Fix signature generation in Akamai cache purger (#3933)

The EdgeGrid signature scheme signs over the path being requested. When we
added the "network" parameter as part of the move to the v3 API, we forgot to include
that as part of the path when calculating signatures. This change fixes that and adds
a unittest that would have caught it.

Part of the unittest changes include changing `akamaiServer` to embed `httptest.Server`.
This allows its methods to know what port it's listening on, which is an input to signature
checking.

Author: jsha

akamai/cache-client.go

@@ -145,13 +145,9 @@ func (cpc *CachePurgeClient) constructAuthHeader(request *http.Request, body []b
 		header,
 	)
 
-	// Create signing key using a HMAC of the client secret over the timestamp
-	h := hmac.New(sha256.New, []byte(cpc.clientSecret))
-	h.Write([]byte(timestamp))
-	key := make([]byte, base64.StdEncoding.EncodedLen(32))
-	base64.StdEncoding.Encode(key, h.Sum(nil))
+	cpc.log.Debugf("To-be-signed Akamai EdgeGrid authentication: %q", tbs)
 
-	h = hmac.New(sha256.New, key)
+	h := hmac.New(sha256.New, signingKey(cpc.clientSecret, timestamp))
 	h.Write([]byte(tbs))
 	return fmt.Sprintf(
 		"%ssignature=%s",
@@ -160,6 +156,16 @@ func (cpc *CachePurgeClient) constructAuthHeader(request *http.Request, body []b
 	), nil
 }
 
+// signingKey makes a signing key by HMAC'ing the timestamp
+// using a client secret as the key.
+func signingKey(clientSecret string, timestamp string) []byte {
+	h := hmac.New(sha256.New, []byte(clientSecret))
+	h.Write([]byte(timestamp))
+	key := make([]byte, base64.StdEncoding.EncodedLen(32))
+	base64.StdEncoding.Encode(key, h.Sum(nil))
+	return key
+}
+
 // purge actually sends the individual requests to the Akamai endpoint and checks
 // if they are successful
 func (cpc *CachePurgeClient) purge(urls []string) error {
@@ -184,7 +190,6 @@ func (cpc *CachePurgeClient) purge(urls []string) error {
 	if err != nil {
 		return errFatal(err.Error())
 	}
-
 	req, err := http.NewRequest(
 		"POST",
 		endpoint,
@@ -198,7 +203,7 @@ func (cpc *CachePurgeClient) purge(urls []string) error {
 	authHeader, err := cpc.constructAuthHeader(
 		req,
 		reqJSON,
-		purgePath,
+		purgePath+cpc.v3Network,
 		core.RandomString(16),
 	)
 	if err != nil {
@@ -207,6 +212,9 @@ func (cpc *CachePurgeClient) purge(urls []string) error {
 	req.Header.Set("Authorization", authHeader)
 	req.Header.Set("Content-Type", "application/json")
 
+	cpc.log.Debugf("POSTing to %s with Authorization %s: %s",
+		endpoint, authHeader, reqJSON)
+
 	rS := cpc.clk.Now()
 	resp, err := cpc.client.Do(req)
 	cpc.stats.TimingDuration("PurgeRequestLatency", time.Since(rS))

akamai/cache-client_test.go

@@ -2,6 +2,9 @@ package akamai
 
 import (
 	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io/ioutil"
@@ -18,6 +21,7 @@ import (
 )
 
 func TestConstructAuthHeader(t *testing.T) {
+	log := blog.NewMock()
 	stats := metrics.NewNoopScope()
 	cpc, err := NewCachePurgeClient(
 		"https://akaa-baseurl-xxxxxxxxxxx-xxxxxxxxxxxxx.luna.akamaiapis.net",
@@ -27,15 +31,15 @@ func TestConstructAuthHeader(t *testing.T) {
 		"production",
 		0,
 		time.Second,
-		nil,
+		log,
 		stats,
 	)
 	test.AssertNotError(t, err, "Failed to create cache purge client")
 	fc := clock.NewFake()
 	cpc.clk = fc
 	wantedTimestamp, err := time.Parse(timestampFormat, "20140321T19:34:21+0000")
 	test.AssertNotError(t, err, "Failed to parse timestamp")
-	fc.Add(wantedTimestamp.Sub(fc.Now()))
+	fc.Set(wantedTimestamp)
 
 	req, err := http.NewRequest(
 		"POST",
@@ -58,6 +62,7 @@ func TestConstructAuthHeader(t *testing.T) {
 type akamaiServer struct {
 	responseCode int
 	v3           bool
+	*httptest.Server
 }
 
 func (as *akamaiServer) sendResponse(w http.ResponseWriter, resp purgeResponse) {
@@ -95,6 +100,13 @@ func (as *akamaiServer) akamaiHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	err = as.checkSignature(r, body)
+	if err != nil {
+		fmt.Printf("Error checking signature: %s\n", err)
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
 	// Enforce that a V3 request is well formed and does not include the "Type"
 	// and "Action" fields used by the V2 api.
 	if as.v3 == true && (req.Type != "" || req.Action != "") {
@@ -129,19 +141,58 @@ func (as *akamaiServer) akamaiHandler(w http.ResponseWriter, r *http.Request) {
 	as.sendResponse(w, resp)
 }
 
