2 * collectd - src/utils_oauth.c
5 * Copyright (C) 2017 Florian Forster
7 * Permission to use, copy, modify, and/or distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 * Florian Forster <octo at collectd.org>
27 #include "utils_oauth.h"
29 #include <curl/curl.h>
31 #include <yajl/yajl_tree.h>
32 #include <yajl/yajl_version.h>
34 #include <openssl/err.h>
35 #include <openssl/evp.h>
36 #include <openssl/pem.h>
37 #include <openssl/pkcs12.h>
38 #include <openssl/sha.h>
43 #define GOOGLE_TOKEN_URL "https://accounts.google.com/o/oauth2/token"
45 /* Max send buffer size, since there will be only one writer thread and
46 * monitoring api supports up to 100K bytes in one request, 64K is reasonable
48 #define MAX_BUFFER_SIZE 65536
49 #define MAX_ENCODE_SIZE 2048
67 typedef struct memory_s memory_t;
69 #define OAUTH_GRANT_TYPE "urn:ietf:params:oauth:grant-type:jwt-bearer"
70 #define OAUTH_EXPIRATION_TIME TIME_T_TO_CDTIME_T(3600)
71 #define OAUTH_HEADER "{\"alg\":\"RS256\",\"typ\":\"JWT\"}"
73 static const char OAUTH_CLAIM_FORMAT[] = "{"
81 static size_t write_memory(void *contents, size_t size, size_t nmemb, /* {{{ */
83 size_t realsize = size * nmemb;
84 memory_t *mem = (memory_t *)userp;
87 if (0x7FFFFFF0 < mem->size || 0x7FFFFFF0 - mem->size < realsize) {
88 ERROR("integer overflow");
92 tmp = (char *)realloc((void *)mem->memory, mem->size + realsize + 1);
95 ERROR("write_memory: not enough memory (realloc returned NULL)");
100 memcpy(&(mem->memory[mem->size]), contents, realsize);
101 mem->size += realsize;
102 mem->memory[mem->size] = 0;
105 } /* }}} size_t write_memory */
107 /* Base64-encodes "s" and stores the result in buffer.
108 * Returns zero on success, non-zero otherwise. */
109 static int base64_encode_n(char const *s, size_t s_size, /* {{{ */
110 char *buffer, size_t buffer_size) {
116 /* Set up the memory-base64 chain */
117 b64 = BIO_new(BIO_f_base64());
118 BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
119 b64 = BIO_push(b64, BIO_new(BIO_s_mem()));
121 /* Write data to the chain */
122 BIO_write(b64, (void const *)s, s_size);
123 status = BIO_flush(b64);
125 ERROR("utils_oauth: base64_encode: BIO_flush() failed.");
131 BIO_get_mem_ptr(b64, &bptr);
133 if (buffer_size <= bptr->length) {
134 ERROR("utils_oauth: base64_encode: Buffer too small.");
139 /* Copy data to buffer. */
140 memcpy(buffer, bptr->data, bptr->length);
141 buffer[bptr->length] = 0;
143 /* replace + with -, / with _ and remove padding = at the end */
144 for (i = 0; i < bptr->length; i++) {
145 if (buffer[i] == '+') {
147 } else if (buffer[i] == '/') {
149 } else if (buffer[i] == '=') {
156 } /* }}} int base64_encode_n */
158 /* Base64-encodes "s" and stores the result in buffer.
159 * Returns zero on success, non-zero otherwise. */
160 static int base64_encode(char const *s, /* {{{ */
161 char *buffer, size_t buffer_size) {
162 return base64_encode_n(s, strlen(s), buffer, buffer_size);
163 } /* }}} int base64_encode */
165 /* get_header returns the base64 encoded OAuth header. */
166 static int get_header(char *buffer, size_t buffer_size) /* {{{ */
168 char header[] = OAUTH_HEADER;
170 return base64_encode(header, buffer, buffer_size);
171 } /* }}} int get_header */
173 /* get_claim constructs an OAuth claim and returns it as base64 encoded string.
