diff --git a/Cargo.lock b/Cargo.lock index f4dc397d0..6187a83f1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -9402,9 +9402,11 @@ name = "rustfs-credentials" version = "1.0.0-beta.4" dependencies = [ "base64-simd", + "hmac 0.13.0", "rand 0.10.1", "serde", "serde_json", + "sha2 0.11.0", "time", ] @@ -9608,7 +9610,6 @@ dependencies = [ "moka", "openidconnect", "pollster", - "rand 0.10.1", "reqwest", "rustfs-config", "rustfs-credentials", diff --git a/crates/credentials/Cargo.toml b/crates/credentials/Cargo.toml index 25e38048b..dba336815 100644 --- a/crates/credentials/Cargo.toml +++ b/crates/credentials/Cargo.toml @@ -1,3 +1,17 @@ +# Copyright 2024 RustFS Team +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + [package] name = "rustfs-credentials" edition.workspace = true @@ -12,9 +26,11 @@ categories = ["web-programming", "development-tools", "data-structures", "securi [dependencies] base64-simd = { workspace = true } +hmac = { workspace = true } rand = { workspace = true } serde = { workspace = true } serde_json.workspace = true +sha2 = { workspace = true } time = { workspace = true, features = ["serde", "parsing", "formatting", "macros"] } [lints] diff --git a/crates/credentials/src/credentials.rs b/crates/credentials/src/credentials.rs index 505b80864..db1069f95 100644 --- a/crates/credentials/src/credentials.rs +++ b/crates/credentials/src/credentials.rs @@ -12,10 +12,13 @@ // See the License for the specific language governing permissions and // limitations under the License. -use crate::{DEFAULT_SECRET_KEY, ENV_RPC_SECRET, IAM_POLICY_CLAIM_NAME_SA, INHERITED_POLICY_TYPE}; +use crate::{DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY, ENV_RPC_SECRET, IAM_POLICY_CLAIM_NAME_SA, INHERITED_POLICY_TYPE}; +use base64_simd::URL_SAFE_NO_PAD; +use hmac::{Hmac, KeyInit, Mac}; use rand::{Rng, RngExt}; use serde::{Deserialize, Serialize}; use serde_json::Value; +use sha2::Sha256; use std::collections::HashMap; use std::env; use std::fmt; @@ -33,7 +36,12 @@ pub static GLOBAL_RUSTFS_RPC_SECRET: OnceLock = OnceLock::new(); pub const RPC_SECRET_REQUIRED_MESSAGE: &str = "RPC authentication secret is not configured"; /// Operator-facing guidance for configuring RPC authentication safely. -pub const RPC_SECRET_REQUIRED_OPERATOR_MESSAGE: &str = "RUSTFS_RPC_SECRET must be set to a non-default value or RUSTFS_SECRET_KEY must be changed from the default for RPC authentication"; +pub const RPC_SECRET_REQUIRED_OPERATOR_MESSAGE: &str = + "RUSTFS_RPC_SECRET can be set explicitly; otherwise the RPC secret is derived from the active access/secret key pair"; + +type HmacSha256 = Hmac; + +const RPC_SECRET_DERIVATION_CONTEXT: &[u8] = b"rustfs-rpc-secret:v1"; /// Error type for credentials operations #[derive(Debug)] @@ -217,37 +225,59 @@ pub fn gen_secret_key(length: usize) -> std::io::Result { Ok(encoded) } -/// Get the RPC authentication token from environment variable +/// Get the RPC authentication token from the environment or derive it from the active credentials. /// /// # Returns /// * `String` - The RPC authentication token /// -fn resolve_rpc_secret(env_secret: Option<&str>, global_secret: Option<&str>) -> Option { - if let Some(secret) = env_secret.map(str::trim).filter(|secret| !secret.is_empty()) { - return (secret != DEFAULT_SECRET_KEY).then(|| secret.to_string()); +fn normalize_rpc_secret(secret: &str) -> Option { + let secret = secret.trim(); + (!secret.is_empty() && secret != DEFAULT_SECRET_KEY && secret != DEFAULT_ACCESS_KEY).then(|| secret.to_string()) +} + +fn derive_rpc_secret(access_key: &str, secret_key: &str) -> Option { + let access_key = access_key.trim(); + let