Line data    Source code

       1              : use super::{
       2              :     ComputeCredentialKeys, ComputeCredentials, ComputeUserInfo, ComputeUserInfoNoEndpoint,
       3              : };
       4              : use crate::{
       5              :     auth::{self, AuthFlow},
       6              :     console::AuthSecret,
       7              :     context::RequestMonitoring,
       8              :     sasl,
       9              :     stream::{self, Stream},
      10              : };
      11              : use tokio::io::{AsyncRead, AsyncWrite};
      12              : use tracing::{info, warn};
      13              : 
      14              : /// Compared to [SCRAM](crate::scram), cleartext password auth saves
      15              : /// one round trip and *expensive* computations (>= 4096 HMAC iterations).
      16              : /// These properties are benefical for serverless JS workers, so we
      17              : /// use this mechanism for websocket connections.
      18            0 : pub async fn authenticate_cleartext(
      19            0 :     ctx: &mut RequestMonitoring,
      20            0 :     info: ComputeUserInfo,
      21            0 :     client: &mut stream::PqStream<Stream<impl AsyncRead + AsyncWrite + Unpin>>,
      22            0 :     secret: AuthSecret,
      23            0 : ) -> auth::Result<ComputeCredentials> {
      24            0 :     warn!("cleartext auth flow override is enabled, proceeding");
      25            0 :     ctx.set_auth_method(crate::context::AuthMethod::Cleartext);
      26            0 : 
      27            0 :     // pause the timer while we communicate with the client
      28            0 :     let _paused = ctx.latency_timer.pause();
      29              : 
      30            0 :     let auth_outcome = AuthFlow::new(client)
      31            0 :         .begin(auth::CleartextPassword(secret))
      32            0 :         .await?
      33            0 :         .authenticate()
      34            0 :         .await?;
      35              : 
      36            0 :     let keys = match auth_outcome {
      37            0 :         sasl::Outcome::Success(key) => key,
      38            0 :         sasl::Outcome::Failure(reason) => {
      39            0 :             info!("auth backend failed with an error: {reason}");
      40            0 :             return Err(auth::AuthError::auth_failed(&*info.user));
      41              :         }
      42              :     };
      43              : 
      44            0 :     Ok(ComputeCredentials { info, keys })
      45            0 : }
      46              : 
      47              : /// Workaround for clients which don't provide an endpoint (project) name.
      48              : /// Similar to [`authenticate_cleartext`], but there's a specific password format,
      49              : /// and passwords are not yet validated (we don't know how to validate them!)
      50            3 : pub async fn password_hack_no_authentication(
      51            3 :     ctx: &mut RequestMonitoring,
      52            3 :     info: ComputeUserInfoNoEndpoint,
      53            3 :     client: &mut stream::PqStream<Stream<impl AsyncRead + AsyncWrite + Unpin>>,
      54            3 : ) -> auth::Result<ComputeCredentials> {
      55            3 :     warn!("project not specified, resorting to the password hack auth flow");
      56            3 :     ctx.set_auth_method(crate::context::AuthMethod::Cleartext);
      57            3 : 
      58            3 :     // pause the timer while we communicate with the client
      59            3 :     let _paused = ctx.latency_timer.pause();
      60              : 
      61            3 :     let payload = AuthFlow::new(client)
      62            3 :         .begin(auth::PasswordHack)
      63            0 :         .await?
      64            3 :         .get_password()
      65            3 :         .await?;
      66              : 
      67            2 :     info!(project = &*payload.endpoint, "received missing parameter");
      68              : 
      69              :     // Report tentative success; compute node will check the password anyway.
      70            2 :     Ok(ComputeCredentials {
      71            2 :         info: ComputeUserInfo {
      72            2 :             user: info.user,
      73            2 :             options: info.options,
      74            2 :             endpoint: payload.endpoint,
      75            2 :         },
      76            2 :         keys: ComputeCredentialKeys::Password(payload.password),
      77            2 :     })
      78            3 : }