headscale/preauth_keys.go

231 lines
5.6 KiB
Go
Raw Normal View History

2021-04-22 16:25:01 -06:00
package headscale
import (
"crypto/rand"
"encoding/hex"
2021-06-24 07:44:19 -06:00
"errors"
2022-05-30 07:31:06 -06:00
"fmt"
"strconv"
2021-04-22 16:25:01 -06:00
"time"
2021-06-24 07:44:19 -06:00
2021-11-13 01:39:04 -07:00
v1 "github.com/juanfont/headscale/gen/go/headscale/v1"
"google.golang.org/protobuf/types/known/timestamppb"
2021-06-24 07:44:19 -06:00
"gorm.io/gorm"
2021-04-22 16:25:01 -06:00
)
const (
2022-07-29 09:35:21 -06:00
ErrPreAuthKeyNotFound = Error("AuthKey not found")
ErrPreAuthKeyExpired = Error("AuthKey expired")
ErrSingleUseAuthKeyHasBeenUsed = Error("AuthKey has already been used")
ErrNamespaceMismatch = Error("namespace mismatch")
)
2021-05-05 15:00:04 -06:00
2021-11-13 01:39:04 -07:00
// PreAuthKey describes a pre-authorization key usable in a particular namespace.
2021-04-22 16:25:01 -06:00
type PreAuthKey struct {
ID uint64 `gorm:"primary_key"`
Key string
NamespaceID uint
Namespace Namespace
Reusable bool
Ephemeral bool `gorm:"default:false"`
2021-10-13 15:28:47 -06:00
Used bool `gorm:"default:false"`
AclTags []PreAuthKeyAclTag
2021-04-22 16:25:01 -06:00
CreatedAt *time.Time
Expiration *time.Time
}
// PreAuthKeyAclTag describes an autmatic tag applied to a node when registered with the associated PreAuthKey
type PreAuthKeyAclTag struct {
ID uint64 `gorm:"primary_key"`
PreAuthKeyID uint64
Tag string
}
2021-11-13 01:39:04 -07:00
// CreatePreAuthKey creates a new PreAuthKey in a namespace, and returns it.
func (h *Headscale) CreatePreAuthKey(
namespaceName string,
reusable bool,
ephemeral bool,
expiration *time.Time,
aclTags []string,
) (*PreAuthKey, error) {
2021-11-15 09:15:50 -07:00
namespace, err := h.GetNamespace(namespaceName)
2021-04-22 16:25:01 -06:00
if err != nil {
return nil, err
}
now := time.Now().UTC()
kstr, err := h.generateKey()
if err != nil {
return nil, err
}
2021-11-15 09:15:50 -07:00
key := PreAuthKey{
2021-04-22 16:25:01 -06:00
Key: kstr,
2021-11-15 09:15:50 -07:00
NamespaceID: namespace.ID,
Namespace: *namespace,
2021-04-22 16:25:01 -06:00
Reusable: reusable,
Ephemeral: ephemeral,
2021-04-22 16:25:01 -06:00
CreatedAt: &now,
Expiration: expiration,
}
2022-05-30 07:31:06 -06:00
err = h.db.Transaction(func(db *gorm.DB) error {
if err := db.Save(&key).Error; err != nil {
return fmt.Errorf("failed to create key in the database: %w", err)
}
if len(aclTags) > 0 {
for _, tag := range aclTags {
if err := db.Save(&PreAuthKeyAclTag{PreAuthKeyID: key.ID, Tag: tag}).Error; err != nil {
return fmt.Errorf(
"failed to create key tag in the database: %w",
err,
)
}
}
}
return nil
})
if err != nil {
return nil, err
2022-05-30 07:31:06 -06:00
}
2021-04-22 16:25:01 -06:00
2021-11-15 09:15:50 -07:00
return &key, nil
2021-04-22 16:25:01 -06:00
}
2021-11-13 01:39:04 -07:00
// ListPreAuthKeys returns the list of PreAuthKeys for a namespace.
func (h *Headscale) ListPreAuthKeys(namespaceName string) ([]PreAuthKey, error) {
2021-11-15 09:15:50 -07:00
namespace, err := h.GetNamespace(namespaceName)
2021-04-22 16:25:01 -06:00
if err != nil {
return nil, err
}
keys := []PreAuthKey{}
if err := h.db.Preload("Namespace").Preload("AclTags").Where(&PreAuthKey{NamespaceID: namespace.ID}).Find(&keys).Error; err != nil {
2021-04-22 16:25:01 -06:00
return nil, err
}
2021-11-14 08:46:09 -07:00
return keys, nil
2021-04-22 16:25:01 -06:00
}
2021-11-13 01:39:04 -07:00
// GetPreAuthKey returns a PreAuthKey for a given key.
func (h *Headscale) GetPreAuthKey(namespace string, key string) (*PreAuthKey, error) {
pak, err := h.checkKeyValidity(key)
if err != nil {
return nil, err
}
if pak.Namespace.Name != namespace {
2022-07-29 09:35:21 -06:00
return nil, ErrNamespaceMismatch
}
return pak, nil
}
// DestroyPreAuthKey destroys a preauthkey. Returns error if the PreAuthKey
// does not exist.
