2023-05-10 09:24:05 +02:00
|
|
|
package hscontrol
|
2021-04-23 00:25:01 +02:00
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/rand"
|
|
|
|
"encoding/hex"
|
2021-06-24 15:44:19 +02:00
|
|
|
"errors"
|
2022-05-30 15:31:06 +02:00
|
|
|
"fmt"
|
2021-11-04 23:14:39 +01:00
|
|
|
"strconv"
|
2022-08-25 12:43:15 +02:00
|
|
|
"strings"
|
2021-04-23 00:25:01 +02:00
|
|
|
"time"
|
2021-06-24 15:44:19 +02:00
|
|
|
|
2021-11-13 09:39:04 +01:00
|
|
|
v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
|
2023-05-11 09:09:18 +02:00
|
|
|
"github.com/juanfont/headscale/hscontrol/util"
|
2021-11-04 23:14:39 +01:00
|
|
|
"google.golang.org/protobuf/types/known/timestamppb"
|
2021-06-24 15:44:19 +02:00
|
|
|
"gorm.io/gorm"
|
2021-04-23 00:25:01 +02:00
|
|
|
)
|
|
|
|
|
2023-05-11 09:09:18 +02:00
|
|
|
var (
|
|
|
|
ErrPreAuthKeyNotFound = errors.New("AuthKey not found")
|
|
|
|
ErrPreAuthKeyExpired = errors.New("AuthKey expired")
|
|
|
|
ErrSingleUseAuthKeyHasBeenUsed = errors.New("AuthKey has already been used")
|
|
|
|
ErrUserMismatch = errors.New("user mismatch")
|
|
|
|
ErrPreAuthKeyACLTagInvalid = errors.New("AuthKey tag is invalid")
|
2021-11-04 23:14:39 +01:00
|
|
|
)
|
2021-05-05 23:00:04 +02:00
|
|
|
|
2023-01-17 17:43:44 +01:00
|
|
|
// PreAuthKey describes a pre-authorization key usable in a particular user.
|
2021-04-23 00:25:01 +02:00
|
|
|
type PreAuthKey struct {
|
2023-01-17 20:36:46 +01:00
|
|
|
ID uint64 `gorm:"primary_key"`
|
|
|
|
Key string
|
|
|
|
UserID uint
|
|
|
|
User User
|
|
|
|
Reusable bool
|
|
|
|
Ephemeral bool `gorm:"default:false"`
|
|
|
|
Used bool `gorm:"default:false"`
|
|
|
|
ACLTags []PreAuthKeyACLTag
|
2021-04-23 00:25:01 +02:00
|
|
|
|
|
|
|
CreatedAt *time.Time
|
|
|
|
Expiration *time.Time
|
|
|
|
}
|
|
|
|
|
2022-09-07 14:12:29 +02:00
|
|
|
// PreAuthKeyACLTag describes an autmatic tag applied to a node when registered with the associated PreAuthKey.
|
|
|
|
type PreAuthKeyACLTag struct {
|
2022-08-25 12:03:38 +02:00
|
|
|
ID uint64 `gorm:"primary_key"`
|
|
|
|
PreAuthKeyID uint64
|
|
|
|
Tag string
|
|
|
|
}
|
|
|
|
|
2023-01-17 17:43:44 +01:00
|
|
|
// CreatePreAuthKey creates a new PreAuthKey in a user, and returns it.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) CreatePreAuthKey(
|
2023-01-17 17:43:44 +01:00
|
|
|
userName string,
|
2021-11-04 23:14:39 +01:00
|
|
|
reusable bool,
|
|
|
|
ephemeral bool,
|
|
|
|
expiration *time.Time,
|
2022-08-25 12:03:38 +02:00
|
|
|
aclTags []string,
|
2021-11-04 23:14:39 +01:00
|
|
|
) (*PreAuthKey, error) {
|
2023-05-11 09:09:18 +02:00
|
|
|
user, err := hsdb.GetUser(userName)
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2022-08-25 12:43:15 +02:00
|
|
|
for _, tag := range aclTags {
|
|
|
|
if !strings.HasPrefix(tag, "tag:") {
|
2023-05-11 09:09:18 +02:00
|
|
|
return nil, fmt.Errorf(
|
|
|
|
"%w: '%s' did not begin with 'tag:'",
|
|
|
|
ErrPreAuthKeyACLTagInvalid,
|
|
|
|
tag,
|
|
|
|
)
|
2022-08-25 12:43:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-23 00:25:01 +02:00
|
|
|
now := time.Now().UTC()
|
2023-05-11 09:09:18 +02:00
|
|
|
kstr, err := hsdb.generateKey()
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-11-15 17:15:50 +01:00
|
|
|
key := PreAuthKey{
|
2023-01-17 20:36:46 +01:00
|
|
|
Key: kstr,
|
|
|
|
UserID: user.ID,
|
|
|
|
User: *user,
|
|
|
|
Reusable: reusable,
|
|
|
|
Ephemeral: ephemeral,
|
|
|
|
CreatedAt: &now,
|
|
|
|
Expiration: expiration,
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
2022-05-30 15:31:06 +02:00
|
|
|
|
2023-05-11 09:09:18 +02:00
|
|
|
err = hsdb.db.Transaction(func(db *gorm.DB) error {
|
2022-08-25 12:03:38 +02:00
|
|
|
if err := db.Save(&key).Error; err != nil {
|
|
|
|
return fmt.Errorf("failed to create key in the database: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(aclTags) > 0 {
|
2022-08-25 12:43:15 +02:00
|
|
|
seenTags := map[string]bool{}
|
|
|
|
|
