You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by GitBox <gi...@apache.org> on 2020/09/10 09:53:18 UTC
[GitHub] [apisix] membphis commented on a change in pull request #2192: feat: add AK/SK auth plugin
membphis commented on a change in pull request #2192:
URL: https://github.com/apache/apisix/pull/2192#discussion_r486203895
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
Review comment:
Maximum and minimum length
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
Review comment:
ditto
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
+ default = "hmac-sha256"
+ },
+ clock_skew = {
+ type = "integer",
+ default = 0
Review comment:
I think 5 `min` = 300 sec is a better default value, @nic-chen what do you think?
##########
File path: doc/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [中文](../zh-cn/plugins/hmac-auth.md)
+
+# Summary
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+
+## Name
+
+`hmac-auth` is an authentication plugin that need to work with `consumer`. Add HMAC Authentication to a `service` or `route`.
+
+The `consumer` then adds its key to request header to verify its request.
+
+## Attributes
+
+|Name |Requirement |Description|
+|--------- |--------|-----------|
+| access_key |required|Different `consumer` objects should have different values, and it should be unique. If different consumers use the same `access_key`, a request matching exception will occur|
+| secret_key |optional|Use as a pair with `access_key`|
+| algorithm | optional|Encryption algorithm. support `hmac-sha1`, `hmac-sha256` and `hmac-sha512`,`hmac-sha512` is default.|
Review comment:
`hmac-sha256` is the default one?
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
Review comment:
if they were all `hmac-*`, how about we remove the fixed prefix `hmac-`?
`{"sha1", "sha256", "sha512"}`, it looks simpler.
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
+ default = "hmac-sha256"
+ },
+ clock_skew = {
+ type = "integer",
+ default = 0
+ }
+ },
+ dependencies = {
Review comment:
I think we should use `required` which is easier to understand
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
+ default = "hmac-sha256"
+ },
+ clock_skew = {
+ type = "integer",
+ default = 0
+ }
+ },
+ dependencies = {
+ ["access_key"] = {"secret_key"},
+ ["secret_key"] = {"access_key"},
+ ["algorithm"] = {"secret_key", "access_key"}
+ }
+}
+
+local _M = {
+ version = 0.1,
+ priority = 2530,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+}
+
+local hmac_funcs = {
+ ["hmac-sha1"] = function(secret_key, message)
+ return hmac_sha1(secret_key, message)
+ end,
+ ["hmac-sha256"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA256):final(message)
+ end,
+ ["hmac-sha512"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA512):final(message)
+ end,
+}
+
+
+local function try_attr(t, ...)
+ local count = select('#', ...)
+ for i = 1, count do
+ local attr = select(i, ...)
+ t = t[attr]
+ if type(t) ~= "table" then
+ return false
+ end
+ end
+
+ return true
+end
+
+
+local create_consume_cache
Review comment:
`create_consume_cache` -> `create_consumer_cache`
##########
File path: doc/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [中文](../zh-cn/plugins/hmac-auth.md)
+
+# Summary
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+
+## Name
+
+`hmac-auth` is an authentication plugin that need to work with `consumer`. Add HMAC Authentication to a `service` or `route`.
+
+The `consumer` then adds its key to request header to verify its request.
+
+## Attributes
+
+|Name |Requirement |Description|
+|--------- |--------|-----------|
+| access_key |required|Different `consumer` objects should have different values, and it should be unique. If different consumers use the same `access_key`, a request matching exception will occur|
+| secret_key |optional|Use as a pair with `access_key`|
+| algorithm | optional|Encryption algorithm. support `hmac-sha1`, `hmac-sha256` and `hmac-sha512`,`hmac-sha512` is default.|
+| clock_skew |optional|The clock skew allowed by the signature in seconds. For example, if the time is allowed to skew by 10 seconds, then it should be set to `10`|
Review comment:
what is the default value? we need to clear it in doc
##########
File path: doc/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [中文](../zh-cn/plugins/hmac-auth.md)
+
+# Summary
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+
+## Name
+
+`hmac-auth` is an authentication plugin that need to work with `consumer`. Add HMAC Authentication to a `service` or `route`.
+
+The `consumer` then adds its key to request header to verify its request.
