72 lines
2.0 KiB
Go
72 lines
2.0 KiB
Go
// Package identity gates a route on the set of tailnet peers allowed to use it.
|
|
// The middleware sits in front of the proxy: it names the route the same way the
|
|
// proxy does and refuses with 403 any caller a route does not allow.
|
|
package identity
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
const (
|
|
// routeHeader is how a caller names the route, the same header the proxy
|
|
// reads.
|
|
routeHeader = "X-Crossbar-Route"
|
|
// peerHeader carries the node name in header mode.
|
|
peerHeader = "X-Crossbar-Peer"
|
|
// adminPrefix is never gated here; the proxy's own handlers own it.
|
|
adminPrefix = "/_crossbar/"
|
|
)
|
|
|
|
// Middleware wraps next with the peer gate. peersFor names the allow list for a
|
|
// route and reports whether it knows the route; an unknown route, like a path
|
|
// under adminPrefix, passes straight through.
|
|
func Middleware(c *Checker, peersFor func(route string) ([]string, bool), next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if strings.HasPrefix(r.URL.Path, adminPrefix) {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
route := r.Header.Get(routeHeader)
|
|
if route == "" {
|
|
route = firstSegment(r.URL.Path)
|
|
}
|
|
peers, known := peersFor(route)
|
|
if !known {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
ctx := WithHeaderPeer(r.Context(), r.Header.Get(peerHeader))
|
|
if err := c.Allow(ctx, peers, r.RemoteAddr); err != nil {
|
|
writeForbidden(w)
|
|
return
|
|
}
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
|
|
// writeForbidden answers the JSON 403 the tests and callers expect.
|
|
func writeForbidden(w http.ResponseWriter) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
w.WriteHeader(http.StatusForbidden)
|
|
w.Write([]byte(`{"error":"forbidden route"}`))
|
|
}
|
|
|
|
// firstSegment takes the first path segment as the route, "/a/v1/x" -> "a".
|
|
func firstSegment(path string) string {
|
|
if path == "" || path[0] != '/' {
|
|
return ""
|
|
}
|
|
after := path[1:]
|
|
if slash := strings.IndexByte(after, '/'); slash >= 0 {
|
|
if after[:slash] == "" {
|
|
return ""
|
|
}
|
|
return after[:slash]
|
|
}
|
|
if after == "" {
|
|
return ""
|
|
}
|
|
return after
|
|
}
|