74 lines
2.3 KiB
Go
74 lines
2.3 KiB
Go
package worker
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"google.golang.org/grpc/credentials"
|
|
"google.golang.org/grpc/peer"
|
|
|
|
"proxy-pool/internal/domain/workerruntime"
|
|
)
|
|
|
|
var ErrUnauthorizedIdentity = errors.New("control-plane identity is not authorized")
|
|
|
|
// AllowLoopbackIdentity is used only by the validated loopback plaintext mode.
|
|
// It deliberately does not inspect transport credentials because that mode has no TLS peer.
|
|
type AllowLoopbackIdentity struct{}
|
|
|
|
func (AllowLoopbackIdentity) Authorize(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
func (AllowLoopbackIdentity) AuthorizeChecker(context.Context, string) error {
|
|
return nil
|
|
}
|
|
|
|
type SPIFFEIdentityAuthorizer struct {
|
|
trustDomain string
|
|
environment string
|
|
}
|
|
|
|
func NewSPIFFEIdentityAuthorizer(trustDomain, environment string) (*SPIFFEIdentityAuthorizer, error) {
|
|
if strings.TrimSpace(trustDomain) == "" || strings.TrimSpace(environment) == "" {
|
|
return nil, fmt.Errorf("spiffe identity authorizer: trust domain and environment are required")
|
|
}
|
|
return &SPIFFEIdentityAuthorizer{trustDomain: trustDomain, environment: environment}, nil
|
|
}
|
|
|
|
func (authorizer *SPIFFEIdentityAuthorizer) Authorize(ctx context.Context, workerID string) error {
|
|
return authorizer.authorize(ctx, "worker", workerID)
|
|
}
|
|
|
|
func (authorizer *SPIFFEIdentityAuthorizer) AuthorizeChecker(ctx context.Context, checkerID string) error {
|
|
return authorizer.authorize(ctx, "checker", checkerID)
|
|
}
|
|
|
|
func (authorizer *SPIFFEIdentityAuthorizer) authorize(ctx context.Context, resourceType, resourceID string) error {
|
|
if authorizer == nil || (resourceType != "worker" && resourceType != "checker") || resourceID == "" {
|
|
return ErrUnauthorizedIdentity
|
|
}
|
|
peerInfo, ok := peer.FromContext(ctx)
|
|
if !ok || peerInfo.AuthInfo == nil {
|
|
return ErrUnauthorizedIdentity
|
|
}
|
|
tlsInfo, ok := peerInfo.AuthInfo.(credentials.TLSInfo)
|
|
if !ok || len(tlsInfo.State.VerifiedChains) == 0 {
|
|
return ErrUnauthorizedIdentity
|
|
}
|
|
|
|
chain := tlsInfo.State.VerifiedChains[0]
|
|
if len(chain) == 0 || chain[0] == nil {
|
|
return ErrUnauthorizedIdentity
|
|
}
|
|
identity, matches := workerruntime.SingleSPIFFEIdentity(
|
|
chain[0].URIs, authorizer.trustDomain, authorizer.environment, resourceType,
|
|
)
|
|
if !matches || identity != resourceID {
|
|
return ErrUnauthorizedIdentity
|
|
}
|
|
return nil
|
|
}
|