Skip to content

Commit 4abb319

Browse files
Dylan Souzaezelkow1
authored andcommitted
Backport of all uri-signing changes in to 8.1.x
List of included PRs: - #6363 (partial pick) - #6420 - #6419 - #6354 - #6252 - #4513 - #4603 - #4750 (partial pick) - #4604 - #4540 - #4777 - #4862 - #4814 - #4802 - #4897 - #4988 - #5034 - #5140 - #5112 - #4895 - #5834 (partial pick) - #6061 - #6210 (partial pick) - #6265 (partial pick) - #6282 (partial pick) Updating uri_signing docs to reflect new RFC changes (cherry picked from commit 90e51a2) Add normalization the URI before cdniuc validation (cherry picked from commit b39b0f7) JWT Parser strips token from URI and places in buffer (cherry picked from commit 5f9d358) Use POSIX ERE for uri signing regex evaluation (cherry picked from commit be56b3a) Implement nbf claim in Uri Signing Plugin (cherry picked from commit d9dc0f4) Implement aud claim in Uri Signing Plugin The Aud claim is implemented as per the RFC version 16 that can be found here:https://tools.ietf.org/html/draft-ietf-cdni-uri-signing-16 As per the specification, the aud claim can be either a JSON array or a string. The aud claim is stored as raw json in the jwt class in this implementation. It is converted either to an array or a string at validation time. This commit also expands the unit tests quite a bit. Test configs can be provided in the unit_tests directory and parsed in the test framework. JWS validation is also testable now. This commit also fixes two memory leaks 1. Issuers were never being freed on configuration cleanup. 2. Token renewal allocates a tmp json_object without freeing. (cherry picked from commit 012d437) cdniuc is not a manditory claim With Internet Draft 16 for uri signing, the cdniuc claim is not manditory. It took the place of the manditory sub claim in draft 12, and the manditory nature of the sub claim was still in effect. This change allows for tokens to not contain the cdniuc claim and also renews the cdniuc and cdnistd claim on token renewal. (cherry picked from commit fa53771) add --with-jansson and --with-cjose options, document sample commands for building and configuring both locally (cherry picked from commit 0cce83c) Strip token from upstream if conifigured and dynamically allocate string buffers Adds a configuration option to strip uri signing tokens from both the cache key URL and the upstream URL. Additionally it was pointed out that some statically allocated buffers were too small in some of the string manipulating functions (normalize and strip token). These buffers are now dynamically allocated since the maximum buffer size is known for these. (cherry picked from commit 192dc83) Cherry-pick from commit 4cfd5a7 Add Example URI Signer Python Script Provide an example script to be used in conjunction with the uri signing plugin. This script is meant to serve as an example of how to get started with uri signing and could be useful in testing various configs. (cherry picked from commit 3632eb7) Cherry-pick from commit 9c1b88a Cherry-pick from commit a139fd1 Cherry-pick from commit c07474d Add simple autest and subsequent fixes (cherry picked from commit ea3aa04) Cherry-pick from commit 6d64842 URI Sig Null Check for Clang Warning (#6419) This commit adds a missing null check in the uri normalization function. This was caught by the clang analyzer. (cherry picked from commit 2de1c35) Syntax Error fixed in URI sig Plugin (#6420) (cherry picked from commit c154d40) Change gold files to be less restrictive since some of the headers include can be in a different order (#6410) (cherry picked from commit 4bdde5d) Add a dummy cachekey usage to handle the effective vs pristine url issue that exists in 8x where the first plugin gets a different url then subsequent ones. This is not needed on 9x+
1 parent e8055c8 commit 4abb319

35 files changed

Lines changed: 2518 additions & 147 deletions

.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ plugins/esi/vars_test
122122
plugins/experimental/slice/test_config
123123
plugins/experimental/slice/test_content_range
124124
plugins/experimental/slice/test_range
125+
plugins/experimental/uri_signing/test_uri_signing
125126

