Skip to content

Commit d1f396d

Browse files
dabasovdabasov
authored
Merge pull request #1378 from 0chain/hotfix/download-sig
verify client in download handler
2 parents cce361c + 9f54632 commit d1f396d

File tree

10 files changed

+87
-48
lines changed

10 files changed

+87
-48
lines changed

‎code/go/0chain.net/blobbercore/handler/context.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,8 @@ type Context struct {
3030
// AllocationId optional. allocation id in request
3131
AllocationId string
3232
// Signature optional. signature in request
33-
Signature string
33+
Signature string
34+
SignatureV2 string
3435

3536
Allocation *allocation.Allocation
3637

@@ -163,6 +164,7 @@ func WithTxHandler(handler func(ctx *Context) (interface{}, error)) func(w http.
163164
ctx.ClientKey = r.Header.Get(common.ClientKeyHeader)
164165
ctx.AllocationId = r.Header.Get(common.AllocationIdHeader)
165166
ctx.Signature = r.Header.Get(common.ClientSignatureHeader)
167+
ctx.SignatureV2 = r.Header.Get(common.ClientSignatureHeaderV2)
166168

167169
ctx, err := WithVerify(ctx, r)
168170
statusCode = ctx.StatusCode
@@ -222,7 +224,7 @@ func WithVerify(ctx *Context, r *http.Request) (*Context, error) {
222224

223225
publicKey := alloc.OwnerPublicKey
224226

225-
valid, err := verifySignatureFromRequest(allocationTx, ctx.Signature, publicKey)
227+
valid, err := verifySignatureFromRequest(allocationTx, ctx.Signature, ctx.SignatureV2, publicKey)
226228

227229
if !valid {
228230
ctx.StatusCode = http.StatusBadRequest

‎code/go/0chain.net/blobbercore/handler/download_request_header.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ type DownloadRequestHeader struct {
2525
VerifyDownload bool
2626
DownloadMode string
2727
ConnectionID string
28+
Version string
2829
}
2930

3031
func FromDownloadRequest(allocationID string, req *http.Request, isRedeem bool) (*DownloadRequestHeader, error) {
@@ -103,6 +104,7 @@ func (dr *DownloadRequestHeader) Parse(isRedeem bool) error {
103104

104105
dr.DownloadMode = dr.Get("X-Mode")
105106
dr.VerifyDownload = dr.Get("X-Verify-Download") == "true"
107+
dr.Version = dr.Get("X-Version")
106108
return nil
107109
}
108110

‎code/go/0chain.net/blobbercore/handler/handler.go

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,8 @@ func setupHandlerContext(ctx context.Context, r *http.Request) context.Context {
311311

312312
// signature is not requered for all requests, but if header is empty it won`t affect anything
313313
ctx = context.WithValue(ctx, constants.ContextKeyClientSignatureHeaderKey, r.Header.Get(common.ClientSignatureHeader))
314+
// signature V2
315+
ctx = context.WithValue(ctx, constants.ContextKeyClientSignatureHeaderV2Key, r.Header.Get(common.ClientSignatureHeaderV2))
314316
return ctx
315317
}
316318

@@ -806,8 +808,9 @@ func RevokeShare(ctx context.Context, r *http.Request) (interface{}, error) {
806808
}
807809

808810
sign := r.Header.Get(common.ClientSignatureHeader)
811+
signV2 := r.Header.Get(common.ClientSignatureHeaderV2)
809812

810-
valid, err := verifySignatureFromRequest(allocationTx, sign, allocationObj.OwnerPublicKey)
813+
valid, err := verifySignatureFromRequest(allocationTx, sign, signV2, allocationObj.OwnerPublicKey)
811814
if !valid || err != nil {
812815
return nil, common.NewError("invalid_signature", "Invalid signature")
813816
}
@@ -867,8 +870,9 @@ func InsertShare(ctx context.Context, r *http.Request) (interface{}, error) {
867870
}
868871

869872
sign := r.Header.Get(common.ClientSignatureHeader)
873+
signV2 := r.Header.Get(common.ClientSignatureHeaderV2)
870874

