56:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// PublicAccess defines a security check for public endpoints.
|
|
|
|
// No authentication is required to access these endpoints.
|
|
|
|
func (bouncer *RequestBouncer) PublicAccess(h http.Handler) http.Handler {
|
|
|
|
h = mwSecureHeaders(h)
|
|
|
|
return h
|
|
|
|
}
|
|
|
|
|
|
|
|
// AuthenticatedAccess defines a security check for private endpoints.
|
|
|
|
// Authentication is required to access these endpoints.
|
|
|
|
func (bouncer *RequestBouncer) AuthenticatedAccess(h http.Handler) http.Handler {
|
|
|
|
h = bouncer.mwCheckAuthentication(h)
|
|
|
|
h = mwSecureHeaders(h)
|
|
|
|
return h
|
|
|
|
}
|
|
|
|
|
2017-08-13 14:45:55 +00:00
|
|
|
// RestrictedAccess defines a security check for restricted endpoints.
|
2017-05-23 18:56:10 +00:00
|
|
|
// Authentication is required to access these endpoints.
|
|
|
|
// The request context will be enhanced with a RestrictedRequestContext object
|
|
|
|
// that might be used later to authorize/filter access to resources.
|
|
|
|
func (bouncer *RequestBouncer) RestrictedAccess(h http.Handler) http.Handler {
|
|
|
|
h = bouncer.mwUpgradeToRestrictedRequest(h)
|
|
|
|
h = bouncer.AuthenticatedAccess(h)
|
|
|
|
return h
|
|
|
|
}
|
|
|
|
|
|
|
|
// AdministratorAccess defines a chain of middleware for restricted endpoints.
|
|
|
|
// Authentication as well as administrator role are required to access these endpoints.
|
|
|
|
func (bouncer *RequestBouncer) AdministratorAccess(h http.Handler) http.Handler {
|
|
|
|
h = mwCheckAdministratorRole(h)
|
|
|
|
h = bouncer.AuthenticatedAccess(h)
|
|
|
|
return h
|
|
|
|
}
|
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
// EndpointAccess retrieves the JWT token from the request context and verifies
|
|
|
|
// that the user can access the specified endpoint.
|
|
|
|
// An error is returned when access is denied.
|
|
|
|
func (bouncer *RequestBouncer) EndpointAccess(r *http.Request, endpoint *portainer.Endpoint) error {
|
|
|
|
tokenData, err := RetrieveTokenData(r)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if tokenData.Role == portainer.AdministratorRole {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(tokenData.ID)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
group, err := bouncer.endpointGroupService.EndpointGroup(endpoint.GroupID)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if !authorizedEndpointAccess(endpoint, group, tokenData.ID, memberships) {
|
|
|
|
return portainer.ErrEndpointAccessDenied
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2017-05-23 18:56:10 +00:00
|
|
|
// mwSecureHeaders provides secure headers middleware for handlers.
|
|
|
|
func mwSecureHeaders(next http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
w.Header().Add("X-Frame-Options", "DENY")
|
2018-08-23 15:10:18 +00:00
|
|
|
w.Header().Add("X-XSS-Protection", "1; mode=block")
|
|
|
|
w.Header().Add("X-Content-Type-Options", "nosniff")
|
2017-05-23 18:56:10 +00:00
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// mwUpgradeToRestrictedRequest will enhance the current request with
|
|
|
|
// a new RestrictedRequestContext object.