126127
mgmt/api/traffic_api_cli_remote
127128
mgmt/tools/traffic_mcast_snoop

build/cjose.m4

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
dnl -------------------------------------------------------- -*- autoconf -*-
2+
dnl Licensed to the Apache Software Foundation (ASF) under one or more
3+
dnl contributor license agreements. See the NOTICE file distributed with
4+
dnl this work for additional information regarding copyright ownership.
5+
dnl The ASF licenses this file to You under the Apache License, Version 2.0
6+
dnl (the "License"); you may not use this file except in compliance with
7+
dnl the License. You may obtain a copy of the License at
8+
dnl
9+
dnl http://www.apache.org/licenses/LICENSE-2.0
10+
dnl
11+
dnl Unless required by applicable law or agreed to in writing, software
12+
dnl distributed under the License is distributed on an "AS IS" BASIS,
13+
dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
dnl See the License for the specific language governing permissions and
15+
dnl limitations under the License.
16+
17+
dnl
18+
dnl cjose.m4: Trafficserver's cjose autoconf macros
19+
dnl
20+
21+
dnl
22+
dnl TS_CHECK_CJOSE: look for cjose libraries and headers
23+
dnl
24+
25+
AC_DEFUN([TS_CHECK_CJOSE], [
26+
AC_MSG_CHECKING([for --with-cjose])
27+
AC_ARG_WITH(
28+
[cjose],
29+
[AS_HELP_STRING([--with-cjose=DIR], [use a specific cjose library])],
30+
[ LDFLAGS="$LDFLAGS -L$with_cjose/lib";
31+
CFLAGS="$CFLAGS -I$with_cjose/include/";
32+
CPPFLAGS="$CPPFLAGS -I$with_cjose/include/";
33+
AC_MSG_RESULT([$with_cjose])
34+
],
35+
[ AC_MSG_RESULT([no])]
36+
)
37+
38+
AC_CHECK_HEADERS([cjose/cjose.h], [
39+
AC_MSG_CHECKING([whether cjose is dynamic])
40+
TS_LINK_WITH_FLAGS_IFELSE([-fPIC -lcjose -ljansson -lcrypto],[AC_LANG_PROGRAM(
41+
[#include <cjose/cjose.h>],
42+
[(void) cjose_jws_import("", 0, NULL);])],
43+
[AC_MSG_RESULT([yes]); LIBCJOSE=-lcjose],
44+
[AC_MSG_RESULT([no]); LIBCJOSE=-l:libcjose.a])
45+
],
46+
[LIBCJOSE=])
47+
])