871-
valid, err := verifySignatureFromRequest(allocationTx, sign, allocationObj.OwnerPublicKey)
875+
valid, err := verifySignatureFromRequest(allocationTx, sign, signV2, allocationObj.OwnerPublicKey)
872876
if !valid || err != nil {
873877
return nil, common.NewError("invalid_signature", "Invalid signature")
874878
}
@@ -958,8 +962,9 @@ func ListShare(ctx context.Context, r *http.Request) (interface{}, error) {
958962
}
959963

960964
sign := r.Header.Get(common.ClientSignatureHeader)
965+
signV2 := r.Header.Get(common.ClientSignatureHeaderV2)
961966

962-
valid, err := verifySignatureFromRequest(allocationTx, sign, allocationObj.OwnerPublicKey)
967+
valid, err := verifySignatureFromRequest(allocationTx, sign, signV2, allocationObj.OwnerPublicKey)
963968
if !valid || err != nil {
964969
return nil, common.NewError("invalid_signature", "Invalid signature")
965970
}

‎code/go/0chain.net/blobbercore/handler/handler_download_test.go

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ func TestHandlers_Download(t *testing.T) {
7878
// setupEncryptionScheme()
7979

8080
router, handlers := setupDownloadHandlers()
81+
signScheme := "bls0chain"
8182

8283
sch := zcncrypto.NewSignatureScheme("bls0chain")
8384
//sch.Mnemonic = "expose culture dignity plastic digital couple promote best pool error brush upgrade correct art become lobster nature moment obtain trial multiply arch miss toe"
@@ -222,7 +223,7 @@ func TestHandlers_Download(t *testing.T) {
222223
}
223224

224225
hash := encryption.Hash(alloc.Tx)
225-
sign, err := sch.Sign(hash)
226+
sign, err := ownerClient.Sign(hash, signScheme)
226227
if err != nil {
227228
t.Fatal(err)
228229
}
@@ -291,7 +292,7 @@ func TestHandlers_Download(t *testing.T) {
291292
t.Fatal(err)
292293
}
293294
hash := encryption.Hash(alloc.Tx)
294-
sign, err := sch.Sign(hash)
295+
sign, err := ownerClient.Sign(hash, signScheme)
295296
if err != nil {
296297
t.Fatal(err)
297298
}
@@ -472,7 +473,7 @@ func TestHandlers_Download(t *testing.T) {
472473
t.Fatal(err)
473474
}
474475
hash := encryption.Hash(alloc.Tx)
475-
sign, err := sch.Sign(hash)
476+
sign, err := guestClient.Sign(hash, signScheme)
476477
if err != nil {
477478
t.Fatal(err)
478479
}
@@ -554,7 +555,7 @@ func TestHandlers_Download(t *testing.T) {
554555
t.Fatal(err)
555556
}
556557
hash := encryption.Hash(alloc.Tx)
557-
sign, err := sch.Sign(hash)
558+
sign, err := guestClient.Sign(hash, signScheme)
558559
if err != nil {
559560
t.Fatal(err)
560561
}
@@ -667,7 +668,7 @@ func TestHandlers_Download(t *testing.T) {
667668
}
668669

669670
hash := encryption.Hash(alloc.Tx)
670-
sign, err := sch.Sign(hash)
671+
sign, err := guestClient.Sign(hash, signScheme)
671672
if err != nil {
672673
t.Fatal(err)
673674
}
@@ -787,7 +788,7 @@ func TestHandlers_Download(t *testing.T) {
787788
}
788789

789790
hash := encryption.Hash(alloc.Tx)
790-
sign, err := sch.Sign(hash)
791+
sign, err := guestClient.Sign(hash, signScheme)
791792
if err != nil {
792793
t.Fatal(err)
793794
}
@@ -906,7 +907,7 @@ func TestHandlers_Download(t *testing.T) {
906907
}
907908

908909
hash := encryption.Hash(alloc.Tx)
909-
sign, err := sch.Sign(hash)
910+
sign, err := guestClient.Sign(hash, signScheme)
910911
if err != nil {
911912
t.Fatal(err)
912913
}

