blob: 517d5dbec3abf4357aef651d311b6d1bca2c2774 [file] [log] [blame]
// Copyright (C) 2011 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package com.google.gerrit.httpd;
import static com.google.common.base.MoreObjects.firstNonNull;
import static com.google.common.base.Strings.emptyToNull;
import static com.google.common.net.HttpHeaders.AUTHORIZATION;
import static com.google.gerrit.extensions.api.lfs.LfsDefinitions.CONTENTTYPE_VND_GIT_LFS_JSON;
import static com.google.gerrit.httpd.GerritAuthModule.NOT_AUTHORIZED_LFS_URL_REGEX;
import static javax.servlet.http.HttpServletResponse.SC_FORBIDDEN;
import static javax.servlet.http.HttpServletResponse.SC_UNAUTHORIZED;
import com.google.common.base.Strings;
import com.google.gerrit.extensions.registration.DynamicItem;
import com.google.gerrit.httpd.restapi.RestApiServlet;
import com.google.gerrit.server.AccessPath;
import com.google.gerrit.server.account.AccountCache;
import com.google.gerrit.server.account.AccountState;
import com.google.gerrit.server.config.AuthConfig;
import com.google.gerrit.server.config.GerritServerConfig;
import com.google.inject.Inject;
import com.google.inject.Singleton;
import java.io.IOException;
import java.util.Locale;
import java.util.Optional;
import java.util.regex.Pattern;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.eclipse.jgit.lib.Config;
/**
* Trust the authentication which is done by the container.
*
* <p>Check whether the container has already authenticated the user. If yes, then lookup the
* account and set the account ID in our current session.
*
* <p>This filter should only be configured to run, when authentication is configured to trust
* container authentication. This filter is intended to protect the {@link GitOverHttpServlet} and
* its handled URLs, which provide remote repository access over HTTP. It also protects {@link
* RestApiServlet}.
*/
@Singleton
class ContainerAuthFilter implements Filter {
private static final String LFS_AUTH_PREFIX = "Ssh: ";
private static final Pattern LFS_ENDPOINT = Pattern.compile(NOT_AUTHORIZED_LFS_URL_REGEX);
private final DynamicItem<WebSession> session;
private final AccountCache accountCache;
private final Config config;
private final String loginHttpHeader;
@Inject
ContainerAuthFilter(
DynamicItem<WebSession> session,
AccountCache accountCache,
AuthConfig authConfig,
@GerritServerConfig Config config) {
this.session = session;
this.accountCache = accountCache;
this.config = config;
loginHttpHeader = firstNonNull(emptyToNull(authConfig.getLoginHttpHeader()), AUTHORIZATION);
}
@Override
public void init(FilterConfig config) {}
@Override
public void destroy() {}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse rsp = (HttpServletResponse) response;
if (verify(req, rsp)) {
chain.doFilter(req, response);
}
}
private boolean verify(HttpServletRequest req, HttpServletResponse rsp) throws IOException {
String username = RemoteUserUtil.getRemoteUser(req, loginHttpHeader);
if (username == null) {
if (isLfsOverSshRequest(req)) {
// LFS-over-SSH auth request cannot be authorized by container
// therefore let it go through the filter
return true;
}
rsp.sendError(SC_FORBIDDEN);
return false;
}
if (config.getBoolean("auth", "userNameToLowerCase", false)) {
username = username.toLowerCase(Locale.US);
}
Optional<AccountState> who =
accountCache.getByUsername(username).filter(a -> a.account().isActive());
if (!who.isPresent()) {
rsp.sendError(SC_UNAUTHORIZED);
return false;
}
WebSession ws = session.get();
ws.setUserAccountId(who.get().account().id());
ws.setAccessPathOk(AccessPath.GIT, true);
ws.setAccessPathOk(AccessPath.REST_API, true);
return true;
}
private static boolean isLfsOverSshRequest(HttpServletRequest req) {
String hdr = req.getHeader(AUTHORIZATION);
return CONTENTTYPE_VND_GIT_LFS_JSON.equals(req.getContentType())
&& !Strings.isNullOrEmpty(hdr)
&& hdr.startsWith(LFS_AUTH_PREFIX)
&& LFS_ENDPOINT.matcher(req.getRequestURI()).matches();
}
}