175 static int get_claim(oauth_t *auth, char *buffer, size_t buffer_size) /* {{{ */
177 char claim[buffer_size];
183 exp = iat + OAUTH_EXPIRATION_TIME;
185 /* create the claim set */
187 snprintf(claim, sizeof(claim), OAUTH_CLAIM_FORMAT, auth->iss, auth->scope,
188 auth->aud, (unsigned long)CDTIME_T_TO_TIME_T(exp),
189 (unsigned long)CDTIME_T_TO_TIME_T(iat));
192 else if ((size_t)status >= sizeof(claim))
195 DEBUG("utils_oauth: get_claim() = %s", claim);
197 return base64_encode(claim, buffer, buffer_size);
198 } /* }}} int get_claim */
200 /* get_signature signs header and claim with pkey and returns the signature in
202 static int get_signature(char *buffer, size_t buffer_size, /* {{{ */
203 char const *header, char const *claim,
205 char payload[buffer_size];
207 char signature[buffer_size];
208 unsigned int signature_size;
211 /* Make the string to sign */
212 payload_len = snprintf(payload, sizeof(payload), "%s.%s", header, claim);
213 if (payload_len < 1) {
215 } else if (payload_len >= sizeof(payload)) {
219 /* Create the signature */
220 signature_size = EVP_PKEY_size(pkey);
221 if (signature_size > sizeof(signature)) {
222 ERROR("utils_oauth: Signature is too large (%u bytes).", signature_size);
226 EVP_MD_CTX *ctx = EVP_MD_CTX_new();
228 /* EVP_SignInit(3SSL) claims this is a void function, but in fact it returns
229 * an int. We're not going to rely on this, though. */
230 EVP_SignInit(ctx, EVP_sha256());
232 status = EVP_SignUpdate(ctx, payload, payload_len);
235 ERR_error_string_n(ERR_get_error(), errbuf, sizeof(errbuf));
236 ERROR("utils_oauth: EVP_SignUpdate failed: %s", errbuf);
238 EVP_MD_CTX_free(ctx);
243 EVP_SignFinal(ctx, (unsigned char *)signature, &signature_size, pkey);
246 ERR_error_string_n(ERR_get_error(), errbuf, sizeof(errbuf));
247 ERROR("utils_oauth: EVP_SignFinal failed: %s", errbuf);
249 EVP_MD_CTX_free(ctx);
253 EVP_MD_CTX_free(ctx);
255 return base64_encode_n(signature, (size_t)signature_size, buffer,
257 } /* }}} int get_signature */
259 static int get_assertion(oauth_t *auth, char *buffer,
260 size_t buffer_size) /* {{{ */
262 char header[buffer_size];
263 char claim[buffer_size];
264 char signature[buffer_size];
267 status = get_header(header, sizeof(header));
271 status = get_claim(auth, claim, sizeof(claim));
276 get_signature(signature, sizeof(signature), header, claim, auth->key);
280 status = snprintf(buffer, buffer_size, "%s.%s.%s", header, claim, signature);
283 else if (status >= buffer_size)
287 } /* }}} int get_assertion */
289 int oauth_parse_json_token(char const *json, /* {{{ */
290 char *out_access_token, size_t access_token_size,
291 cdtime_t *expires_in) {
292 time_t expire_in_seconds = 0;
297 const char *token_path[] = {"access_token", NULL};
298 const char *expire_path[] = {"expires_in", NULL};
300 root = yajl_tree_parse(json, errbuf, sizeof(errbuf));
302 ERROR("utils_oauth: oauth_parse_json_token: parse error %s", errbuf);
306 token_val = yajl_tree_get(root, token_path, yajl_t_string);
307 if (token_val == NULL) {
308 ERROR("utils_oauth: oauth_parse_json_token: access token field not found");
309 yajl_tree_free(root);
312 sstrncpy(out_access_token, YAJL_GET_STRING(token_val), access_token_size);
314 expire_val = yajl_tree_get(root, expire_path, yajl_t_number);
315 if (expire_val == NULL) {
316 ERROR("utils_oauth: oauth_parse_json_token: expire field found");
317 yajl_tree_free(root);