‎code/go/0chain.net/blobbercore/handler/object_operation_handler.go

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -267,15 +267,16 @@ func (fsh *StorageHandler) DownloadFile(ctx context.Context, r *http.Request) (i
267267
// get client and allocation ids
268268

269269
var (
270-
clientID = ctx.Value(constants.ContextKeyClient).(string)
271-
allocationTx = ctx.Value(constants.ContextKeyAllocation).(string)
272-
allocationID = ctx.Value(constants.ContextKeyAllocationID).(string)
273-
alloc *allocation.Allocation
274-
blobberID = node.Self.ID
275-
quotaManager = getQuotaManager()
270+
clientID = ctx.Value(constants.ContextKeyClient).(string)
271+
clientPublicKey = ctx.Value(constants.ContextKeyClientKey).(string)
272+
allocationTx = ctx.Value(constants.ContextKeyAllocation).(string)
273+
allocationID = ctx.Value(constants.ContextKeyAllocationID).(string)
274+
alloc *allocation.Allocation
275+
blobberID = node.Self.ID
276+
quotaManager = getQuotaManager()
276277
)
277278

278-
if clientID == "" {
279+
if clientID == "" || clientPublicKey == "" {
279280
return nil, common.NewError("download_file", "invalid client")
280281
}
281282

@@ -320,6 +321,12 @@ func (fsh *StorageHandler) DownloadFile(ctx context.Context, r *http.Request) (i
320321
if dr.AuthToken == "" {
321322
return nil, common.NewError("invalid_authticket", "authticket is required")
322323
}
324+
if dr.Version == "v2" {
325+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), clientPublicKey)
326+
if !valid || err != nil {
327+
return nil, common.NewError("invalid_signature", "Invalid signature")
328+
}
329+
}
323330
authTokenString, err := base64.StdEncoding.DecodeString(dr.AuthToken)
324331
if err != nil {
325332
return nil, common.NewError("invalid_authticket", err.Error())
@@ -343,6 +350,13 @@ func (fsh *StorageHandler) DownloadFile(ctx context.Context, r *http.Request) (i
343350
return nil, common.NewErrorf("download_file", "the file is not available until: %v", shareInfo.AvailableAt.UTC().Format("2006-01-02T15:04:05"))
344351
}
345352

353+
} else {
354+
if dr.Version == "v2" {
355+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), alloc.OwnerPublicKey)
356+
if !valid || err != nil {
357+
return nil, common.NewError("invalid_signature", "Invalid signature")
358+
}
359+
}
346360
}
347361

348362
isReadFree := alloc.IsReadFree(blobberID)
@@ -464,7 +478,7 @@ func (fsh *StorageHandler) CreateConnection(ctx context.Context, r *http.Request
464478
return nil, common.NewError("invalid_operation", "Operation needs to be performed by the owner or the payer of the allocation")
465479
}
466480

467-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey)
481+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), allocationObj.OwnerPublicKey)
468482
if !valid || err != nil {
469483
return nil, common.NewError("invalid_signature", "Invalid signature")
470484
}
@@ -766,8 +780,7 @@ func (fsh *StorageHandler) RenameObject(ctx context.Context, r *http.Request) (i
766780

767781
clientID := ctx.Value(constants.ContextKeyClient).(string)
768782
_ = ctx.Value(constants.ContextKeyClientKey).(string)
769-
770-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey)
783+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), allocationObj.OwnerPublicKey)
771784
if !valid || err != nil {
772785
return nil, common.NewError("invalid_signature", "Invalid signature")
773786
}
@@ -848,7 +861,7 @@ func (fsh *StorageHandler) CopyObject(ctx context.Context, r *http.Request) (int
848861
return nil, common.NewError("prohibited_allocation_file_options", "Cannot copy data from this allocation.")
849862
}
850863

851-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey)
864+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), allocationObj.OwnerPublicKey)
852865
if !valid || err != nil {
853866
return nil, common.NewError("invalid_signature", "Invalid signature")
854867
}
@@ -957,8 +970,7 @@ func (fsh *StorageHandler) MoveObject(ctx context.Context, r *http.Request) (int
957970
return nil, common.NewError("prohibited_allocation_file_options", "Cannot move data in this allocation.")
958971
}
959972

