Merge branch '17598-keep-web-url' refs #17598

Arvados-DCO-1.1-Signed-off-by: Peter Amstutz <peter.amstutz@curii.com>

diff --git a/services/keep-web/handler.go b/services/keep-web/handler.go
index 94b59ebd41ea843d80cf32fade7e5dd6168a225e..754aefe44bbb03eda7c6816c1c7b24154d087e15 100644 (file)
--- a/services/keep-web/handler.go
+++ b/services/keep-web/handler.go
@@ -6,6 +6,7 @@ package main
 
 import (
        "encoding/json"
+       "fmt"
        "html"
        "html/template"
        "io"
@@ -184,6 +185,16 @@ var (
        }
 )
 
+func stripDefaultPort(host string) string {
+       // Will consider port 80 and port 443 to be the same vhost.  I think that's fine.
+       u := &url.URL{Host: host}
+       if p := u.Port(); p == "80" || p == "443" {
+               return u.Hostname()
+       } else {
+               return host
+       }
+}
+
 // ServeHTTP implements http.Handler.
 func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        h.setupOnce.Do(h.setup)
@@ -240,14 +251,20 @@ func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        var attachment bool
        var useSiteFS bool
        credentialsOK := h.Config.cluster.Collections.TrustAllContent
+       reasonNotAcceptingCredentials := ""
 
-       if r.Host != "" && r.Host == h.Config.cluster.Services.WebDAVDownload.ExternalURL.Host {
+       if r.Host != "" && stripDefaultPort(r.Host) == stripDefaultPort(h.Config.cluster.Services.WebDAVDownload.ExternalURL.Host) {
                credentialsOK = true
                attachment = true
        } else if r.FormValue("disposition") == "attachment" {
                attachment = true
        }
 
+       if !credentialsOK {
+               reasonNotAcceptingCredentials = fmt.Sprintf("vhost %q does not specify a single collection ID or match Services.WebDAVDownload.ExternalURL %q, and Collections.TrustAllContent is false",
+                       r.Host, h.Config.cluster.Services.WebDAVDownload.ExternalURL)
+       }
+
        if collectionID = parseCollectionIDFromDNSName(r.Host); collectionID != "" {
                // http://ID.collections.example/PATH...
                credentialsOK = true
@@ -278,6 +295,7 @@ func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
                        // data. Tokens provided with the request are
                        // ignored.
                        credentialsOK = false
+                       reasonNotAcceptingCredentials = "the '/collections/UUID/PATH' form only works for public data"
                }
        }
 
@@ -346,7 +364,19 @@ func (h *handler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        }
 
        if tokens == nil {
-               tokens = append(reqTokens, h.Config.cluster.Users.AnonymousUserToken)
+               tokens = reqTokens
+               if h.Config.cluster.Users.AnonymousUserToken != "" {
+                       tokens = append(tokens, h.Config.cluster.Users.AnonymousUserToken)
+               }
+       }
+
+       if tokens == nil {
+               if !credentialsOK {
+                       http.Error(w, fmt.Sprintf("Authorization tokens are not accepted here: %v, and no anonymous user token is configured.", reasonNotAcceptingCredentials), http.StatusUnauthorized)
+               } else {
+                       http.Error(w, fmt.Sprintf("No authorization token in request, and no anonymous user token is configured."), http.StatusUnauthorized)
+               }
+               return
        }
 
        if len(targetPath) > 0 && targetPath[0] == "_" {

diff --git a/services/keep-web/handler_test.go b/services/keep-web/handler_test.go
index 9252bd82d7e15cb86424106c1c76a5009061189f..4560adc68c0c89a1561a165dfb078cc3f88174a3 100644 (file)
--- a/services/keep-web/handler_test.go
+++ b/services/keep-web/handler_test.go
@@ -193,11 +193,18 @@ func (s *IntegrationSuite) TestVhost404(c *check.C) {
 // the token is invalid.
 type authorizer func(*http.Request, string) int
 