secret_key = secret_key.trim(); + + if access_key.is_empty() || secret_key.is_empty() { + return None; } - global_secret - .map(str::trim) - .filter(|secret| !secret.is_empty() && *secret != DEFAULT_SECRET_KEY) - .map(ToOwned::to_owned) + let mut mac = ::new_from_slice(secret_key.as_bytes()).expect("HMAC can take key of any size"); + mac.update(RPC_SECRET_DERIVATION_CONTEXT); + mac.update(&[0]); + mac.update(access_key.as_bytes()); + + Some(URL_SAFE_NO_PAD.encode_to_string(mac.finalize().into_bytes())) +} + +fn resolve_rpc_secret(env_secret: Option<&str>, global_access: Option<&str>, global_secret: Option<&str>) -> Option { + if let Some(secret) = env_secret.map(str::trim).filter(|secret| !secret.is_empty()) { + return normalize_rpc_secret(secret); + } + + match (global_access, global_secret) { + (Some(access_key), Some(secret_key)) => derive_rpc_secret(access_key, secret_key), + _ => None, + } } pub fn try_get_rpc_token() -> std::io::Result { if let Some(secret) = GLOBAL_RUSTFS_RPC_SECRET.get() { - return resolve_rpc_secret(None, Some(secret)).ok_or_else(|| Error::other(RPC_SECRET_REQUIRED_MESSAGE)); + return normalize_rpc_secret(secret).ok_or_else(|| Error::other(RPC_SECRET_REQUIRED_MESSAGE)); } let env_secret = env::var(ENV_RPC_SECRET).ok(); + let global_access = get_global_access_key_opt(); let global_secret = get_global_secret_key_opt(); - let secret = resolve_rpc_secret(env_secret.as_deref(), global_secret.as_deref()) + let secret = resolve_rpc_secret(env_secret.as_deref(), global_access.as_deref(), global_secret.as_deref()) .ok_or_else(|| Error::other(RPC_SECRET_REQUIRED_MESSAGE))?; match GLOBAL_RUSTFS_RPC_SECRET.set(secret.clone()) { Ok(()) => Ok(secret), Err(_) => GLOBAL_RUSTFS_RPC_SECRET .get() - .and_then(|stored| resolve_rpc_secret(None, Some(stored))) + .and_then(|stored| normalize_rpc_secret(stored)) .ok_or_else(|| Error::other(RPC_SECRET_REQUIRED_MESSAGE)), } } @@ -407,7 +437,7 @@ impl Credentials { #[cfg(test)] mod tests { use super::*; - use crate::{IAM_POLICY_CLAIM_NAME_SA, INHERITED_POLICY_TYPE}; + use crate::{DEFAULT_ACCESS_KEY, IAM_POLICY_CLAIM_NAME_SA, INHERITED_POLICY_TYPE}; use time::Duration; #[test] @@ -510,11 +540,12 @@ mod tests { // If it hasn't already been initialized, the test automatically generates logic if get_global_action_cred().is_none() { init_global_action_credentials(None, None).ok(); - let ak = get_global_access_key(); - let sk = get_global_secret_key(); - assert_eq!(ak.len(), 20); - assert_eq!(sk.len(), 32); } + + let ak = get_global_access_key(); + let sk = get_global_secret_key(); + assert!(ak.len() >= 3); + assert!(sk.len() >= 8); } #[test] @@ -528,10 +559,26 @@ mod tests { } #[test] - fn test_resolve_rpc_secret_rejects_default_fallback() { - assert!(resolve_rpc_secret(None, None).is_none()); - assert!(resolve_rpc_secret(None, Some(DEFAULT_SECRET_KEY)).is_none()); - assert!(resolve_rpc_secret(Some(DEFAULT_SECRET_KEY), Some("custom-global-secret")).is_none()); + fn test_gen_access_key_length_and_charset() { + let err = gen_access_key(2).expect_err("length below 3 should fail"); + assert_eq!(err.to_string(), "access key length is too short"); + + let key = gen_access_key(20).expect("access key should generate"); + assert_eq!(key.len(), 20); + assert!(key.chars().all(|ch| ch.is_ascii_uppercase() || ch.is_ascii_digit())); + } + + #[test] + fn test_resolve_rpc_secret_allows_default_credentials_for_derivation() { + assert!(resolve_rpc_secret(None, None, None).is_none()); + + let expected = derive_rpc_secret(DEFAULT_ACCESS_KEY, DEFAULT_SECRET_KEY).expect("secret should derive"); + assert_eq!