2022-08-25 12:03:38 +02:00
|
|
|
for _, tag := range aclTags {
|
2022-09-07 14:12:29 +02:00
|
|
|
if !seenTags[tag] {
|
|
|
|
if err := db.Save(&PreAuthKeyACLTag{PreAuthKeyID: key.ID, Tag: tag}).Error; err != nil {
|
2022-08-25 12:43:15 +02:00
|
|
|
return fmt.Errorf(
|
|
|
|
"failed to ceate key tag in the database: %w",
|
|
|
|
err,
|
|
|
|
)
|
|
|
|
}
|
|
|
|
seenTags[tag] = true
|
2022-08-25 12:03:38 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-09-07 14:12:29 +02:00
|
|
|
|
2022-08-25 12:03:38 +02:00
|
|
|
return nil
|
|
|
|
})
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2022-05-30 15:31:06 +02:00
|
|
|
}
|
2021-04-23 00:25:01 +02:00
|
|
|
|
2021-11-15 17:15:50 +01:00
|
|
|
return &key, nil
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
|
|
|
|
2023-01-17 17:43:44 +01:00
|
|
|
// ListPreAuthKeys returns the list of PreAuthKeys for a user.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) ListPreAuthKeys(userName string) ([]PreAuthKey, error) {
|
|
|
|
user, err := hsdb.GetUser(userName)
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
keys := []PreAuthKey{}
|
2023-05-11 09:09:18 +02:00
|
|
|
if err := hsdb.db.Preload("User").Preload("ACLTags").Where(&PreAuthKey{UserID: user.ID}).Find(&keys).Error; err != nil {
|
2021-04-23 00:25:01 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-11-04 23:14:39 +01:00
|
|
|
return keys, nil
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
|
|
|
|
2021-11-13 09:39:04 +01:00
|
|
|
// GetPreAuthKey returns a PreAuthKey for a given key.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) GetPreAuthKey(user string, key string) (*PreAuthKey, error) {
|
|
|
|
pak, err := hsdb.checkKeyValidity(key)
|
2021-08-08 00:10:30 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-01-17 17:43:44 +01:00
|
|
|
if pak.User.Name != user {
|
|
|
|
return nil, ErrUserMismatch
|
2021-08-08 00:10:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return pak, nil
|
|
|
|
}
|
|
|
|
|
2021-11-13 20:01:05 +01:00
|
|
|
// DestroyPreAuthKey destroys a preauthkey. Returns error if the PreAuthKey
|
|
|
|
// does not exist.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) DestroyPreAuthKey(pak PreAuthKey) error {
|
|
|
|
return hsdb.db.Transaction(func(db *gorm.DB) error {
|
2022-09-07 14:12:29 +02:00
|
|
|
if result := db.Unscoped().Where(PreAuthKeyACLTag{PreAuthKeyID: pak.ID}).Delete(&PreAuthKeyACLTag{}); result.Error != nil {
|
2022-08-25 12:03:38 +02:00
|
|
|
return result.Error
|
|
|
|
}
|
2021-11-13 20:01:05 +01:00
|
|
|
|
2022-08-25 12:03:38 +02:00
|
|
|
if result := db.Unscoped().Delete(pak); result.Error != nil {
|
|
|
|
return result.Error
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
})
|
2021-11-13 20:01:05 +01:00
|
|
|
}
|
|
|
|
|
2021-11-14 09:32:58 +01:00
|
|
|
// MarkExpirePreAuthKey marks a PreAuthKey as expired.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) ExpirePreAuthKey(k *PreAuthKey) error {
|
|
|
|
if err := hsdb.db.Model(&k).Update("Expiration", time.Now()).Error; err != nil {
|
2021-08-07 23:57:52 +02:00
|
|
|
return err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-08-07 23:57:52 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-02-28 09:06:39 +01:00
|
|
|
// UsePreAuthKey marks a PreAuthKey as used.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) UsePreAuthKey(k *PreAuthKey) error {
|
2022-02-28 09:06:39 +01:00
|
|
|
k.Used = true
|
2023-05-11 09:09:18 +02:00
|
|
|
if err := hsdb.db.Save(k).Error; err != nil {
|
2022-05-30 15:31:06 +02:00
|
|
|
return fmt.Errorf("failed to update key used status in the database: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
2022-02-28 09:06:39 +01:00
|
|
|
}
|
|
|
|
|
2021-05-05 23:00:04 +02:00
|
|
|
// checkKeyValidity does the heavy lifting for validation of the PreAuthKey coming from a node
|
2021-11-13 09:39:04 +01:00
|
|
|
// If returns no error and a PreAuthKey, it can be used.