+
+## Attributes
+
+|Name |Requirement |Description|
+|--------- |--------|-----------|
+| access_key |required|Different `consumer` objects should have different values, and it should be unique. If different consumers use the same `access_key`, a request matching exception will occur|
+| secret_key |optional|Use as a pair with `access_key`|
+| algorithm | optional|Encryption algorithm. support `hmac-sha1`, `hmac-sha256` and `hmac-sha512`,`hmac-sha512` is default.|
+| clock_skew |optional|The clock skew allowed by the signature in seconds. For example, if the time is allowed to skew by 10 seconds, then it should be set to `10`|
+
+## How To Enable
+
+1. set a consumer and config the value of the `hmac-auth` option
+
+```shell
+curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
+{
+ "username": "jack",
+ "plugins": {
+ "hmac-auth": {
+ "access_key": "user-key",
+ "secret_key": "my-secret-key",
+ "clock_skew": 10
+ }
+ }
+}'
+```
+
+2. add a Route or add a Service , and enable the `hmac-auth` plugin
+
+```shell
+curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
+{
+ "methods": ["GET"],
Review comment:
mini case is better. let us remove `"methods": ["GET"]`
##########
File path: doc/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [中文](../zh-cn/plugins/hmac-auth.md)
+
+# Summary
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+
+## Name
+
+`hmac-auth` is an authentication plugin that need to work with `consumer`. Add HMAC Authentication to a `service` or `route`.
+
+The `consumer` then adds its key to request header to verify its request.
+
+## Attributes
+
+|Name |Requirement |Description|
+|--------- |--------|-----------|
+| access_key |required|Different `consumer` objects should have different values, and it should be unique. If different consumers use the same `access_key`, a request matching exception will occur|
+| secret_key |optional|Use as a pair with `access_key`|
Review comment:
`secret_key` should be a `required` option
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
+ default = "hmac-sha256"
+ },
+ clock_skew = {
+ type = "integer",
+ default = 0
+ }
+ },
+ dependencies = {
+ ["access_key"] = {"secret_key"},
+ ["secret_key"] = {"access_key"},
+ ["algorithm"] = {"secret_key", "access_key"}
+ }
+}
+
+local _M = {
+ version = 0.1,
+ priority = 2530,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+}
+
+local hmac_funcs = {
+ ["hmac-sha1"] = function(secret_key, message)
+ return hmac_sha1(secret_key, message)
+ end,
+ ["hmac-sha256"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA256):final(message)
+ end,
+ ["hmac-sha512"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA512):final(message)
+ end,
+}
+
+
+local function try_attr(t, ...)
+ local count = select('#', ...)
+ for i = 1, count do
+ local attr = select(i, ...)
+ t = t[attr]
+ if type(t) ~= "table" then
+ return false
+ end
+ end
+
+ return true
+end
+
+
+local create_consume_cache
+do
+ local consumer_ids = {}
+
+ function create_consume_cache(consumers)
+ core.table.clear(consumer_ids)
+
+ for _, consumer in ipairs(consumers.nodes) do
+ core.log.info("consumer node: ", core.json.delay_encode(consumer))
+ consumer_ids[consumer.auth_conf.access_key] = consumer
+ end
+
+ return consumer_ids
+ end
+
+end -- do
+
+
+function _M.check_schema(conf)
+ core.log.info("input conf: ", core.json.delay_encode(conf))
+
+ local ok, err = core.schema.check(schema, conf)
+ if not ok then
Review comment:
`return ok, err` is enough
##########
File path: apisix/plugins/hmac-auth.lua
##########
@@ -0,0 +1,291 @@
+--
+-- Licensed to the Apache Software Foundation (ASF) under one or more
+-- contributor license agreements. See the NOTICE file distributed with
+-- this work for additional information regarding copyright ownership.