build/hiredis.m4

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
dnl -------------------------------------------------------- -*- autoconf -*-
2+
dnl Licensed to the Apache Software Foundation (ASF) under one or more
3+
dnl contributor license agreements. See the NOTICE file distributed with
4+
dnl this work for additional information regarding copyright ownership.
5+
dnl The ASF licenses this file to You under the Apache License, Version 2.0
6+
dnl (the "License"); you may not use this file except in compliance with
7+
dnl the License. You may obtain a copy of the License at
8+
dnl
9+
dnl http://www.apache.org/licenses/LICENSE-2.0
10+
dnl
11+
dnl Unless required by applicable law or agreed to in writing, software
12+
dnl distributed under the License is distributed on an "AS IS" BASIS,
13+
dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
dnl See the License for the specific language governing permissions and
15+
dnl limitations under the License.
16+
17+
dnl
18+
dnl hiredis.m4: Trafficserver's hiredis autoconf macros
19+
dnl
20+
21+
dnl
22+
dnl TS_CHECK_HIREDIS: look for hiredis libraries and headers
23+
dnl
24+
25+
AC_DEFUN([TS_CHECK_HIREDIS], [
26+
hiredis_base_dir='/usr'
27+
has_hiredis=0
28+
AC_ARG_WITH(hiredis, [AC_HELP_STRING([--with-hiredis=DIR],[use a specific hiredis library])],
29+
[
30+
has_hiredis=1
31+
if test "x$withval" != "xyes" && test "x$withval" != "x"; then
32+
hiredis_base_dir="$withval"
33+
if test "$withval" != "no"; then
34+
case "$withval" in
35+
*":"*)
36+
hiredis_include="`echo $withval |sed -e 's/:.*$//'`"
37+
hiredis_ldflags="`echo $withval |sed -e 's/^.*://'`"
38+
AC_MSG_CHECKING(checking for hiredis includes in $hiredis_include libs in $hiredis_ldflags )
39+
;;
40+
*)
41+
hiredis_include="$withval/include"
42+
hiredis_ldflags="$withval/lib"
43+
AC_MSG_CHECKING(checking for hiredis includes in $withval)
44+
;;
45+
esac
46+
fi
47+
fi
48+
49+
if test -d $hiredis_include && test -d $hiredis_ldflags && test -f $hiredis_include/hiredis/hiredis.h; then
50+
AC_MSG_RESULT([ok])
51+
else
52+
has_hiredis=0
53+
AC_MSG_RESULT([not found])
54+
fi
55+
56+
if test "$has_hiredis" != "0"; then
57+
saved_ldflags=$LDFLAGS
58+
saved_cppflags=$CPPFLAGS
59+
hiredis_have_headers=0
60+
hiredis_have_libs=0
61+
if test "$hiredis_base_dir" != "/usr"; then
62+
TS_ADDTO(CPPFLAGS, [-I${hiredis_include}])
63+
TS_ADDTO(LDFLAGS, [-L${hiredis_ldflags}])
64+
TS_ADDTO_RPATH(${hiredis_ldflags})
65+
fi
66+
67+
AC_CHECK_LIB([hiredis], redisConnect, [hiredis_have_libs=1])
68+
if test "$hiredis_have_libs" != "0"; then
69+
AC_CHECK_HEADERS(hiredis/hiredis.h, [hiredis_have_headers=1])
70+
fi
71+
if test "$hiredis_have_headers" != "0"; then
72+
AC_SUBST([LIB_HIREDIS], [-lhiredis])
73+
AC_SUBST([CFLAGS_HIREDIS], [-I${hiredis_include}])
74+
else
75+
has_hiredis=0
76+
CPPFLAGS=$saved_cppflags
77+
LDFLAGS=$saved_ldflags
78+
fi
79+
fi
80+
],
81+
[
82+
has_hiredis=1
83+
AC_CHECK_HEADER([hiredis/hiredis.h], [], [has_hiredis=0])
84+
AC_CHECK_LIB([hiredis], redisConnect, [], [has_hiredis=0])
85+
86+
if test "x$has_hiredis" == "x1"; then
87+
AC_SUBST([LIB_HIREDIS], [-lhiredis])
88+
fi
89+
])
90+
91+
])
92+
93+

build/jansson.m4

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
dnl -------------------------------------------------------- -*- autoconf -*-
2+
dnl Licensed to the Apache Software Foundation (ASF) under one or more
3+
dnl contributor license agreements. See the NOTICE file distributed with
4+
dnl this work for additional information regarding copyright ownership.
5+
dnl The ASF licenses this file to You under the Apache License, Version 2.0
6+
dnl (the "License"); you may not use this file except in compliance with
7+
dnl the License. You may obtain a copy of the License at
8+
dnl
9+
dnl http://www.apache.org/licenses/LICENSE-2.0
10+
dnl
11+
dnl Unless required by applicable law or agreed to in writing, software
12+
dnl distributed under the License is distributed on an "AS IS" BASIS,
13+
dnl WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
dnl See the License for the specific language governing permissions and
15+
dnl limitations under the License.
16+
17+
dnl
18+
dnl jansson.m4: Trafficserver's jansson autoconf macros
19+
dnl
20+
21+
dnl
22+
dnl TS_CHECK_JANSSON: look for jansson libraries and headers
23+
dnl
24+
25+
AC_DEFUN([TS_CHECK_JANSSON], [
26+
AC_MSG_CHECKING([for --with-jansson])
27+
AC_ARG_WITH(
28+
[jansson],
29+
[AS_HELP_STRING([--with-jansson], [use a specific jansson library])],
30+
[ LDFLAGS="$LDFLAGS -L$with_jansson/lib";
31+
CFLAGS="$CFLAGS -I$with_jansson/include/";
32+
CPPFLAGS="$CPPFLAGS -I$with_jansson/include/";
33+
AC_MSG_RESULT([$with_jansson])
34+
],
35+
[ AC_MSG_RESULT([no])]
36+
)
37+
38+
AC_CHECK_HEADERS([jansson.h], [
39+
AC_MSG_CHECKING([whether jansson is dynamic])
40+
TS_LINK_WITH_FLAGS_IFELSE([-fPIC -ljansson],[AC_LANG_PROGRAM(
41+
[#include <jansson.h>],
42+
[(void) json_object();])],
43+
[AC_MSG_RESULT([yes]); LIBJANSSON=-ljansson],
44+
[AC_MSG_RESULT([no]); LIBJANSSON=-l:libjansson.a])
45+
],
46+
[LIBJANSSON=])
47+
])

