X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/ecf4a87ac687b713d3eb4f191f4c5ead293fa046..0561bd0c3c07257fd58ded6c7cfa5feeae97af57:/sdk/go/keepclient/perms.go

diff --git a/sdk/go/keepclient/perms.go b/sdk/go/keepclient/perms.go
index 378fdcdff8..68f0b46bea 100644
--- a/sdk/go/keepclient/perms.go
+++ b/sdk/go/keepclient/perms.go
@@ -1,3 +1,7 @@
+// Copyright (C) The Arvados Authors. All rights reserved.
+//
+// SPDX-License-Identifier: Apache-2.0
+
 // Generate and verify permission signatures for Keep locators.
 //
 // See https://dev.arvados.org/projects/arvados/wiki/Keep_locator_format
@@ -29,7 +33,7 @@ var (
 
 // makePermSignature generates a SHA-1 HMAC digest for the given blob,
 // token, expiry, and site secret.
-func makePermSignature(blobHash, apiToken, expiry string, blobSigningTTL time.Duration, permissionSecret []byte) string {
+func makePermSignature(blobHash, apiToken, expiry, blobSignatureTTL string, permissionSecret []byte) string {
 	hmac := hmac.New(sha1.New, permissionSecret)
 	hmac.Write([]byte(blobHash))
 	hmac.Write([]byte("@"))
@@ -37,7 +41,7 @@ func makePermSignature(blobHash, apiToken, expiry string, blobSigningTTL time.Du
 	hmac.Write([]byte("@"))
 	hmac.Write([]byte(expiry))
 	hmac.Write([]byte("@"))
-	hmac.Write([]byte(strconv.Itoa(int(blobSigningTTL.Seconds()))))
+	hmac.Write([]byte(blobSignatureTTL))
 	digest := hmac.Sum(nil)
 	return fmt.Sprintf("%x", digest)
 }
@@ -48,15 +52,16 @@ func makePermSignature(blobHash, apiToken, expiry string, blobSigningTTL time.Du
 //
 // This function is intended to be used by system components and admin
 // utilities: userland programs do not know the permissionSecret.
-func SignLocator(blobLocator, apiToken string, expiry time.Time, blobSigningTTL time.Duration, permissionSecret []byte) string {
+func SignLocator(blobLocator, apiToken string, expiry time.Time, blobSignatureTTL time.Duration, permissionSecret []byte) string {
 	if len(permissionSecret) == 0 || apiToken == "" {
 		return blobLocator
 	}
 	// Strip off all hints: only the hash is used to sign.
 	blobHash := strings.Split(blobLocator, "+")[0]
 	timestampHex := fmt.Sprintf("%08x", expiry.Unix())
+	blobSignatureTTLHex := strconv.FormatInt(int64(blobSignatureTTL.Seconds()), 16)
 	return blobLocator +
-		"+A" + makePermSignature(blobHash, apiToken, timestampHex, blobSigningTTL, permissionSecret) +
+		"+A" + makePermSignature(blobHash, apiToken, timestampHex, blobSignatureTTLHex, permissionSecret) +
 		"@" + timestampHex
 }
 
@@ -72,7 +77,7 @@ var signedLocatorRe = regexp.MustCompile(`^([[:xdigit:]]{32}).*\+A([[:xdigit:]]{
 //
 // This function is intended to be used by system components and admin
 // utilities: userland programs do not know the permissionSecret.
-func VerifySignature(signedLocator, apiToken string, blobSigningTTL time.Duration, permissionSecret []byte) error {
+func VerifySignature(signedLocator, apiToken string, blobSignatureTTL time.Duration, permissionSecret []byte) error {
 	matches := signedLocatorRe.FindStringSubmatch(signedLocator)
 	if matches == nil {
 		return ErrSignatureMissing
@@ -85,7 +90,8 @@ func VerifySignature(signedLocator, apiToken string, blobSigningTTL time.Duratio
 	} else if expiryTime.Before(time.Now()) {
 		return ErrSignatureExpired
 	}
-	if signatureHex != makePermSignature(blobHash, apiToken, expiryHex, blobSigningTTL, permissionSecret) {
+	blobSignatureTTLHex := strconv.FormatInt(int64(blobSignatureTTL.Seconds()), 16)
+	if signatureHex != makePermSignature(blobHash, apiToken, expiryHex, blobSignatureTTLHex, permissionSecret) {
 		return ErrSignatureInvalid
 	}
 	return nil