authn.rs 97.6%

41 of 42 lines run, 2 of 6 functions · run #34 on main · run missed

//! Authenticating a request (spec §8.5): a signature by a known key over the
//! method, the body, a time within five minutes and a nonce not seen in
//! that window, from a key the owner delegates to now, and, when the agent
//! is bound to a Unix user, from that user. What it returns becomes the
//! `auth` of every event the request causes.

use crate::event::{Auth, Method};
use crate::principals::{Principal, Principals};
use crate::proof::{Proof, WINDOW_MS};
use std::collections::HashMap;
use std::sync::Mutex;

/// Why a request was refused.
#[derive(Debug, PartialEq, Eq, thiserror::Error)]
pub enum Refusal {
    #[error("the request is not signed")]
    Unsigned,
    #[error("the signature is for {0}, not this request")]
    WrongMethod(String),
    #[error("the request's time is {0} s from the server's: check the clock")]
    Stale(i64),
    #[error("the request's nonce was used before: a replay")]
    Replay,
    #[error("{0}")]
    NotAPrincipal(String),
    #[error("{0}")]
    BadSignature(String),
    /// The key is bound to another Unix user (logged as `guard.impersonation`).
    #[error("agent {agent}'s key is bound to uid {bound}, used from uid {from}")]
    WrongUid { agent: String, bound: u32, from: u32 },
    /// The key is bound to a Unix user but came over TCP, where there is no
    /// peer uid to check (spec §8.6; logged as `guard.impersonation`).
    #[error("agent {agent}'s key is bound to uid {bound} and must come over the Unix socket, not the network")]
    BoundOverNetwork { agent: String, bound: u32 },
}

/// The outcome: who, and the `auth` for their events.
#[derive(Clone, Debug)]
pub struct Caller {
    pub principal: Principal,
    pub auth: Auth,
    /// The agent asked for its uid to be learnt and has none yet: the
    /// caller records `agent.uid_bound` with this uid.
    pub learn_uid: Option<u32>,
}

/// Remembers nonces for the window.
#[derive(Debug, Default)]
pub struct Authenticator {
    nonces: Mutex<HashMap<[u8; 16], u64>>,
}

impl Authenticator {
    pub fn authenticate(
        &self,
        principals: &Principals,
        proof: Option<&Proof>,
        method: &str,
        body: &[u8],
        now_ms: u64,
        peer_uid: Option<u32>,
    ) -> Result<Caller, Refusal> {
        let proof = proof.ok_or(Refusal::Unsigned)?;
        if proof.method != method {
            return Err(Refusal::WrongMethod(proof.method.clone()));
        }
        let skew = proof.time_ms as i64 - now_ms as i64;
        if skew.unsigned_abs() > WINDOW_MS {
            return Err(Refusal::Stale(skew / 1000));
        }
        let key = crate::identity::KeyId(proof.key());
        let principal = principals.principal(&key, now_ms).map_err(Refusal::NotAPrincipal)?;
        let identity = principals.identity(&key).ok_or_else(|| Refusal::NotAPrincipal("an unknown key".into()))?;
        proof.verify(identity, Some(body)).map_err(Refusal::BadSignature)?;
        let mut learn_uid = None;
        if let Principal::Agent { name, uid, learn_uid: learn, .. } = &principal {
            match (uid, peer_uid) {
                (Some(bound), Some(from)) if *bound != from => return Err(Refusal::WrongUid { agent: name.clone(), bound: *bound, from }),
                (Some(bound), None) => return Err(Refusal::BoundOverNetwork { agent: name.clone(), bound: *bound }),
                (None, Some(from)) if *learn => learn_uid = Some(from),
                _ => {}
            }
        }
        {
            let mut seen = self.nonces.lock().unwrap();
            seen.retain(|_, t| now_ms.saturating_sub(*t) <= 2 * WINDOW_MS);
            if seen.insert(proof.nonce, now_ms).is_some() {
                return Err(Refusal::Replay);
            }
        }
        Ok(Caller {
            principal,
            auth: Auth { key: Some(proof.key()), method: Method::Signature, assurance: 2, proof: Some(proof.encode()) },
            learn_uid,
        })
    }
}

