Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Docker authentication #926

Merged
merged 3 commits into from
Jan 24, 2025
Merged

Fix Docker authentication #926

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b7b1a53
fix docker cli authz dance
ezekg Jan 23, 2025
29653c0
add docker api version header to ping
ezekg Jan 24, 2025
2fb641a
add content digest and length headers for head
ezekg Jan 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 18 additions & 5 deletions app/controllers/api/v1/release_engines/oci/blobs_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,30 @@ class Oci::BlobsController < Api::V1::BaseController
def show
authorize! package

descriptor = authorized_scope(package.descriptors).find_by!(
descriptor = package.descriptors.find_by!(
content_digest: params[:digest],
)
authorize! descriptor

if request.head?
response.headers['Docker-Content-Digest'] = descriptor.content_digest # oras likes these
response.headers['Content-Length'] = descriptor.content_length

# see: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#checking-if-content-exists-in-the-registry
head :ok
else
redirect_to vanity_v1_account_release_artifact_url(current_account, descriptor.artifact, filename: descriptor.content_path, host: request.host),
status: :see_other
end
rescue ActionPolicy::Unauthorized
# FIXME(ezekg) docker expects a 401 Unauthorized response with an WWW-Authenticate
# challenge, so unfortunately, we can't return a 404 here like we
# usually do for unauthorized requests (so as not to leak data).
if current_bearer.nil?
render_unauthorized(code: 'UNAUTHORIZED')
else
render_forbidden(code: 'DENIED')
end
end

private
Expand All @@ -32,10 +44,11 @@ def show
def require_ee! = super(entitlements: %i[oci_engine])

def set_package
scoped_packages = authorized_scope(current_account.release_packages.oci)
.where_assoc_exists(
:descriptors, # must exist
)
# NOTE(ezekg) see above comment i.r.t. docker authentication on why we're
# skipping authorized_scope here and elsewhere
scoped_packages = current_account.release_packages.oci.where_assoc_exists(
:descriptors, # must exist
)

@package = Current.resource = FindByAliasService.call(
scoped_packages,
Expand Down
23 changes: 18 additions & 5 deletions app/controllers/api/v1/release_engines/oci/manifests_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ class Oci::ManifestsController < Api::V1::BaseController
def show
authorize! package

manifest = authorized_scope(package.manifests).find_by_reference!(params[:reference],
manifest = package.manifests.find_by_reference!(params[:reference],
accepts: request.accepts.collect(&:to_s),
prefers: %w[
application/vnd.oci.image.index.v1+json
Expand All @@ -30,11 +30,23 @@ def show
response.content_type = manifest.content_type

if request.head?
response.headers['Docker-Content-Digest'] = manifest.content_digest # oras likes these
response.headers['Content-Length'] = manifest.content_length

# see: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#checking-if-content-exists-in-the-registry
head :ok
else
render body: manifest.content
end
rescue ActionPolicy::Unauthorized
# FIXME(ezekg) docker expects a 401 Unauthorized response with an WWW-Authenticate
# challenge, so unfortunately, we can't return a 404 here like we
# usually do for unauthorized requests (so as not to leak data).
if current_bearer.nil?
render_unauthorized(code: 'UNAUTHORIZED')
else
render_forbidden(code: 'DENIED')
end
end

private
Expand All @@ -44,10 +56,11 @@ def show
def require_ee! = super(entitlements: %i[oci_engine])

def set_package
scoped_packages = authorized_scope(current_account.release_packages.oci)
.where_assoc_exists(
:manifests, # must exist
)
# NOTE(ezekg) see above comment i.r.t. docker authentication on why we're
# skipping authorized_scope here and elsewhere
scoped_packages = current_account.release_packages.oci.where_assoc_exists(
:manifests, # must exist
)

@package = Current.resource = FindByAliasService.call(
scoped_packages,
Expand Down
13 changes: 12 additions & 1 deletion app/controllers/api/v1/release_engines/oci/tags_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,15 @@ def index
name: package.key,
tags:,
}
rescue ActionPolicy::Unauthorized
# FIXME(ezekg) docker expects a 401 Unauthorized response with an WWW-Authenticate
# challenge, so unfortunately, we can't return a 404 here like we
# usually do for unauthorized requests (so as not to leak data).
if current_bearer.nil?
render_unauthorized(code: 'UNAUTHORIZED')
else
render_forbidden(code: 'DENIED')
end
end

private
Expand All @@ -31,7 +40,9 @@ def index
def require_ee! = super(entitlements: %i[oci_engine])

def set_package
scoped_packages = authorized_scope(current_account.release_packages.oci)
# NOTE(ezekg) see above comment i.r.t. docker authentication on why we're
# skipping authorized_scope here
scoped_packages = current_account.release_packages.oci

@package = Current.resource = FindByAliasService.call(
scoped_packages,
Expand Down
13 changes: 12 additions & 1 deletion app/controllers/application_controller.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,16 @@ def render_forbidden(**kwargs)
def render_unauthorized(**kwargs)
skip_verify_authorized!

self.headers['WWW-Authenticate'] = %(Bearer realm="keygen")
# FIXME(ezekg) docker wants to do a jwt token dance unless we stick to a basic
# auth scheme (which is fine since our basic auth scheme only
# supports license keys and tokens, not passwords!)
default_challenge_scheme = oci? ? 'Basic' : 'Bearer'

challenge_scheme = authentication_scheme&.capitalize || default_challenge_scheme
challenge_realm = 'keygen'
challenge = %(#{challenge_scheme} realm="#{challenge_realm}")

response.headers['WWW-Authenticate'] = challenge
Copy link
Member Author

@ezekg ezekg Jan 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should probably refactor this challenge logic out into the authentication concern.


