Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add pure version of authorizeBiscuit #79

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add pure version of authorizeBiscuit #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e707dbd
Add pure version of authorizeBiscuit
kephas Mar 29, 2023
213567e
Add haddoc comment with security warning
kephas Mar 30, 2023
6b1bae4
Fix comment
kephas Apr 1, 2023
4b11e45
Remove code duplication
kephas Apr 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions biscuit/src/Auth/Biscuit/Datalog/ScopedExecutor.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ module Auth.Biscuit.Datalog.ScopedExecutor
( BlockWithRevocationId
, runAuthorizer
, runAuthorizerWithLimits
, runAuthorizerWithLimitsPure
, runAuthorizerNoTimeout
, runFactGeneration
, PureExecError (..)
Expand All @@ -31,6 +32,7 @@ import Control.Monad.State (StateT (..), evalStateT, get,
import Data.Bifunctor (first)
import Data.ByteString (ByteString)
import Data.Foldable (fold, traverse_)
import Data.Functor.Identity (Identity(Identity))
import Data.List (genericLength)
import Data.List.NonEmpty (NonEmpty)
import qualified Data.List.NonEmpty as NE
Expand Down Expand Up @@ -115,6 +117,19 @@ runAuthorizerWithLimits l@Limits{..} authority blocks v = do
Nothing -> Left Timeout
Just r -> r

-- | Given a series of blocks and an authorizer, ensure that all
-- the checks and policies match
runAuthorizerWithLimitsPure :: Limits
-- ^ custom limits
-> BlockWithRevocationId
-- ^ The authority block
-> [BlockWithRevocationId]
-- ^ The extra blocks
-> Authorizer
-- ^ A authorizer
-> Identity (Either ExecutionError AuthorizationSuccess)
runAuthorizerWithLimitsPure l authority blocks v =
Identity $ runAuthorizerNoTimeout l authority blocks v

mkRevocationIdFacts :: BlockWithRevocationId -> [BlockWithRevocationId]
-> Set Fact
Expand Down
34 changes: 29 additions & 5 deletions biscuit/src/Auth/Biscuit/Token.hs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,8 @@ module Auth.Biscuit.Token
, serializeBiscuit
, authorizeBiscuit
, authorizeBiscuitWithLimits
, authorizeBiscuitNoTimeout
, authorizeBiscuitWithLimitsNoTimeout
, fromOpen
, fromSealed
, asOpen
Expand All @@ -67,6 +69,7 @@ import Data.Bifunctor (first)
import Data.ByteString (ByteString)
import qualified Data.ByteString.Base64.URL as B64
import Data.Foldable (fold)
import Data.Functor.Identity (runIdentity)
import Data.List.NonEmpty (NonEmpty ((:|)))
import qualified Data.List.NonEmpty as NE
import Data.Set (Set)
Expand All @@ -89,10 +92,12 @@ import Auth.Biscuit.Datalog.AST (Authorizer, Block, Query,
import Auth.Biscuit.Datalog.Executor (Bindings, ExecutionError,
Limits, defaultLimits)
import Auth.Biscuit.Datalog.ScopedExecutor (AuthorizationSuccess,
BlockWithRevocationId,
collectWorld,
queryAvailableFacts,
queryGeneratedFacts,
runAuthorizerWithLimits)
runAuthorizerWithLimits,
runAuthorizerWithLimitsPure)
import qualified Auth.Biscuit.Proto as PB
import Auth.Biscuit.ProtoBufAdapter (blockToPb, pbToBlock,
pbToProof,
Expand Down Expand Up @@ -559,9 +564,11 @@ getRevocationIds Biscuit{authority, blocks} =
getRevocationId (_, sig, _, _) = sigBytes sig
in getRevocationId <$> allBlocks