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) checkKeyValidity(k string) (*PreAuthKey, error) {
|
2021-05-05 23:00:04 +02:00
|
|
|
pak := PreAuthKey{}
|
2023-05-11 09:09:18 +02:00
|
|
|
if result := hsdb.db.Preload("User").Preload("ACLTags").First(&pak, "key = ?", k); errors.Is(
|
2021-11-13 09:36:45 +01:00
|
|
|
result.Error,
|
|
|
|
gorm.ErrRecordNotFound,
|
|
|
|
) {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrPreAuthKeyNotFound
|
2021-05-05 23:00:04 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if pak.Expiration != nil && pak.Expiration.Before(time.Now()) {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrPreAuthKeyExpired
|
2021-05-05 23:00:04 +02:00
|
|
|
}
|
|
|
|
|
2021-05-23 02:15:29 +02:00
|
|
|
if pak.Reusable || pak.Ephemeral { // we don't need to check if has been used before
|
2021-05-06 00:08:36 +02:00
|
|
|
return &pak, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
machines := []Machine{}
|
2023-05-11 09:09:18 +02:00
|
|
|
if err := hsdb.db.Preload("AuthKey").Where(&Machine{AuthKeyID: uint(pak.ID)}).Find(&machines).Error; err != nil {
|
2021-05-06 00:08:36 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2021-10-13 22:51:55 +02:00
|
|
|
if len(machines) != 0 || pak.Used {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrSingleUseAuthKeyHasBeenUsed
|
2021-05-06 00:08:36 +02:00
|
|
|
}
|
|
|
|
|
2021-05-05 23:00:04 +02:00
|
|
|
return &pak, nil
|
|
|
|
}
|
|
|
|
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) generateKey() (string, error) {
|
2021-04-23 00:25:01 +02:00
|
|
|
size := 24
|
|
|
|
bytes := make([]byte, size)
|
|
|
|
if _, err := rand.Read(bytes); err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-04-23 00:25:01 +02:00
|
|
|
return hex.EncodeToString(bytes), nil
|
|
|
|
}
|
2021-11-04 23:14:39 +01:00
|
|
|
|
|
|
|
func (key *PreAuthKey) toProto() *v1.PreAuthKey {
|
2021-11-08 21:48:20 +01:00
|
|
|
protoKey := v1.PreAuthKey{
|
2023-01-17 20:36:46 +01:00
|
|
|
User: key.User.Name,
|
2023-05-11 09:09:18 +02:00
|
|
|
Id: strconv.FormatUint(key.ID, util.Base10),
|
2021-11-08 21:48:20 +01:00
|
|
|
Key: key.Key,
|
|
|
|
Ephemeral: key.Ephemeral,
|
|
|
|
Reusable: key.Reusable,
|
|
|
|
Used: key.Used,
|
2022-09-07 14:12:29 +02:00
|
|
|
AclTags: make([]string, len(key.ACLTags)),
|
2021-11-04 23:14:39 +01:00
|
|
|
}
|
2021-11-08 21:48:20 +01:00
|
|
|
|
|
|
|
if key.Expiration != nil {
|
|
|
|
protoKey.Expiration = timestamppb.New(*key.Expiration)
|
|
|
|
}
|
|
|
|
|
|
|
|
if key.CreatedAt != nil {
|
|
|
|
protoKey.CreatedAt = timestamppb.New(*key.CreatedAt)
|
|
|
|
}
|
|
|
|
|
2022-09-23 09:58:06 +02:00
|
|
|
for idx := range key.ACLTags {
|
|
|
|
protoKey.AclTags[idx] = key.ACLTags[idx].Tag
|
2022-08-25 12:03:38 +02:00
|
|
|
}
|
|
|
|
|
2021-11-08 21:48:20 +01:00
|
|
|
return &protoKey
|
2021-11-04 23:14:39 +01:00
|
|
|
}
|