960-
valid, err := verifySignatureFromRequest(
961-
allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey)
973+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), allocationObj.OwnerPublicKey)
962974
if !valid || err != nil {
963975
return nil, common.NewError("invalid_signature", "Invalid signature")
964976
}
@@ -1109,7 +1121,7 @@ func (fsh *StorageHandler) CreateDir(ctx context.Context, r *http.Request) (*all
11091121
return nil, common.NewError("invalid_parameters", "Invalid allocation id passed."+err.Error())
11101122
}
11111123

1112-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), allocationObj.OwnerPublicKey)
1124+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), allocationObj.OwnerPublicKey)
11131125
if !valid || err != nil {
11141126
return nil, common.NewError("invalid_signature", "Invalid signature")
11151127
}
@@ -1240,7 +1252,7 @@ func (fsh *StorageHandler) WriteFile(ctx context.Context, r *http.Request) (*all
12401252
st = time.Now()
12411253
publicKey := allocationObj.OwnerPublicKey
12421254

1243-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), publicKey)
1255+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), publicKey)
12441256

12451257
if !valid || err != nil {
12461258
return nil, common.NewError("invalid_signature", "Invalid signature")

‎code/go/0chain.net/blobbercore/handler/object_operation_handler_test.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"net/http/httptest"
1212
"time"
1313

14+
"github.com/0chain/blobber/code/go/0chain.net/core/encryption"
1415
"github.com/0chain/blobber/code/go/0chain.net/core/transaction"
1516

1617
"github.com/0chain/blobber/code/go/0chain.net/blobbercore/reference"
@@ -114,6 +115,8 @@ func TestDownloadFile(t *testing.T) {
114115
req.Header.Set("X-Block-Num", fmt.Sprintf("%d", p.inData.blockNum))
115116
req.Header.Set("X-Num-Blocks", fmt.Sprintf("%d", p.inData.numBlocks))
116117
req.Header.Set(common.AllocationIdHeader, mockAllocationId)
118+
sign, _ := client.Sign(encryption.Hash(mockAllocationTx))
119+
req.Header.Set("X-App-Client-Signature", sign)
117120

118121
if p.useAuthTicket {
119122
authTicket := &marker.AuthTicket{

‎code/go/0chain.net/blobbercore/handler/storage_handler.go

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"github.com/0chain/blobber/code/go/0chain.net/core/common"
2323
"github.com/0chain/blobber/code/go/0chain.net/core/encryption"
2424
. "github.com/0chain/blobber/code/go/0chain.net/core/logging"
25+
"github.com/0chain/blobber/code/go/0chain.net/core/node"
2526
)
2627

2728
const (
@@ -136,7 +137,7 @@ func (fsh *StorageHandler) GetFileMeta(ctx context.Context, r *http.Request) (in
136137
if isOwner {
137138
publicKey := alloc.OwnerPublicKey
138139

139-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), publicKey)
140+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), publicKey)
140141
if !valid || err != nil {
141142
return nil, common.NewError("invalid_signature", "Invalid signature")
142143
}
@@ -180,7 +181,7 @@ func (fsh *StorageHandler) GetFilesMetaByName(ctx context.Context, r *http.Reque
180181
if isOwner {
181182
publicKey := alloc.OwnerPublicKey
182183

183-
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), publicKey)
184+
valid, err := verifySignatureFromRequest(allocationTx, r.Header.Get(common.ClientSignatureHeader), r.Header.Get(common.ClientSignatureHeaderV2), publicKey)
184185
if !valid || err != nil {
185186
return nil, common.NewError("invalid_signature", "Invalid signature")
186187
}
@@ -223,7 +224,8 @@ func (fsh *StorageHandler) GetFileStats(ctx context.Context, r *http.Request) (i
223224
allocationID := allocationObj.ID
224225

225226
clientSign, _ := ctx.Value(constants.ContextKeyClientSignatureHeaderKey).(string)
226-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, allocationObj.OwnerPublicKey)
227+
clientSignV2, _ := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
228+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, allocationObj.OwnerPublicKey)
227229
if !valid || err != nil {
228230
return nil, common.NewError("invalid_signature", "Invalid signature")
229231
}
@@ -431,8 +433,8 @@ func (fsh *StorageHandler) GetLatestWriteMarker(ctx context.Context, r *http.Req
431433