-- | Generic version of 'authorizeBiscuitWithLimits' which takes custom 'Limits'.
authorizeBiscuitWithLimits :: Limits -> Biscuit proof Verified -> Authorizer -> IO (Either ExecutionError (AuthorizedBiscuit proof))
authorizeBiscuitWithLimits l biscuit@Biscuit{..} authorizer =
-- | Generic version of 'authorizeBiscuit' which takes custom 'Limits' and a runner function
-- to run actual authorization. It is polymorphic on the functor returned by the runner.
authorizeBiscuitWithRunner :: Functor f => (Limits -> BlockWithRevocationId -> [BlockWithRevocationId] -> Authorizer -> f (Either ExecutionError AuthorizationSuccess))
-> Limits -> Biscuit proof Verified -> Authorizer -> f (Either ExecutionError (AuthorizedBiscuit proof))
authorizeBiscuitWithRunner runAuthorizerF l biscuit@Biscuit{..} authorizer =
let toBlockWithRevocationId ((_, block), sig, _, eSig) = (block, sigBytes sig, snd <$> eSig)
-- the authority block can't be externally signed. If it carries a signature, it won't be
-- verified. So we need to make sure there is none, to avoid having facts trusted without
Expand All @@ -573,11 +580,25 @@ authorizeBiscuitWithLimits l biscuit@Biscuit{..} authorizer =
, authorizationSuccess
}
in fmap withBiscuit <$>
runAuthorizerWithLimits l
runAuthorizerF l
(dropExternalPk $ toBlockWithRevocationId authority)
(toBlockWithRevocationId <$> blocks)
authorizer

-- | Generic version of 'authorizeBiscuitWithLimits' which takes custom 'Limits'.
authorizeBiscuitWithLimits :: Limits -> Biscuit proof Verified -> Authorizer -> IO (Either ExecutionError (AuthorizedBiscuit proof))
authorizeBiscuitWithLimits = authorizeBiscuitWithRunner runAuthorizerWithLimits

-- | Generic version of 'authorizeBiscuit' which takes custom 'Limits' and doesn't timeout.
--
-- The absence of timeout enables this function to be pure but opens one important vulnerability:
-- an attacker could craft a biscuit with some pathological datalog whose evaluation takes a very
-- long time. So this function should only be used in a context that sets a timeout if run time
-- can be an issue.
authorizeBiscuitWithLimitsNoTimeout :: Limits -> Biscuit proof Verified -> Authorizer -> Either ExecutionError (AuthorizedBiscuit proof)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you add a haddoc comment explaining its purpose and outlining the danger?
it might good to refer to it from the doc items of authorizeBiscuitWithLimits

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know Prolog can easily have infinite loops but I don't know about Datalog or the way it's evaluated in Biscuit, so I'll write the doc warning about that too.

Copy link
Collaborator

@divarvel divarvel Mar 31, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The semantics for this Datalog flavour means it always converges, so it's not about infinite loops per se, but about ensuring that it does within an acceptable duration

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comment fixed.

authorizeBiscuitWithLimitsNoTimeout l biscuit authorizer =
runIdentity $ authorizeBiscuitWithRunner runAuthorizerWithLimitsPure l biscuit authorizer

-- | Given a biscuit with a verified signature and an authorizer (a set of facts, rules, checks
-- and policies), verify a biscuit:
--
Expand All @@ -594,6 +615,9 @@ authorizeBiscuitWithLimits l biscuit@Biscuit{..} authorizer =
authorizeBiscuit :: Biscuit proof Verified -> Authorizer -> IO (Either ExecutionError (AuthorizedBiscuit proof))
authorizeBiscuit = authorizeBiscuitWithLimits defaultLimits

authorizeBiscuitNoTimeout :: Biscuit proof Verified -> Authorizer -> Either ExecutionError (AuthorizedBiscuit proof)
authorizeBiscuitNoTimeout = authorizeBiscuitWithLimitsNoTimeout defaultLimits

-- | Retrieve the `PublicKey` which was used to verify the `Biscuit` signatures
getVerifiedBiscuitPublicKey :: Biscuit a Verified -> PublicKey
getVerifiedBiscuitPublicKey Biscuit{proofCheck} =
Expand Down