320 expire_in_seconds = (time_t)YAJL_GET_INTEGER(expire_val);
321 DEBUG("oauth_parse_json_token: expires_in %lu",
322 (unsigned long)expire_in_seconds);
324 *expires_in = TIME_T_TO_CDTIME_T(expire_in_seconds);
325 yajl_tree_free(root);
327 } /* }}} int oauth_parse_json_token */
329 static int new_token(oauth_t *auth) /* {{{ */
332 char assertion[1024];
333 char post_data[1024];
335 char access_token[256];
338 char curl_errbuf[CURL_ERROR_SIZE];
346 status = get_assertion(auth, assertion, sizeof(assertion));
348 ERROR("utils_oauth: Failed to get token using service account %s.",
353 snprintf(post_data, sizeof(post_data), "grant_type=%s&assertion=%s",
354 OAUTH_GRANT_TYPE, assertion);
356 curl = curl_easy_init();
358 ERROR("utils_oauth: curl_easy_init failed.");
362 curl_easy_setopt(curl, CURLOPT_ERRORBUFFER, curl_errbuf);
363 curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1L);
364 curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_memory);
365 curl_easy_setopt(curl, CURLOPT_WRITEDATA, &data);
366 curl_easy_setopt(curl, CURLOPT_POST, 1L);
367 curl_easy_setopt(curl, CURLOPT_POSTFIELDS, post_data);
368 curl_easy_setopt(curl, CURLOPT_URL, auth->url);
370 status = curl_easy_perform(curl);
371 if (status != CURLE_OK) {
372 ERROR("utils_oauth: curl_easy_perform failed with status %i: %s", status,
376 curl_easy_cleanup(curl);
382 curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
383 if ((http_code < 200) || (http_code >= 300)) {
384 ERROR("utils_oauth: POST request to %s failed: HTTP error %ld", auth->url,
386 if (data.memory != NULL)
387 INFO("utils_oauth: Server replied: %s", data.memory);
390 curl_easy_cleanup(curl);
396 status = oauth_parse_json_token(data.memory, access_token,
397 sizeof(access_token), &expires_in);
400 curl_easy_cleanup(curl);
406 auth->token = strdup(access_token);
407 if (auth->token == NULL) {
408 ERROR("utils_oauth: strdup failed");
409 auth->valid_until = 0;
412 curl_easy_cleanup(curl);
416 INFO("utils_oauth: OAuth2 access token is valid for %.3fs",
417 CDTIME_T_TO_DOUBLE(expires_in));
418 auth->valid_until = now + expires_in;
421 curl_easy_cleanup(curl);
424 } /* }}} int new_token */
426 static int renew_token(oauth_t *auth) /* {{{ */
428 /* TODO(octo): Make sure that we get a new token 60 seconds or so before the
429 * old one expires. */
430 if (auth->valid_until > cdtime())
433 return new_token(auth);
434 } /* }}} int renew_token */
436 static oauth_t *oauth_create(char const *url, char const *iss,
437 char const *scope, char const *aud,
438 EVP_PKEY *key) /* {{{ */
442 if ((url == NULL) || (iss == NULL) || (scope == NULL) || (aud == NULL) ||
446 auth = malloc(sizeof(*auth));
449 memset(auth, 0, sizeof(*auth));
451 auth->url = strdup(url);
452 auth->iss = strdup(iss);
453 auth->scope = strdup(scope);
454 auth->aud = strdup(aud);
456 if ((auth->url == NULL) || (auth->iss == NULL) || (auth->scope == NULL) ||
457 (auth->aud == NULL)) {
465 } /* }}} oauth_t *oauth_create */
470 oauth_google_t oauth_create_google_json(char const *buffer, char const *scope) {
472 yajl_val root = yajl_tree_parse(buffer, errbuf, sizeof(errbuf));
474 ERROR("utils_oauth: oauth_create_google_json: parse error %s", errbuf);
475 return (oauth_google_t){NULL};
478 yajl_val field_project =
479 yajl_tree_get(root, (char const *[]){"project_id", NULL}, yajl_t_string);
480 if (field_project == NULL) {