432434
clientSign, _ := ctx.Value(constants.ContextKeyClientSignatureHeaderKey).(string)
433435
publicKey := allocationObj.OwnerPublicKey
434-
435-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, publicKey)
436+
clientSignV2 := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
437+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, publicKey)
436438
if !valid || err != nil {
437439
return nil, common.NewError("invalid_signature", "could not verify the allocation owner")
438440
}
@@ -513,7 +515,8 @@ func (fsh *StorageHandler) getReferencePath(ctx context.Context, r *http.Request
513515

514516
publicKey := allocationObj.OwnerPublicKey
515517

516-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, publicKey)
518+
clientSignV2 := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
519+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, publicKey)
517520
if !valid || err != nil {
518521
errCh <- common.NewError("invalid_signature", "could not verify the allocation owner or collaborator")
519522
return
@@ -575,7 +578,8 @@ func (fsh *StorageHandler) GetObjectTree(ctx context.Context, r *http.Request) (
575578
allocationID := allocationObj.ID
576579

577580
clientSign, _ := ctx.Value(constants.ContextKeyClientSignatureHeaderKey).(string)
578-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, allocationObj.OwnerPublicKey)
581+
clientSignV2 := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
582+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, allocationObj.OwnerPublicKey)
579583
if !valid || err != nil {
580584
return nil, common.NewError("invalid_signature", "Invalid signature")
581585
}
@@ -644,8 +648,8 @@ func (fsh *StorageHandler) GetRecentlyAddedRefs(ctx context.Context, r *http.Req
644648
}
645649

646650
clientSign := ctx.Value(constants.ContextKeyClientSignatureHeaderKey).(string)
647-
648-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, allocationObj.OwnerPublicKey)
651+
clientSignV2 := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
652+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, allocationObj.OwnerPublicKey)
649653
if !valid || err != nil {
650654
return nil, common.NewError("invalid_signature", "Invalid signature or invalid access")
651655
}
@@ -731,7 +735,8 @@ func (fsh *StorageHandler) GetRefs(ctx context.Context, r *http.Request) (*blobb
731735

732736
clientSign, _ := ctx.Value(constants.ContextKeyClientSignatureHeaderKey).(string)
733737

734-
valid, err := verifySignatureFromRequest(allocationTx, clientSign, publicKey)
738+
clientSignV2 := ctx.Value(constants.ContextKeyClientSignatureHeaderV2Key).(string)
739+
valid, err := verifySignatureFromRequest(allocationTx, clientSign, clientSignV2, publicKey)
735740
if !valid || err != nil {
736741
return nil, common.NewError("invalid_signature", "Invalid signature")
737742
}
@@ -896,14 +901,24 @@ func (fsh *StorageHandler) GetRefs(ctx context.Context, r *http.Request) (*blobb
896901
}
897902

898903
// verifySignatureFromRequest verifies signature passed as common.ClientSignatureHeader header.
899-
func verifySignatureFromRequest(alloc, sign, pbK string) (bool, error) {
900-
sign = encryption.MiraclToHerumiSig(sign)
901-
904+
func verifySignatureFromRequest(alloc, signV1, signV2, pbK string) (bool, error) {
905+
var (
906+
sign string
907+
hashData string
908+
hash string
909+
)
910+
if signV2 != "" {
911+
sign = encryption.MiraclToHerumiSig(signV2)
912+
hashData = alloc + node.Self.GetURLBase()
913+
hash = encryption.Hash(hashData)
914+
} else {
915+
sign = encryption.MiraclToHerumiSig(signV1)
916+
hashData = alloc
917+
hash = encryption.Hash(hashData)
918+
}
902919
if len(sign) < 64 {
903920
return false, nil
904921
}
905-
906-
hash := encryption.Hash(alloc)
907922
return encryption.Verify(pbK, sign, hash)
908923
}
909924

0 commit comments

Comments
 (0)