respond_to do |format|
format.any {
Expand Down Expand Up @@ -567,6 +576,8 @@ def rescue_from_exceptions
)
end

def oci? = request.subdomain == 'oci.pkg'

def prefers?(preference)
preferences = request.headers.fetch('Prefer') { request.query_parameters.fetch(:prefer, '').to_s }
.split(',')
Expand Down
4 changes: 4 additions & 0 deletions app/models/release_package.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ class ReleasePackage < ApplicationRecord
to: :engine,
allow_nil: true

delegate :open?, :closed?, :licensed?,
to: :product,
allow_nil: true

def engine_id? = release_engine_id?
def engine_id = release_engine_id
def engine_id=(id)
Expand Down
8 changes: 4 additions & 4 deletions app/policies/product_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@ def index?
case bearer
in role: Role(:admin | :developer | :sales_agent | :support_agent | :read_only | :environment)
allow!
in role: Role(:user) if record.all? { _1.open? || _1.id.in?(bearer.product_ids) }
in role: Role(:user) if record.all? { _1.open? || _1.licensed? && _1.id.in?(bearer.product_ids) }
allow!
in role: Role(:license) if record.all? { _1.open? || _1 == bearer.product }
in role: Role(:license) if record.all? { _1.open? || _1.licensed? && _1 == bearer.product }
allow!
else
deny!
Expand All @@ -50,9 +50,9 @@ def show?
allow!
in role: Role(:product) if record == bearer
allow!
in role: Role(:user) if record.open? || bearer.products.exists?(record.id)
in role: Role(:user) if record.open? || record.licensed? && bearer.products.exists?(record.id)
allow!
in role: Role(:license) if record.open? || record == bearer.product
in role: Role(:license) if record.open? || record.licensed? && record == bearer.product
allow!
else
deny!
Expand Down
8 changes: 6 additions & 2 deletions app/policies/products/release_artifact_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,10 @@ def index?
allow? :index, record, skip_verify_permissions: true, with: ::ReleaseArtifactPolicy
in role: Role(:license) if product.open? || product == bearer.product
allow? :index, record, skip_verify_permissions: true, with: ::ReleaseArtifactPolicy
in nil if product.open? && record.none?(&:constraints?)
allow!
else
product.open? && record.none?(&:constraints?)
deny!
end
end

Expand All @@ -41,8 +43,10 @@ def show?
allow? :show, record, skip_verify_permissions: true, with: ::ReleaseArtifactPolicy
in role: Role(:license) if product.open? || product == bearer.product
allow? :show, record, skip_verify_permissions: true, with: ::ReleaseArtifactPolicy
in nil if product.open? && record.constraints.none?
allow!
else
product.open? && record.constraints.none?
deny!
end
end
end
Expand Down
8 changes: 6 additions & 2 deletions app/policies/products/release_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,10 @@ def index?
allow? :index, record, skip_verify_permissions: true, with: ::ReleasePolicy
in role: Role(:license) if product.open? || product == bearer.product
allow? :index, record, skip_verify_permissions: true, with: ::ReleasePolicy
in nil if product.open? && record.none?(&:constraints?)
allow!
else
product.open? && record.none?(&:constraints?)
deny!
end
end

Expand All @@ -41,8 +43,10 @@ def show?
allow? :show, record, skip_verify_permissions: true, with: ::ReleasePolicy
in role: Role(:license) if product.open? || product == bearer.product
allow? :show, record, skip_verify_permissions: true, with: ::ReleasePolicy
in nil if product.open? && record.constraints.none?
allow!
else
product.open? && record.constraints.none?
deny!
end
end
end
Expand Down
16 changes: 10 additions & 6 deletions app/policies/release_package_policy.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,14 @@ def index?
allow!
in role: Role(:product) if record.all? { _1.product == bearer }
allow!
in role: Role(:user) if record.all? { _1.product.open? || _1.product_id.in?(bearer.product_ids) }
in role: Role(:user) if record.all? { _1.open? || _1.licensed? && _1.product_id.in?(bearer.product_ids) }
allow!
in role: Role(:license) if record.all? { _1.product.open? || _1.product == bearer.product }
in role: Role(:license) if record.all? { _1.open? || _1.licensed? && _1.product == bearer.product }
allow!
in nil if record.all?(&:open?)
allow!
else
record.all? { _1.product.open? }
deny!
end
end

Expand All @@ -54,12 +56,14 @@ def show?
allow!
in role: Role(:product) if record.product == bearer
allow!
in role: Role(:user) if record.product.open? || bearer.products.exists?(record.product_id)
in role: Role(:user) if record.open? || record.licensed? && bearer.products.exists?(record.product_id)
allow!
in role: Role(:license) if record.product.open? || record.product == bearer.product
in role: Role(:license) if record.open? || record.licensed? && record.product == bearer.product
allow!
in nil if record.open?
allow!
else
record.product.open?
deny!
end
end

Expand Down
3 changes: 2 additions & 1 deletion config/routes.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -664,8 +664,9 @@
scope module: 'api/v1/release_engines', constraints: { subdomain: 'oci.pkg' } do
# NOTE(ezekg) /v2 namespace is handled here because docker wants it at the root...
scope :v2 do
# see: https://github.com/distribution/distribution/blob/main/docs/content/spec/api.md#api-version-check
# see: https://github.com/opencontainers/distribution-spec/blob/main/spec.md#endpoints
match '/', via: %i[head get], to: -> env { [200, {}, []] }
match '/', via: %i[head get], to: -> env { [200, {'Docker-Distribution-Api-Version': 'registry/2.0'}, []] }

case
when Keygen.multiplayer?
Expand Down
Loading
Loading