-func (s *IntegrationSuite) TestVhostViaAuthzHeader(c *check.C) {
-       s.doVhostRequests(c, authzViaAuthzHeader)
+func (s *IntegrationSuite) TestVhostViaAuthzHeaderOAuth2(c *check.C) {
+       s.doVhostRequests(c, authzViaAuthzHeaderOAuth2)
 }
-func authzViaAuthzHeader(r *http.Request, tok string) int {
-       r.Header.Add("Authorization", "OAuth2 "+tok)
+func authzViaAuthzHeaderOAuth2(r *http.Request, tok string) int {
+       r.Header.Add("Authorization", "Bearer "+tok)
+       return http.StatusUnauthorized
+}
+func (s *IntegrationSuite) TestVhostViaAuthzHeaderBearer(c *check.C) {
+       s.doVhostRequests(c, authzViaAuthzHeaderBearer)
+}
+func authzViaAuthzHeaderBearer(r *http.Request, tok string) int {
+       r.Header.Add("Authorization", "Bearer "+tok)
        return http.StatusUnauthorized
 }
 
@@ -319,6 +326,28 @@ func (s *IntegrationSuite) doVhostRequestsWithHostPath(c *check.C, authz authori
        }
 }
 
+func (s *IntegrationSuite) TestVhostPortMatch(c *check.C) {
+       for _, port := range []string{"80", "443", "8000"} {
+               s.testServer.Config.cluster.Services.WebDAVDownload.ExternalURL.Host = fmt.Sprintf("download.example.com:%v", port)
+               u := mustParseURL(fmt.Sprintf("http://download.example.com/by_id/%v/foo", arvadostest.FooCollection))
+               req := &http.Request{
+                       Method:     "GET",
+                       Host:       u.Host,
+                       URL:        u,
+                       RequestURI: u.RequestURI(),
+                       Header:     http.Header{"Authorization": []string{"Bearer " + arvadostest.ActiveToken}},
+               }
+               req, resp := s.doReq(req)
+               code, _ := resp.Code, resp.Body.String()
+
+               if port == "8000" {
+                       c.Check(code, check.Equals, 401)
+               } else {
+                       c.Check(code, check.Equals, 200)
+               }
+       }
+}
+
 func (s *IntegrationSuite) doReq(req *http.Request) (*http.Request, *httptest.ResponseRecorder) {
        resp := httptest.NewRecorder()
        s.testServer.Handler.ServeHTTP(resp, req)
@@ -743,7 +772,7 @@ func (s *IntegrationSuite) testDirectoryListing(c *check.C) {
                {
                        // URLs of this form ignore authHeader, and
                        // FooAndBarFilesInDirUUID isn't public, so
-                       // this returns 404.
+                       // this returns 401.
                        uri:    "download.example.com/collections/" + arvadostest.FooAndBarFilesInDirUUID + "/",
                        header: authHeader,
                        expect: nil,
@@ -886,7 +915,11 @@ func (s *IntegrationSuite) testDirectoryListing(c *check.C) {
                        c.Check(req.URL.Path, check.Equals, trial.redirect, comment)
                }
                if trial.expect == nil {
-                       c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       if s.testServer.Config.cluster.Users.AnonymousUserToken == "" {
+                               c.Check(resp.Code, check.Equals, http.StatusUnauthorized, comment)
+                       } else {
+                               c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       }
                } else {
                        c.Check(resp.Code, check.Equals, http.StatusOK, comment)
                        for _, e := range trial.expect {
@@ -907,7 +940,11 @@ func (s *IntegrationSuite) testDirectoryListing(c *check.C) {
                resp = httptest.NewRecorder()
                s.testServer.Handler.ServeHTTP(resp, req)
                if trial.expect == nil {
-                       c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       if s.testServer.Config.cluster.Users.AnonymousUserToken == "" {
+                               c.Check(resp.Code, check.Equals, http.StatusUnauthorized, comment)
+                       } else {
+                               c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       }
                } else {
                        c.Check(resp.Code, check.Equals, http.StatusOK, comment)
                }
@@ -923,7 +960,11 @@ func (s *IntegrationSuite) testDirectoryListing(c *check.C) {
                resp = httptest.NewRecorder()
                s.testServer.Handler.ServeHTTP(resp, req)
                if trial.expect == nil {
-                       c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       if s.testServer.Config.cluster.Users.AnonymousUserToken == "" {
+                               c.Check(resp.Code, check.Equals, http.StatusUnauthorized, comment)
+                       } else {
+                               c.Check(resp.Code, check.Equals, http.StatusNotFound, comment)
+                       }
                } else {
                        c.Check(resp.Code, check.Equals, http.StatusMultiStatus, comment)
                        for _, e := range trial.expect {