configure.ac

Lines changed: 7 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1316,27 +1316,15 @@ TS_CHECK_LUAJIT
13161316
# Enable experimental/uri_singing plugin
13171317
# This is here, instead of above, because it needs to know if PCRE is available.
13181318
#
1319-
AC_CHECK_HEADERS([jansson.h], [
1320-
AC_MSG_CHECKING([whether jansson is dynamic])
1321-
TS_LINK_WITH_FLAGS_IFELSE([-fPIC -ljansson],[AC_LANG_PROGRAM(
1322-
[#include <jansson.h>],
1323-
[(void) json_object();])],
1324-
[AC_MSG_RESULT([yes]); LIBJANSSON=-ljansson],
1325-
[AC_MSG_RESULT([no]); LIBJANSSON=-l:libjansson.a])
1326-
],
1327-
[LIBJANSSON=])
1328-
1329-
AC_CHECK_HEADERS([cjose/cjose.h], [
1330-
AC_MSG_CHECKING([whether cjose is dynamic])
1331-
TS_LINK_WITH_FLAGS_IFELSE([-fPIC -lcjose],[AC_LANG_PROGRAM(
1332-
[#include <cjose/cjose.h>],
1333-
[(void) cjose_jws_import("", 0, NULL);])],
1334-
[AC_MSG_RESULT([yes]); LIBCJOSE=-lcjose],
1335-
[AC_MSG_RESULT([no]); LIBCJOSE=-l:libcjose.a])
1336-
],
1337-
[LIBCJOSE=])
1319+
1320+
#### Check for optional jansson library (uri_signing)
1321+
TS_CHECK_JANSSON
1322+
13381323
AC_CHECK_LIB([crypto],[HMAC],[has_libcrypto=1],[has_libcrypto=0])
13391324

1325+
#### Check for optional cjose library (uri_signing)
1326+
TS_CHECK_CJOSE
1327+
13401328
AM_CONDITIONAL([BUILD_URI_SIGNING_PLUGIN], [test ! -z "${LIBCJOSE}" -a ! -z "${LIBJANSSON}" -a "x${enable_pcre}" = "xyes" -a "x${has_libcrypto}" = "x1"])
13411329
AC_SUBST([LIBCJOSE])
13421330
AC_SUBST([LIBJANSSON])

plugins/experimental/uri_signing/Makefile.inc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,22 @@ experimental_uri_signing_uri_signing_la_SOURCES = \
2323
experimental/uri_signing/jwt.c \
2424
experimental/uri_signing/match.c \
2525
experimental/uri_signing/parse.c \
26+
experimental/uri_signing/normalize.c \
2627
experimental/uri_signing/timing.c
2728

2829
experimental_uri_signing_uri_signing_la_LIBADD = @LIBJANSSON@ @LIBCJOSE@ @LIBPCRE@ -lm -lcrypto
30+
31+
check_PROGRAMS += experimental/uri_signing/test_uri_signing
32+
33+
experimental_uri_signing_test_uri_signing_CPPFLAGS = $(AM_CPPFLAGS) -I$(abs_top_srcdir)/tests/include -DURI_SIGNING_UNIT_TEST
34+
experimental_uri_signing_test_uri_signing_LDADD = @LIBJANSSON@ @LIBCJOSE@ @LIBPCRE@ -lm -lcrypto
35+
experimental_uri_signing_test_uri_signing_SOURCES = \
36+
experimental/uri_signing/unit_tests/uri_signing_test.cc \
37+
experimental/uri_signing/jwt.c \
38+
experimental/uri_signing/common.c \
39+
experimental/uri_signing/parse.c \
40+
experimental/uri_signing/cookie.c \
41+
experimental/uri_signing/config.c \
42+
experimental/uri_signing/timing.c \
43+
experimental/uri_signing/normalize.c \
44+
experimental/uri_signing/match.c

0 commit comments

Comments
 (0)