+-- The ASF licenses this file to You under the Apache License, Version 2.0
+-- (the "License"); you may not use this file except in compliance with
+-- the License. You may obtain a copy of the License at
+--
+-- http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+--
+local ngx = ngx
+local type = type
+local select = select
+local abs = math.abs
+local ngx_time = ngx.time
+local str_fmt = string.format
+local ngx_re = require("ngx.re")
+local ngx_req = ngx.req
+local pairs = pairs
+local ipairs = ipairs
+local hmac_sha1 = ngx.hmac_sha1
+local escape_uri = ngx.escape_uri
+local core = require("apisix.core")
+local hmac = require("resty.hmac")
+local consumer = require("apisix.consumer")
+local ngx_decode_base64 = ngx.decode_base64
+
+local SIGNATURE_KEY = "X-HMAC-SIGNATURE"
+local ALGORITHM_KEY = "X-HMAC-ALGORITHM"
+local TIMESTAMP_KEY = "X-HMAC-TIMESTAMP"
+local ACCESS_KEY = "X-HMAC-ACCESS-KEY"
+local plugin_name = "hmac-auth"
+
+local schema = {
+ type = "object",
+ properties = {
+ access_key = {type = "string"},
+ secret_key = {type = "string"},
+ algorithm = {
+ type = "string",
+ enum = {"hmac-sha1", "hmac-sha256", "hmac-sha512"},
+ default = "hmac-sha256"
+ },
+ clock_skew = {
+ type = "integer",
+ default = 0
+ }
+ },
+ dependencies = {
+ ["access_key"] = {"secret_key"},
+ ["secret_key"] = {"access_key"},
+ ["algorithm"] = {"secret_key", "access_key"}
+ }
+}
+
+local _M = {
+ version = 0.1,
+ priority = 2530,
+ type = 'auth',
+ name = plugin_name,
+ schema = schema,
+}
+
+local hmac_funcs = {
+ ["hmac-sha1"] = function(secret_key, message)
+ return hmac_sha1(secret_key, message)
+ end,
+ ["hmac-sha256"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA256):final(message)
+ end,
+ ["hmac-sha512"] = function(secret_key, message)
+ return hmac:new(secret_key, hmac.ALGOS.SHA512):final(message)
+ end,
+}
+
+
+local function try_attr(t, ...)
+ local count = select('#', ...)
+ for i = 1, count do
+ local attr = select(i, ...)
+ t = t[attr]
+ if type(t) ~= "table" then
+ return false
+ end
+ end
+
+ return true
+end
+
+
+local create_consume_cache
+do
+ local consumer_ids = {}
+
+ function create_consume_cache(consumers)
Review comment:
ditto, we should use `consumer` here
##########
File path: doc/zh-cn/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [English](../../plugins/hmac-auth.md)
+
+# 目录
+- [**名字**](#名字)
+- [**属性**](#属性)
+- [**如何启用**](#如何启用)
+- [**测试插件**](#测试插件)
+- [**禁用插件**](#禁用插件)
+
+
+## 名字
+
+`hmac-auth` 是一个认证插件，它需要与 `consumer` 一起配合才能工作。
+
+添加 HMAC Authentication 到一个 `service` 或 `route`。 然后 `consumer` 将其签名添加到请求头以验证其请求。
+
+## 属性
+
+* `access_key`: 不同的 `consumer` 对象应有不同的值，它应当是唯一的。不同 consumer 使用了相同的 `access_key` ，将会出现请求匹配异常。
Review comment:
should use `table` way, same as English version
##########
File path: doc/plugins/hmac-auth.md
##########
@@ -0,0 +1,158 @@
+<!--
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+-->
+
+- [中文](../zh-cn/plugins/hmac-auth.md)
+
+# Summary
+- [**Name**](#name)
+- [**Attributes**](#attributes)
+- [**How To Enable**](#how-to-enable)
+- [**Test Plugin**](#test-plugin)
+- [**Disable Plugin**](#disable-plugin)
+
+
+## Name
+
+`hmac-auth` is an authentication plugin that need to work with `consumer`. Add HMAC Authentication to a `service` or `route`.
+
+The `consumer` then adds its key to request header to verify its request.