1		//! Authenticating a request (spec §8.5): a signature by a known key over the
2		//! method, the body, a time within five minutes and a nonce not seen in
3		//! that window, from a key the owner delegates to now, and, when the agent
4		//! is bound to a Unix user, from that user. What it returns becomes the
5		//! `auth` of every event the request causes.
6
7		use crate::event::{Auth, Method};
8		use crate::principals::{Principal, Principals};
9		use crate::proof::{Proof, WINDOW_MS};
10		use std::collections::HashMap;
11		use std::sync::Mutex;
12
13		/// Why a request was refused.
14		#[derive(Debug, PartialEq, Eq, thiserror::Error)]
15		pub enum Refusal {
16		#[error("the request is not signed")]
17		Unsigned,
18		#[error("the signature is for {0}, not this request")]
19		WrongMethod(String),
20		#[error("the request's time is {0} s from the server's: check the clock")]
21		Stale(i64),
22		#[error("the request's nonce was used before: a replay")]
23		Replay,
24		#[error("{0}")]
25		NotAPrincipal(String),
26		#[error("{0}")]
27		BadSignature(String),
28		/// The key is bound to another Unix user (logged as `guard.impersonation`).
29		#[error("agent {agent}'s key is bound to uid {bound}, used from uid {from}")]
30		WrongUid { agent: String, bound: u32, from: u32 },
31		/// The key is bound to a Unix user but came over TCP, where there is no
32		/// peer uid to check (spec §8.6; logged as `guard.impersonation`).
33		#[error("agent {agent}'s key is bound to uid {bound} and must come over the Unix socket, not the network")]
34		BoundOverNetwork { agent: String, bound: u32 },
35		}
36
37		/// The outcome: who, and the `auth` for their events.
38		#[derive(Clone, Debug)]
39		pub struct Caller {
40		pub principal: Principal,
41		pub auth: Auth,
42		/// The agent asked for its uid to be learnt and has none yet: the
43		/// caller records `agent.uid_bound` with this uid.
44		pub learn_uid: Option<u32>,
45		}
46
47		/// Remembers nonces for the window.
48		#[derive(Debug, Default)]
49		pub struct Authenticator {
50		nonces: Mutex<HashMap<[u8; 16], u64>>,
51		}
52
53		impl Authenticator {
54	156×	pub fn authenticate(
55	156×	&self,
56	156×	principals: &Principals,
57	156×	proof: Option<&Proof>,
58	156×	method: &str,
59	156×	body: &[u8],
60	156×	now_ms: u64,
61	156×	peer_uid: Option<u32>,
62	156×	) -> Result<Caller, Refusal> {
63	156×	let proof = proof.ok_or(Refusal::Unsigned)?;
64	153×	if proof.method != method {
65	1×	return Err(Refusal::WrongMethod(proof.method.clone()));
66	152×	}
67	152×	let skew = proof.time_ms as i64 - now_ms as i64;
68	152×	if skew.unsigned_abs() > WINDOW_MS {
69	1×	return Err(Refusal::Stale(skew / 1000));
70	151×	}
71	151×	let key = crate::identity::KeyId(proof.key());
72	151×	let principal = principals.principal(&key, now_ms).map_err(Refusal::NotAPrincipal)?;
73	149×	let identity = principals.identity(&key).ok_or_else(\|\| Refusal::NotAPrincipal("an unknown key".into()))?;
74	149×	proof.verify(identity, Some(body)).map_err(Refusal::BadSignature)?;
75	148×	let mut learn_uid = None;
76	148×	if let Principal::Agent { name, uid, learn_uid: learn, .. } = &principal {
77	90×	match (uid, peer_uid) {
78	4×	(Some(bound), Some(from)) if bound != from => return Err(Refusal::WrongUid { agent: name.clone(), bound: bound, from }),
79	1×	(Some(bound), None) => return Err(Refusal::BoundOverNetwork { agent: name.clone(), bound: *bound }),
80	1×	(None, Some(from)) if *learn => learn_uid = Some(from),
81	86×	_ => {}
82		}
83	58×	}
84		{
85	145×	let mut seen = self.nonces.lock().unwrap();
86	984×	seen.retain(\|_, t\| now_ms.saturating_sub(t) <= 2 WINDOW_MS);
87	145×	if seen.insert(proof.nonce, now_ms).is_some() {
88	1×	return Err(Refusal::Replay);
89	144×	}
90		}
91	144×	Ok(Caller {
92	144×	principal,
93	144×	auth: Auth { key: Some(proof.key()), method: Method::Signature, assurance: 2, proof: Some(proof.encode()) },
94	144×	learn_uid,
95	144×	})
96	156×	}
97		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/spectra-core/src/authn.rs 97.6%

Keyboard