first working version

pkg/api/types/auth.go

@@ -0,0 +1,115 @@
+package types
+
+import (
+	"git.giftfish.de/ston1th/haproxy-lb/pkg/config"
+	"golang.org/x/crypto/bcrypt"
+	weakrand "math/rand"
+	//"net/http"
+	"encoding/hex"
+	"strings"
+	"sync"
+	"time"
+)
+
+var cacheSize = 100
+
+func init() {
+	weakrand.Seed(time.Now().UnixNano())
+}
+
+type cache struct {
+	cache map[string]bool
+	mtx   sync.Mutex
+}
+
+func newCache() *cache {
+	return &cache{
+		cache: make(map[string]bool),
+	}
+}
+
+func (c *cache) get(key string) (bool, bool) {
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	v, ok := c.cache[key]
+	return v, ok
+}
+
+func (c *cache) set(key string, value bool) {
+	c.mtx.Lock()
+	defer c.mtx.Unlock()
+	c.makeRoom()
+	c.cache[key] = value
+}
+
+func (c *cache) makeRoom() {
+	if len(c.cache) < cacheSize {
+		return
+	}
+	numToDelete := len(c.cache) / 10
+	if numToDelete < 1 {
+		numToDelete = 1
+	}
+	for deleted := 0; deleted <= numToDelete; deleted++ {
+		rnd := weakrand.Intn(len(c.cache))
+		i := 0
+		for key := range c.cache {
+			if i == rnd {
+				delete(c.cache, key)
+				break
+			}
+			i++
+		}
+	}
+}
+
+type Auth struct {
+	users map[string]*creds
+	cache *cache
+	// bcryptMtx is there to ensure that bcrypt.CompareHashAndPassword is run
+	// only once in parallel as this is CPU intensive.
+	bcryptMtx sync.Mutex
+}
+
+func (a *Auth) Login(user, pass, path string) bool {
+	creds, valid := a.users[user]
+	hash := creds.Hash
+
+	if !valid {
+		// The user is not found. Use a fixed password hash to
+		// prevent user enumeration by timing requests.
+		// This is a bcrypt-hashed version of "fakepassword".
+		hash = "$2y$10$QOauhQNbBCuQDKes6eFzPeMqBSjb7Mr5DUmpZ/VcEd00UAV/LDeSi"
+	}
+
+	cacheKey := hex.EncodeToString(append(append([]byte(user), []byte(hash)...), []byte(pass)...))
+	authOk, ok := a.cache.get(cacheKey)
+
+	if !ok {
+		// This user, hashedPassword, password is not cached.
+		a.bcryptMtx.Lock()
+		err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(pass))
+		a.bcryptMtx.Unlock()
+
+		authOk = err == nil
+		a.cache.set(cacheKey, authOk)
+	}
+
+	return authOk && valid && strings.HasPrefix(path, creds.Prefix)
+}
+
+type creds struct {
+	Hash   string
+	Prefix string
+}
+
+func NewAuth(conf []config.BasicAuth) (a *Auth) {
+	a = &Auth{
+		users: make(map[string]*creds),
+		cache: newCache(),
+	}
+	for _, ba := range conf {
+		a.users[ba.User] = &creds{ba.Hash, ba.Prefix}
+	}
+	return
+}

pkg/api/types/context.go

@@ -9,14 +9,13 @@ import (
 	"github.com/gorilla/mux"
 
 	"git.giftfish.de/ston1th/haproxy-lb/pkg/alloc"
-	"git.giftfish.de/ston1th/haproxy-lb/pkg/config"
 	"git.giftfish.de/ston1th/haproxy-lb/pkg/db"
 )
 
 type ContextData struct {
 	Alloc *alloc.Alloc
 	DB    *db.DB
-	Auth  []config.BasicAuth
+	Auth  *Auth
 }
 
 func NewContext(w http.ResponseWriter, r *http.Request, data *ContextData, log logr.Logger) *Context {
@@ -47,6 +46,11 @@ func (c *Context) Method() string {
 	return c.Request.Method
 }
 
+// Path returns the request URL path
+func (c *Context) Path() string {
+	return c.Request.URL.Path
+}
+
 // GetHeader returns the given http header
 func (c *Context) GetHeader(name string) string {
 	return c.Request.Header.Get(name)
@@ -82,16 +86,8 @@ func (c *Context) NotFound() {
 	c.Err(ErrNotFound)
 }
 
-//TODO func (c *Context) MethodNotAllowed() {
-//	c.Status = http.StatusMethodNotAllowed
-//	c.Response.WriteHeader(http.StatusMethodNotAllowed)
-//	c.Response.Write([]byte(`{"message":"method not allowed","status":405}`))
-//	c.log()
-//}
-
 // OK is a empty HTTP 200 JSON response
 func (c *Context) OK() {
-	c.Response.Write([]byte("{}"))
 	c.log()
 }
 

pkg/api/types/error.go

@@ -35,11 +35,12 @@ func newError(err string, status int) Error {
 }
 
 var (
-	ErrBadreq    = newError("bad request", http.StatusBadRequest)
-	ErrInvalid   = newError("invalid data", http.StatusBadRequest)
-	ErrForbidden = newError("forbidden", http.StatusForbidden)
-	ErrNotFound  = newError("not found", http.StatusNotFound)
-	ErrMNA       = newError("method not allowed", http.StatusMethodNotAllowed)
-	ErrExists    = newError("resource already exists", http.StatusConflict)
-	ErrISE       = newError("internal server error", http.StatusInternalServerError)
+	ErrBadreq       = newError("bad request", http.StatusBadRequest)
+	ErrInvalid      = newError("invalid data", http.StatusBadRequest)
+	ErrUnauthorized = newError("unauthorized", http.StatusUnauthorized)
+	ErrForbidden    = newError("forbidden", http.StatusForbidden)
+	ErrNotFound     = newError("not found", http.StatusNotFound)
+	ErrMNA          = newError("method not allowed", http.StatusMethodNotAllowed)
+	ErrExists       = newError("resource already exists", http.StatusConflict)
+	ErrISE          = newError("internal server error", http.StatusInternalServerError)
 )