+
+## Attributes
+
+|Name |Requirement |Description|
+|--------- |--------|-----------|
+| access_key |required|Different `consumer` objects should have different values, and it should be unique. If different consumers use the same `access_key`, a request matching exception will occur|
+| secret_key |optional|Use as a pair with `access_key`|
+| algorithm | optional|Encryption algorithm. support `hmac-sha1`, `hmac-sha256` and `hmac-sha512`,`hmac-sha512` is default.|
+| clock_skew |optional|The clock skew allowed by the signature in seconds. For example, if the time is allowed to skew by 10 seconds, then it should be set to `10`|
+
+## How To Enable
+
+1. set a consumer and config the value of the `hmac-auth` option
+
+```shell
+curl http://127.0.0.1:9080/apisix/admin/consumers -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
+{
+ "username": "jack",
+ "plugins": {
+ "hmac-auth": {
+ "access_key": "user-key",
+ "secret_key": "my-secret-key",
+ "clock_skew": 10
+ }
+ }
+}'
+```
+
+2. add a Route or add a Service , and enable the `hmac-auth` plugin
+
+```shell
+curl http://127.0.0.1:9080/apisix/admin/routes/1 -H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' -X PUT -d '
+{
+ "methods": ["GET"],
+ "uri": "/index.html",
+ "plugins": {
+ "hmac-auth": {}
+ },
+ "upstream": {
+ "type": "roundrobin",
+ "nodes": {
+ "39.97.63.215:80": 1
+ }
+ }
+}'
+```
+
+## Test Plugin
+
+#### generate signature:
+The calculation formula of the signature is `signature = HMAC-SHA256-HEX(secret_key, signning_string)`. From the formula, it can be seen that in order to obtain the signature, two parameters, `SECRET_KEY` and `SIGNNING_STRING`, are required. Where secret_key is configured by the corresponding consumer, the calculation formula of `SIGNNING_STRING` is: `signning_string = HTTP Method + HTTP URI + CanonicalQueryString + HTTP BODY + ACCESS_KEY + TIMESTAMP + SECRET_KEY`
+
+1. HTTP Method
+Refers to the GET, PUT, POST and other request methods defined in the HTTP protocol, and must be in all uppercase.
+2. HTTP URI
+`HTTP URI` requirements must start with "/", those that do not start with "/" need to be added, and the empty path is "/".
+
+3. CanonicalQueryString
+`CanonicalQueryString` is the result of encoding the Query String in the URL (Query String is the string "key1 = valve1 & key2 = valve2" after the "?" in the URL).
+
+The coding steps are as follows:
+
+ Extract the Query String item in the URL, that is, the string "key1 = valve1 & key2 = valve2" after the "?" in the URL.
+ Split the Query String into several items according to the & separator, each item is in the form of key=value or only key.
+ Encoding each item after disassembly is divided into the following three situations.
+
+ When the item has only key, the conversion formula is UriEncode(key) + "=".
+ When the item is in the form of key=value, the conversion formula is in the form of UriEncode(key) + "=" + UriEncode(value). Here value can be an empty string.
+ After converting each item, sort by key in lexicographic order (ASCII code from small to large), and connect them with the & symbol to generate the corresponding CanonicalQueryString.
+
+#### Use the generated signature to try the request
+
+**Note: ACCESS_KEY, SIGNATURE, ALGORITHM, TIMESTAMP respectively represent the corresponding variables**
+
+* The signature information is put together in the request header `Authorization` field:
+
+```shell
+$ curl http://127.0.0.1:9080/index.html -H 'Authorization: hmac-auth-v1# + ACCESS_KEY + # + base64_encode(SIGNATURE) + # + ALGORITHM + # + TIMESTAMP' -i
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 13175
+...
+Accept-Ranges: bytes
+
+<!DOCTYPE html>
+<html lang="cn">
+...
+```
+
+* The signature information is separately placed in the request header:
+
+```shell
+$ curl http://127.0.0.1:9080/index.html -H 'X-HMAC-SIGNATURE: base64_encode(SIGNATURE)' -H 'X-HMAC-ALGORITHM: ALGORITHM' -H 'X-HMAC-TIMESTAMP: TIMESTAMP' -H 'X-HMAC-ACCESS-KEY: ACCESS_KEY' -i
+HTTP/1.1 200 OK
+Content-Type: text/html
+Content-Length: 13175
+...
+Accept-Ranges: bytes
+
+<!DOCTYPE html>
+<html lang="cn">
+```
+
+## Disable Plugin
+
+When you want to disable the `hmac-auth` plugin, it is very simple,
+you can delete the corresponding json configuration in the plugin configuration,
+no need to restart the service, it will take effect immediately:
+
+```shell
+$ curl http://127.0.0.1:2379/v2/keys/apisix/routes/1 -X PUT -d '
+{
+ "methods": ["GET"],
Review comment:
ditto
##########
File path: t/APISIX.pm
##########
@@ -96,6 +96,18 @@ etcd:
_EOC_
}
+my $custom_hmac_auth = $ENV{"CUSTOM_HMAC_AUTH"} || "false";
Review comment:
why we need this?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org