|
|
|
|
func (bouncer *RequestBouncer) mwUpgradeToRestrictedRequest(next http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
tokenData, err := RetrieveTokenData(r)
|
|
|
|
if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusForbidden, "Access denied", portainer.ErrResourceAccessDenied)
|
2017-05-23 18:56:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
requestContext, err := bouncer.newRestrictedContextRequest(tokenData.ID, tokenData.Role)
|
|
|
|
if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusInternalServerError, "Unable to create restricted request context ", err)
|
2017-05-23 18:56:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx := storeRestrictedRequestContext(r, requestContext)
|
|
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// mwCheckAdministratorRole check the role of the user associated to the request
|
|
|
|
func mwCheckAdministratorRole(next http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
tokenData, err := RetrieveTokenData(r)
|
|
|
|
if err != nil || tokenData.Role != portainer.AdministratorRole {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusForbidden, "Access denied", portainer.ErrResourceAccessDenied)
|
2017-05-23 18:56:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// mwCheckAuthentication provides Authentication middleware for handlers
|
|
|
|
func (bouncer *RequestBouncer) mwCheckAuthentication(next http.Handler) http.Handler {
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
var tokenData *portainer.TokenData
|
|
|
|
if !bouncer.authDisabled {
|
|
|
|
var token string
|
|
|
|
|
2018-06-18 09:56:31 +00:00
|
|
|
// Optionally, token might be set via the "token" query parameter.
|
|
|
|
// For example, in websocket requests
|
|
|
|
token = r.URL.Query().Get("token")
|
|
|
|
|
2017-05-23 18:56:10 +00:00
|
|
|
// Get token from the Authorization header
|
|
|
|
tokens, ok := r.Header["Authorization"]
|
|
|
|
if ok && len(tokens) >= 1 {
|
|
|
|
token = tokens[0]
|
|
|
|
token = strings.TrimPrefix(token, "Bearer ")
|
|
|
|
}
|
|
|
|
|
|
|
|
if token == "" {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusUnauthorized, "Unauthorized", portainer.ErrUnauthorized)
|
2017-05-23 18:56:10 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
var err error
|
|
|
|
tokenData, err = bouncer.jwtService.ParseAndVerifyToken(token)
|
|
|
|
if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusUnauthorized, "Invalid JWT token", err)
|
2017-05-23 18:56:10 +00:00
|
|
|
return
|
|
|
|
}
|
2018-02-28 07:09:51 +00:00
|
|
|
|
|
|
|
_, err = bouncer.userService.User(tokenData.ID)
|
2018-06-19 11:15:10 +00:00
|
|
|
if err != nil && err == portainer.ErrObjectNotFound {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusUnauthorized, "Unauthorized", portainer.ErrUnauthorized)
|
2018-02-28 07:09:51 +00:00
|
|
|
return
|
|
|
|
} else if err != nil {
|
2018-06-11 13:13:19 +00:00
|
|
|
httperror.WriteError(w, http.StatusInternalServerError, "Unable to retrieve users from the database", err)
|
2018-02-28 07:09:51 +00:00
|
|
|
return
|
|
|
|
}
|
2017-05-23 18:56:10 +00:00
|
|
|
} else {
|
|
|
|
tokenData = &portainer.TokenData{
|
|
|
|
Role: portainer.AdministratorRole,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
ctx := storeTokenData(r, tokenData)
|
|
|
|
next.ServeHTTP(w, r.WithContext(ctx))
|
|
|
|
return
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func (bouncer *RequestBouncer) newRestrictedContextRequest(userID portainer.UserID, userRole portainer.UserRole) (*RestrictedRequestContext, error) {
|
|
|
|
requestContext := &RestrictedRequestContext{
|
|
|
|
IsAdmin: true,
|
|
|
|
UserID: userID,
|
|
|
|
}
|
|
|
|
|
|
|
|
if userRole != portainer.AdministratorRole {
|
|
|
|
requestContext.IsAdmin = false
|
|
|
|
memberships, err := bouncer.teamMembershipService.TeamMembershipsByUserID(userID)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
isTeamLeader := false
|
|
|
|
for _, membership := range memberships {
|
|
|
|
if membership.Role == portainer.TeamLeader {
|
|
|
|
isTeamLeader = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
requestContext.IsTeamLeader = isTeamLeader
|
|
|
|
requestContext.UserMemberships = memberships
|
|
|
|
}
|
|
|
|
|
|
|
|
return requestContext, nil
|
|
|
|
}
|