481 ERROR("utils_oauth: oauth_create_google_json: project_id field not found");
482 yajl_tree_free(root);
483 return (oauth_google_t){NULL};
485 char const *project_id = YAJL_GET_STRING(field_project);
487 yajl_val field_iss = yajl_tree_get(
488 root, (char const *[]){"client_email", NULL}, yajl_t_string);
489 if (field_iss == NULL) {
491 "utils_oauth: oauth_create_google_json: client_email field not found");
492 yajl_tree_free(root);
493 return (oauth_google_t){NULL};
496 yajl_val field_token_uri =
497 yajl_tree_get(root, (char const *[]){"token_uri", NULL}, yajl_t_string);
498 char const *token_uri = (field_token_uri != NULL)
499 ? YAJL_GET_STRING(field_token_uri)
502 yajl_val field_priv_key =
503 yajl_tree_get(root, (char const *[]){"private_key", NULL}, yajl_t_string);
504 if (field_priv_key == NULL) {
505 ERROR("utils_oauth: oauth_create_google_json: private_key field not found");
506 yajl_tree_free(root);
507 return (oauth_google_t){NULL};
510 BIO *bp = BIO_new_mem_buf(YAJL_GET_STRING(field_priv_key), -1);
511 EVP_PKEY *pkey = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL);
514 ERR_error_string_n(ERR_get_error(), errbuf, sizeof(errbuf));
516 "utils_oauth: oauth_create_google_json: parsing private key failed: %s",
519 yajl_tree_free(root);
520 return (oauth_google_t){NULL};
525 oauth_t *oauth = oauth_create(token_uri, YAJL_GET_STRING(field_iss), scope,
528 yajl_tree_free(root);
529 return (oauth_google_t){NULL};
532 oauth_google_t ret = {
533 .project_id = strdup(project_id), .oauth = oauth,
536 yajl_tree_free(root);
538 } /* oauth_google_t oauth_create_google_json */
540 oauth_google_t oauth_create_google_file(char const *path,
541 char const *scope) { /* {{{ */
542 int fd = open(path, O_RDONLY);
544 return (oauth_google_t){NULL};
546 struct stat st = {0};
547 if (fstat(fd, &st) != 0) {
549 return (oauth_google_t){NULL};
552 size_t buf_size = (size_t)st.st_size;
553 char *buf = calloc(1, buf_size + 1);
556 return (oauth_google_t){NULL};
559 if (sread(fd, buf, buf_size) != 0) {
562 return (oauth_google_t){NULL};
567 oauth_google_t ret = oauth_create_google_json(buf, scope);
571 } /* }}} oauth_google_t oauth_create_google_file */
573 /* oauth_create_google_default checks for JSON credentials in well-known
574 * positions, similar to gcloud and other tools. */
575 oauth_google_t oauth_create_google_default(char const *scope) {
576 char const *app_creds;
577 if ((app_creds = getenv("GOOGLE_APPLICATION_CREDENTIALS")) != NULL) {
578 oauth_google_t ret = oauth_create_google_file(app_creds, scope);
579 if (ret.oauth == NULL) {
580 ERROR("The environment variable GOOGLE_APPLICATION_CREDENTIALS is set to "
581 "\"%s\" but that file could not be read.",
589 if ((home = getenv("HOME")) != NULL) {
591 snprintf(path, sizeof(path),
592 "%s/.config/gcloud/application_default_credentials.json", home);
594 oauth_google_t ret = oauth_create_google_file(path, scope);
595 if (ret.oauth != NULL) {
600 return (oauth_google_t){NULL};
601 } /* }}} oauth_google_t oauth_create_google_default */
603 void oauth_destroy(oauth_t *auth) /* {{{ */
613 if (auth->key != NULL) {
614 EVP_PKEY_free(auth->key);
619 } /* }}} void oauth_destroy */
621 int oauth_access_token(oauth_t *auth, char *buffer,
622 size_t buffer_size) /* {{{ */
629 status = renew_token(auth);
632 assert(auth->token != NULL);
634 sstrncpy(buffer, auth->token, buffer_size);
636 } /* }}} int oauth_access_token */