( + resolve_rpc_secret(None, Some(DEFAULT_ACCESS_KEY), Some(DEFAULT_SECRET_KEY)).as_deref(), + Some(expected.as_str()) + ); + + assert!(resolve_rpc_secret(Some(DEFAULT_SECRET_KEY), Some("custom-access"), Some("custom-global-secret")).is_none()); } #[test] @@ -551,37 +598,64 @@ mod tests { #[test] fn test_resolve_rpc_secret_accepts_non_default_secret() { - assert_eq!(resolve_rpc_secret(Some("custom-rpc-secret"), None).as_deref(), Some("custom-rpc-secret")); assert_eq!( - resolve_rpc_secret(None, Some("custom-global-secret")).as_deref(), - Some("custom-global-secret") + resolve_rpc_secret(Some("custom-rpc-secret"), None, None).as_deref(), + Some("custom-rpc-secret") + ); + let expected = derive_rpc_secret("custom-access", "custom-global-secret").expect("secret should derive"); + assert_eq!( + resolve_rpc_secret(None, Some("custom-access"), Some("custom-global-secret")).as_deref(), + Some(expected.as_str()) ); } #[test] fn test_resolve_rpc_secret_trims_and_falls_back_from_blank_env() { + let expected = derive_rpc_secret("custom-access", "custom-global-secret").expect("secret should derive"); assert_eq!( - resolve_rpc_secret(Some(" custom-rpc-secret "), None).as_deref(), + resolve_rpc_secret(Some(" custom-rpc-secret "), None, None).as_deref(), Some("custom-rpc-secret") ); assert_eq!( - resolve_rpc_secret(Some(""), Some("custom-global-secret")).as_deref(), - Some("custom-global-secret") + resolve_rpc_secret(Some(""), Some("custom-access"), Some("custom-global-secret")).as_deref(), + Some(expected.as_str()) ); assert_eq!( - resolve_rpc_secret(Some(" "), Some(" custom-global-secret ")).as_deref(), - Some("custom-global-secret") + resolve_rpc_secret(Some(" "), Some(" custom-access "), Some(" custom-global-secret ")).as_deref(), + Some(expected.as_str()) ); assert_eq!( - resolve_rpc_secret(Some(" "), Some("custom-global-secret")).as_deref(), - Some("custom-global-secret") + resolve_rpc_secret(Some(" "), Some("custom-access"), Some("custom-global-secret")).as_deref(), + Some(expected.as_str()) ); } #[test] fn test_resolve_rpc_secret_returns_none_for_trimmed_default_secret() { let padded_default_secret = format!(" {} ", DEFAULT_SECRET_KEY); - assert!(resolve_rpc_secret(Some(padded_default_secret.as_str()), Some("custom-global-secret")).is_none()); + assert!( + resolve_rpc_secret(Some(padded_default_secret.as_str()), Some("custom-access"), Some("custom-global-secret")) + .is_none() + ); + + let padded_default_access = format!(" {} ", DEFAULT_ACCESS_KEY); + assert!( + resolve_rpc_secret(Some(padded_default_access.as_str()), Some("custom-access"), Some("custom-global-secret")) + .is_none() + ); + } + + #[test] + fn test_derive_rpc_secret_is_stable_and_not_plaintext() { + let first = derive_rpc_secret("custom-access", "custom-secret").expect("secret should derive"); + let second = derive_rpc_secret("custom-access", "custom-secret").expect("secret should derive"); + + assert_eq!(first, second); + assert_ne!(first, "custom-access"); + assert_ne!(first, "custom-secret"); + assert_ne!(first, format!("{}{}", "custom-access", "custom-secret")); + assert!(!first.contains("custom-access")); + assert!(!first.contains("custom-secret")); } #[test] diff --git a/crates/ecstore/src/rpc/http_auth.rs b/crates/ecstore/src/rpc/http_auth.rs index b11d9b1d0..a62bf029c 100644 --- a/crates/ecstore/src/rpc/http_auth.rs +++ b/crates/ecstore/src/rpc/http_auth.rs @@ -72,7 +72,7 @@ fn signature_payload(url: &str, method: &Method, timestamp: i64) -> String { /// Generate HMAC-SHA256 signature for the given data fn generate_signature(secret: &str, url: &str, method: &Method, timestamp: i64) -> String { let data = signature_payload(url, method, timestamp); - let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).expect("HMAC can take key of any size"); + let mut mac = ::new_from_slice(secret.as_bytes()).expect("HMAC can take key of any size"); mac.update(data.as_bytes()); let result = mac.finalize(); general_purpose::STANDARD.encode(result.into_bytes()) @@ -84,7 +84,7 @@ fn verify_signature(secret: &str, url: &str, method: &Method, timestamp: i64, si }; let data = signature_payload(url, method, timestamp); - let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).expect("HMAC can take key of any size"); + let mut mac = ::new_from_slice(secret.as_bytes()).expect("HMAC can take key of any size"); mac.update(data.as_bytes()); mac.verify_slice(&signature).is_ok() } diff --git a/crates/iam/Cargo.toml b/crates/iam/Cargo.toml index b9c2d7482..0c106d84e 100644 --- a/crates/iam/Cargo.toml +++ b/crates/iam/Cargo.toml @@ -42,7 +42,6 @@ thiserror.workspace = true arc-swap = { workspace = true } rustfs-crypto = { workspace = true } futures.workspace = true -rand.workspace = true base64-simd = { workspace = true } jsonwebtoken = { workspace = true } tracing.workspace = true diff --git a/crates/iam/src/utils.rs b/crates/iam/src/utils.rs index ff9fd6875..ee421663a 100644 --- a/crates/iam/src/utils.rs +++ b/crates/iam/src/utils.rs @@ -13,75 +13,8 @@ // limitations under the License. use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header}; -use rand::{Rng, RngExt}; use serde::{Serialize, de::DeserializeOwned}; use std::collections::HashSet; -use std::io::{Error, Result}; - -/// Generates a random access key of the specified length. -/// -/// # Arguments -/// -/// * `length` - The length of the access key to be generated. -/// -/// # Returns -/// -/// * `Result` - A result containing the generated access key or an error if the length is invalid. -/// -/// # Errors -/// -/// * Returns an error if the length is less than 3. -/// -pub fn gen_access_key(length: usize) -> Result { - const ALPHA_NUMERIC_TABLE: [char; 36] = [ - '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', - 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', - ]; - - if length < 3 { - return Err(Error::other("access key length is too short")); - } - - let mut result = String::with_capacity(length); - let mut rng = rand::rng(); - - for _ in 0..length { - result.push(ALPHA_NUMERIC_TABLE[rng.random_range(0..ALPHA_NUMERIC_TABLE.len())]); - } - - Ok(result) -} - -/// Generates a random secret key of the specified length. -/// -/// # Arguments -/// -/// * `length` - The length of the secret key to be generated. -/// -/// # Returns -/// -/// * `Result` - A result containing the generated secret key or an error if the length is invalid. -/// -/// # Errors -/// -/// * Returns an error if the length is less than 8. -/// -pub fn gen_secret_key(length: usize) -> Result { - use base64_simd::URL_SAFE_NO_PAD; - - if length < 8 { - return Err(Error::other("secret key length is too short")); - } - let mut rng = rand::rng(); - - let mut key = vec![0u8; URL_SAFE_NO_PAD.estimated_decoded_length(length)]; - rng.fill_bytes(&mut key); - - let encoded = URL_SAFE_NO_PAD.encode_to_string(&key); - let key_str = encoded.replace("/", "+"); - - Ok(key_str) -} pub fn generate_jwt(claims: &T, secret: &str) -> std::result::Result { let header = Header::new(Algorithm::HS512); @@ -111,99 +44,9 @@ pub fn extract_claims_allow_missing_exp( #[cfg(test)] mod tests { - use super::{extract_claims, gen_access_key, gen_secret_key, generate_jwt}; + use super::{extract_claims, generate_jwt}; use serde::{Deserialize, Serialize}; - #[test] - fn test_gen_access_key_valid_length() { - // Test valid access key generation - let key = gen_access_key(10).unwrap(); - assert_eq!