+func (as *akamaiServer) checkSignature(r *http.Request, body []byte) error {
+	bodyHash := sha256.Sum256(body)
+	bodyHashB64 := base64.StdEncoding.EncodeToString(bodyHash[:])
+
+	authorization := r.Header.Get("Authorization")
+	authValues := make(map[string]string)
+	for _, v := range strings.Split(authorization, ";") {
+		splitValue := strings.Split(v, "=")
+		authValues[splitValue[0]] = splitValue[1]
+	}
+	headerTimestamp := authValues["timestamp"]
+	splitHeader := strings.Split(authorization, "signature=")
+	shortenedHeader, signature := splitHeader[0], splitHeader[1]
+	hostPort := strings.Split(as.URL, "://")[1]
+	// Assume all unittests use "secret" as the client secret.
+	h := hmac.New(sha256.New, signingKey("secret", headerTimestamp))
+	input := []byte(fmt.Sprintf("POST\thttp\t%s\t%s\t\t%s\t%s",
+		hostPort,
+		r.URL.Path,
+		bodyHashB64,
+		shortenedHeader,
+	))
+	h.Write(input)
+	expectedSignature := base64.StdEncoding.EncodeToString(h.Sum(nil))
+	if signature != expectedSignature {
+		return fmt.Errorf("Wrong signature %q in %q. Expected %q\n",
+			signature, authorization, expectedSignature)
+	}
+	return nil
+}
+
+func newAkamaiServer(code int, v3 bool) *akamaiServer {
+	m := http.NewServeMux()
+	as := akamaiServer{
+		responseCode: code,
+		v3:           v3,
+		Server:       httptest.NewServer(m),
+	}
+	m.HandleFunc("/", as.akamaiHandler)
+	return &as
+}
+
 // TestV2Purge tests the legacy CCU v2 Akamai API used when the v3Network
 // parameter to NewCachePurgeClient is "".
 func TestV2Purge(t *testing.T) {
 	log := blog.NewMock()
 
-	as := akamaiServer{responseCode: http.StatusCreated}
-	m := http.NewServeMux()
-	server := httptest.NewUnstartedServer(m)
-	m.HandleFunc("/", as.akamaiHandler)
-	server.Start()
+	as := newAkamaiServer(http.StatusCreated, false)
+	defer as.Close()
 
 	client, err := NewCachePurgeClient(
-		server.URL,
+		as.URL,
 		"token",
 		"secret",
 		"accessToken",
@@ -174,31 +225,24 @@ func TestV2Purge(t *testing.T) {
 // TestV3Purge tests the Akamai CCU v3 purge API by setting the v3Network
 // parameter to "production".
 func TestV3Purge(t *testing.T) {
-	log := blog.NewMock()
-
-	as := akamaiServer{
-		responseCode: http.StatusCreated,
-		v3:           true,
-	}
-	m := http.NewServeMux()
-	server := httptest.NewUnstartedServer(m)
-	m.HandleFunc("/", as.akamaiHandler)
-	server.Start()
+	as := newAkamaiServer(http.StatusCreated, true)
+	defer as.Close()
 
 	// Client is a purge client with a "production" v3Network parameter
 	client, err := NewCachePurgeClient(
-		server.URL,
+		as.URL,
 		"token",
 		"secret",
 		"accessToken",
 		"production",
 		3,
 		time.Second,
-		log,
+		blog.NewMock(),
 		metrics.NewNoopScope(),
 	)
 	test.AssertNotError(t, err, "Failed to create CachePurgeClient")
-	client.clk = clock.NewFake()
+	fc := clock.NewFake()
+	client.clk = fc
 
 	err = client.Purge([]string{"http://test.com"})
 	test.AssertNotError(t, err, "Purge failed with 201 response")
@@ -217,34 +261,30 @@ func TestV3Purge(t *testing.T) {
 }
 
 func TestNewCachePurgeClient(t *testing.T) {
-	log := blog.NewMock()
-	m := http.NewServeMux()
-	server := httptest.NewUnstartedServer(m)
-
 	// Creating a new cache purge client with an invalid "network" parameter should error
 	_, err := NewCachePurgeClient(
-		server.URL,
+		"http://127.0.0.1:9000/",
 		"token",
 		"secret",
 		"accessToken",
 		"fake",
 		3,
 		time.Second,
-		log,
+		blog.NewMock(),
 		metrics.NewNoopScope(),
 	)
 	test.AssertError(t, err, "NewCachePurgeClient with invalid network parameter didn't error")
 
 	// Creating a new cache purge client with a valid "network" parameter shouldn't error
 	_, err = NewCachePurgeClient(
-		server.URL,
+		"http://127.0.0.1:9000/",
 		"token",
 		"secret",
 		"accessToken",
 		"staging",
 		3,
 		time.Second,
-		log,
+		blog.NewMock(),
 		metrics.NewNoopScope(),
 	)
 	test.AssertNotError(t, err, "NewCachePurgeClient with valid network parameter errored")
@@ -258,7 +298,7 @@ func TestNewCachePurgeClient(t *testing.T) {
 		"staging",
 		3,
 		time.Second,
-		log,
+		blog.NewMock(),
 		metrics.NewNoopScope(),
 	)
 	test.AssertError(t, err, "NewCachePurgeClient with invalid server url parameter didn't error")
@@ -267,17 +307,17 @@ func TestNewCachePurgeClient(t *testing.T) {
 func TestBigBatchPurge(t *testing.T) {
 	log := blog.NewMock()
 
+	m := http.NewServeMux()
 	as := akamaiServer{
 		responseCode: http.StatusCreated,
 		v3:           true,
+		Server:       httptest.NewUnstartedServer(m),
 	}
-	m := http.NewServeMux()
-	server := httptest.NewUnstartedServer(m)
 	m.HandleFunc("/", as.akamaiHandler)
-	server.Start()
+	as.Start()
 
 	client, err := NewCachePurgeClient(
-		server.URL,
+		as.URL,
 		"token",
 		"secret",
 		"accessToken",