feat: rpc auth

ecstore/src/disk/remote.rs

@@ -16,6 +16,10 @@ use protos::{
 use rustfs_filemeta::{FileInfo, RawFileInfo};
 use rustfs_rio::{HttpReader, HttpWriter};
 
+use base64::{Engine as _, engine::general_purpose};
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+use std::time::{SystemTime, UNIX_EPOCH};
 use tokio::{
     io::AsyncWrite,
     sync::mpsc::{self, Sender},
@@ -43,6 +47,8 @@ use crate::{
 
 use protos::proto_gen::node_service::RenamePartRequest;
 
+type HmacSha256 = Hmac<Sha256>;
+
 #[derive(Debug)]
 pub struct RemoteDisk {
     pub id: Mutex<Option<Uuid>>,
@@ -69,6 +75,35 @@ impl RemoteDisk {
             endpoint: ep.clone(),
         })
     }
+
+    /// Get the shared secret for HMAC signing
+    fn get_shared_secret() -> String {
+        std::env::var("RUSTFS_RPC_SECRET").unwrap_or_else(|_| "rustfs-default-secret".to_string())
+    }
+
+    /// Generate HMAC-SHA256 signature for the given data
+    fn generate_signature(secret: &str, url: &str, method: &str, timestamp: u64) -> String {
+        let data = format!("{}|{}|{}", url, method, timestamp);
+        let mut mac = HmacSha256::new_from_slice(secret.as_bytes()).expect("HMAC can take key of any size");
+        mac.update(data.as_bytes());
+        let result = mac.finalize();
+        general_purpose::STANDARD.encode(result.into_bytes())
+    }
+
+    /// Build headers with authentication signature
+    fn build_auth_headers(&self, url: &str, method: &Method, base_headers: Option<HeaderMap>) -> HeaderMap {
+        let mut headers = base_headers.unwrap_or_default();
+
+        let secret = Self::get_shared_secret();
+        let timestamp = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs();
+
+        let signature = Self::generate_signature(&secret, url, method.as_str(), timestamp);
+
+        headers.insert("x-rustfs-signature", HeaderValue::from_str(&signature).unwrap());
+        headers.insert("x-rustfs-timestamp", HeaderValue::from_str(&timestamp.to_string()).unwrap());
+
+        headers
+    }
 }
 
 // TODO: all api need to handle errors
@@ -579,8 +614,9 @@ impl DiskAPI for RemoteDisk {
 
         let opts = serde_json::to_vec(&opts)?;
 
-        let mut headers = HeaderMap::new();
-        headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        let mut base_headers = HeaderMap::new();
+        base_headers.insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+        let headers = self.build_auth_headers(&url, &Method::GET, Some(base_headers));
 
         let mut reader = HttpReader::new(url, Method::GET, headers, Some(opts)).await?;
 
@@ -603,7 +639,8 @@ impl DiskAPI for RemoteDisk {
             0
         );
 
-        Ok(Box::new(HttpReader::new(url, Method::GET, HeaderMap::new(), None).await?))
+        let headers = self.build_auth_headers(&url, &Method::GET, None);
+        Ok(Box::new(HttpReader::new(url, Method::GET, headers, None).await?))
     }
 
     #[tracing::instrument(level = "debug", skip(self))]
@@ -626,7 +663,8 @@ impl DiskAPI for RemoteDisk {
             length
         );
 
-        Ok(Box::new(HttpReader::new(url, Method::GET, HeaderMap::new(), None).await?))
+        let headers = self.build_auth_headers(&url, &Method::GET, None);
+        Ok(Box::new(HttpReader::new(url, Method::GET, headers, None).await?))
     }
 
     #[tracing::instrument(level = "debug", skip(self))]
@@ -643,7 +681,8 @@ impl DiskAPI for RemoteDisk {
             0
         );
 
-        Ok(Box::new(HttpWriter::new(url, Method::PUT, HeaderMap::new()).await?))
+        let headers = self.build_auth_headers(&url, &Method::PUT, None);
+        Ok(Box::new(HttpWriter::new(url, Method::PUT, headers).await?))
     }
 
     #[tracing::instrument(level = "debug", skip(self))]
@@ -666,7 +705,8 @@ impl DiskAPI for RemoteDisk {
             file_size
         );
 
-        Ok(Box::new(HttpWriter::new(url, Method::PUT, HeaderMap::new()).await?))
+        let headers = self.build_auth_headers(&url, &Method::PUT, None);
+        Ok(Box::new(HttpWriter::new(url, Method::PUT, headers).await?))
     }
 
     #[tracing::instrument(level = "debug", skip(self))]