2021-11-15 11:31:52 -07:00
func (h *Headscale) DestroyPreAuthKey(pak PreAuthKey) error {
return h.db.Transaction(func(db *gorm.DB) error {
2022-08-25 04:12:41 -06:00
if result := db.Unscoped().Where(PreAuthKeyAclTag{PreAuthKeyID: pak.ID}).Delete(&PreAuthKeyAclTag{}); result.Error != nil {
return result.Error
}
if result := db.Unscoped().Delete(pak); result.Error != nil {
return result.Error
}
return nil
})
}
2021-11-14 01:32:58 -07:00
// MarkExpirePreAuthKey marks a PreAuthKey as expired.
func (h *Headscale) ExpirePreAuthKey(k *PreAuthKey) error {
2021-08-07 15:57:52 -06:00
if err := h.db.Model(&k).Update("Expiration", time.Now()).Error; err != nil {
return err
}
2021-11-14 08:46:09 -07:00
2021-08-07 15:57:52 -06:00
return nil
}
// UsePreAuthKey marks a PreAuthKey as used.
2022-05-30 07:31:06 -06:00
func (h *Headscale) UsePreAuthKey(k *PreAuthKey) error {
k.Used = true
2022-05-30 07:31:06 -06:00
if err := h.db.Save(k).Error; err != nil {
return fmt.Errorf("failed to update key used status in the database: %w", err)
}
return nil
}
2021-05-05 15:00:04 -06:00
// checkKeyValidity does the heavy lifting for validation of the PreAuthKey coming from a node
2021-11-13 01:39:04 -07:00
// If returns no error and a PreAuthKey, it can be used.
2021-05-05 15:00:04 -06:00
func (h *Headscale) checkKeyValidity(k string) (*PreAuthKey, error) {
pak := PreAuthKey{}
if result := h.db.Preload("Namespace").Preload("AclTags").First(&pak, "key = ?", k); errors.Is(
2021-11-13 01:36:45 -07:00
result.Error,
gorm.ErrRecordNotFound,
) {
2022-07-29 09:35:21 -06:00
return nil, ErrPreAuthKeyNotFound
2021-05-05 15:00:04 -06:00
}
if pak.Expiration != nil && pak.Expiration.Before(time.Now()) {
2022-07-29 09:35:21 -06:00
return nil, ErrPreAuthKeyExpired
2021-05-05 15:00:04 -06:00
}
if pak.Reusable || pak.Ephemeral { // we don't need to check if has been used before
return &pak, nil
}
machines := []Machine{}
2021-07-04 13:40:46 -06:00
if err := h.db.Preload("AuthKey").Where(&Machine{AuthKeyID: uint(pak.ID)}).Find(&machines).Error; err != nil {
return nil, err
}
if len(machines) != 0 || pak.Used {
2022-07-29 09:35:21 -06:00
return nil, ErrSingleUseAuthKeyHasBeenUsed
}
2021-05-05 15:00:04 -06:00
return &pak, nil
}
2021-04-22 16:25:01 -06:00
func (h *Headscale) generateKey() (string, error) {
size := 24
bytes := make([]byte, size)
if _, err := rand.Read(bytes); err != nil {
return "", err
}
2021-11-14 08:46:09 -07:00
2021-04-22 16:25:01 -06:00
return hex.EncodeToString(bytes), nil
}
func (key *PreAuthKey) toProto() *v1.PreAuthKey {
2021-11-08 13:48:20 -07:00
protoKey := v1.PreAuthKey{
Namespace: key.Namespace.Name,
Id: strconv.FormatUint(key.ID, Base10),
2021-11-08 13:48:20 -07:00
Key: key.Key,
Ephemeral: key.Ephemeral,
Reusable: key.Reusable,
Used: key.Used,
AclTags: make([]string, len(key.AclTags)),
}
2021-11-08 13:48:20 -07:00
if key.Expiration != nil {
protoKey.Expiration = timestamppb.New(*key.Expiration)
}
if key.CreatedAt != nil {
protoKey.CreatedAt = timestamppb.New(*key.CreatedAt)
}
if len(key.AclTags) > 0 {
for idx := range key.AclTags {
protoKey.AclTags[idx] = key.AclTags[0].Tag
}
}
2021-11-08 13:48:20 -07:00
return &protoKey
}