(key.len(), 10); - - // Test different lengths - let key_20 = gen_access_key(20).unwrap(); - assert_eq!(key_20.len(), 20); - - let key_3 = gen_access_key(3).unwrap(); - assert_eq!(key_3.len(), 3); - } - - #[test] - fn test_gen_access_key_uniqueness() { - // Test that generated keys are unique - let key1 = gen_access_key(16).unwrap(); - let key2 = gen_access_key(16).unwrap(); - assert_ne!(key1, key2, "Generated access keys should be unique"); - } - - #[test] - fn test_gen_access_key_character_set() { - // Test that generated keys only contain valid characters - let key = gen_access_key(100).unwrap(); - for ch in key.chars() { - assert!(ch.is_ascii_alphanumeric(), "Access key should only contain alphanumeric characters"); - assert!( - ch.is_ascii_uppercase() || ch.is_ascii_digit(), - "Access key should only contain uppercase letters and digits" - ); - } - } - - #[test] - fn test_gen_access_key_invalid_length() { - // Test error cases for invalid lengths - assert!(gen_access_key(0).is_err(), "Should fail for length 0"); - assert!(gen_access_key(1).is_err(), "Should fail for length 1"); - assert!(gen_access_key(2).is_err(), "Should fail for length 2"); - - // Verify error message - let error = gen_access_key(2).unwrap_err(); - assert_eq!(error.to_string(), "access key length is too short"); - } - - #[test] - fn test_gen_secret_key_valid_length() { - // Test valid secret key generation - let key = gen_secret_key(10).unwrap(); - assert!(!key.is_empty(), "Secret key should not be empty"); - - let key_20 = gen_secret_key(20).unwrap(); - assert!(!key_20.is_empty(), "Secret key should not be empty"); - } - - #[test] - fn test_gen_secret_key_uniqueness() { - // Test that generated secret keys are unique - let key1 = gen_secret_key(16).unwrap(); - let key2 = gen_secret_key(16).unwrap(); - assert_ne!(key1, key2, "Generated secret keys should be unique"); - } - - #[test] - fn test_gen_secret_key_base64_format() { - // Test that secret key is valid base64-like format - let key = gen_secret_key(32).unwrap(); - - // Should not contain invalid characters for URL-safe base64 - for ch in key.chars() { - assert!( - ch.is_ascii_alphanumeric() || ch == '+' || ch == '-' || ch == '_', - "Secret key should be URL-safe base64 compatible" - ); - } - } - - #[test] - fn test_gen_secret_key_invalid_length() { - // Test error cases for invalid lengths - assert!(gen_secret_key(0).is_err(), "Should fail for length 0"); - assert!(gen_secret_key(7).is_err(), "Should fail for length 7"); - - // Verify error message - let error = gen_secret_key(5).unwrap_err(); - assert_eq!(error.to_string(), "secret key length is too short"); - } - #[derive(Debug, Serialize, Deserialize, PartialEq, Clone)] struct Claims { sub: String, @@ -370,26 +213,4 @@ mod tests { assert_eq!(decoded.claims, special_claims); } - - #[test] - fn test_access_key_length_boundaries() { - // Test boundary conditions for access key length - assert!(gen_access_key(3).is_ok(), "Length 3 should be valid (minimum)"); - assert!(gen_access_key(1000).is_ok(), "Large length should be valid"); - - // Test that minimum length is enforced - let min_key = gen_access_key(3).unwrap(); - assert_eq!(min_key.len(), 3); - } - - #[test] - fn test_secret_key_length_boundaries() { - // Test boundary conditions for secret key length - assert!(gen_secret_key(8).is_ok(), "Length 8 should be valid (minimum)"); - assert!(gen_secret_key(1000).is_ok(), "Large length should be valid"); - - // Test that minimum length is enforced - let result = gen_secret_key(8); - assert!(result.is_ok(), "Minimum valid length should work"); - } }