finish implementation

Author: Snawoot

handler/handler.go

@@ -2,9 +2,12 @@ package handler
 
 import (
 	"bufio"
+	"bytes"
+	"fmt"
 	"io"
 	"log"
 
+	"github.com/SenseUnit/basic_hmac_auth/hmac"
 	"github.com/SenseUnit/basic_hmac_auth/proto"
 )
 
@@ -27,7 +30,20 @@ func (a *BasicHMACAuthHandler) Run(input io.Reader, output io.Writer) error {
 	scanner := proto.NewElasticLineScanner(rd, '\n')
 
 	for scanner.Scan() {
-		log.Printf("line=%q", string(scanner.Bytes()))
+		parts := bytes.SplitN(scanner.Bytes(), []byte{' '}, 4)
+		if len(parts) < 3 {
+			err := fmt.Errorf("bad request line sent to auth helper: %q", string(scanner.Bytes()))
+			return err
+		}
+		channelID := parts[0]
+		username := proto.RFC1738Unescape(parts[1])
+		password := proto.RFC1738Unescape(parts[2])
+
+		if hmac.VerifyHMACLoginAndPassword(a.Secret, username, password) {
+			fmt.Fprintf(output, "%s OK\n", channelID)
+		} else {
+			fmt.Fprintf(output, "%s ERR\n", channelID)
+		}
 	}
 
 	return scanner.Err()

hmac/hmac.go

@@ -0,0 +1,46 @@
+package hmac
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"time"
+)
+
+const (
+	HMACSignaturePrefix = "dumbproxy grant token v1"
+	HMACSignatureSize   = 32
+)
+
+var hmacSignaturePrefix = []byte(HMACSignaturePrefix)
+
+type HMACToken struct {
+	Expire    int64
+	Signature [HMACSignatureSize]byte
+}
+
+func VerifyHMACLoginAndPassword(secret, login, password []byte) bool {
+	rd := base64.NewDecoder(base64.RawURLEncoding, bytes.NewReader(password))
+
+	var token HMACToken
+	if err := binary.Read(rd, binary.BigEndian, &token); err != nil {
+		return false
+	}
+
+	if time.Unix(token.Expire, 0).Before(time.Now()) {
+		return false
+	}
+
+	expectedMAC := CalculateHMACSignature(secret, login, token.Expire)
+	return hmac.Equal(token.Signature[:], expectedMAC)
+}
+
+func CalculateHMACSignature(secret, username []byte, expire int64) []byte {
+	mac := hmac.New(sha256.New, secret)
+	mac.Write(hmacSignaturePrefix)
+	mac.Write(username)
+	binary.Write(mac, binary.BigEndian, expire)
+	return mac.Sum(nil)
+}