| | | 1 | | // Copyright (c) Microsoft Corporation. All rights reserved. |
| | | 2 | | // Licensed under the MIT License. |
| | | 3 | | |
| | | 4 | | using System; |
| | | 5 | | using System.Globalization; |
| | | 6 | | using System.IO; |
| | | 7 | | using System.Security.Cryptography; |
| | | 8 | | using System.Text; |
| | | 9 | | using System.Threading.Tasks; |
| | | 10 | | using Azure.Core; |
| | | 11 | | using Azure.Core.Pipeline; |
| | | 12 | | |
| | | 13 | | namespace Azure.Data.AppConfiguration |
| | | 14 | | { |
| | | 15 | | internal class AuthenticationPolicy : HttpPipelinePolicy |
| | | 16 | | { |
| | | 17 | | private readonly string _credential; |
| | | 18 | | private readonly byte[] _secret; |
| | | 19 | | |
| | 320 | 20 | | public AuthenticationPolicy(string credential, byte[] secret) |
| | | 21 | | { |
| | 320 | 22 | | _credential = credential; |
| | 320 | 23 | | _secret = secret; |
| | 320 | 24 | | } |
| | | 25 | | |
| | | 26 | | public override void Process(HttpMessage message, ReadOnlyMemory<HttpPipelinePolicy> pipeline) |
| | | 27 | | { |
| | 392 | 28 | | string contentHash = CreateContentHash(message); |
| | 392 | 29 | | AddHeaders(message, contentHash); |
| | 392 | 30 | | ProcessNext(message, pipeline); |
| | 392 | 31 | | } |
| | | 32 | | |
| | | 33 | | public override async ValueTask ProcessAsync(HttpMessage message, ReadOnlyMemory<HttpPipelinePolicy> pipeline) |
| | | 34 | | { |
| | 392 | 35 | | string contentHash = await CreateContentHashAsync(message).ConfigureAwait(false); |
| | 392 | 36 | | AddHeaders(message, contentHash); |
| | 392 | 37 | | await ProcessNextAsync(message, pipeline).ConfigureAwait(false); |
| | 392 | 38 | | } |
| | | 39 | | |
| | | 40 | | private static string CreateContentHash(HttpMessage message) |
| | | 41 | | { |
| | 392 | 42 | | using var alg = SHA256.Create(); |
| | | 43 | | |
| | 392 | 44 | | using (var memoryStream = new MemoryStream()) |
| | 392 | 45 | | using (var contentHashStream = new CryptoStream(memoryStream, alg, CryptoStreamMode.Write)) |
| | | 46 | | { |
| | 392 | 47 | | message.Request.Content?.WriteTo(contentHashStream, message.CancellationToken); |
| | 146 | 48 | | } |
| | | 49 | | |
| | 392 | 50 | | return Convert.ToBase64String(alg.Hash); |
| | 392 | 51 | | } |
| | | 52 | | |
| | | 53 | | private static async ValueTask<string> CreateContentHashAsync(HttpMessage message) |
| | | 54 | | { |
| | 392 | 55 | | using var alg = SHA256.Create(); |
| | | 56 | | |
| | 392 | 57 | | using (var memoryStream = new MemoryStream()) |
| | 392 | 58 | | using (var contentHashStream = new CryptoStream(memoryStream, alg, CryptoStreamMode.Write)) |
| | | 59 | | { |
| | 392 | 60 | | if (message.Request.Content != null) |
| | | 61 | | { |
| | 146 | 62 | | await message.Request.Content.WriteToAsync(contentHashStream, message.CancellationToken).ConfigureAw |
| | | 63 | | } |
| | 392 | 64 | | } |
| | | 65 | | |
| | 392 | 66 | | return Convert.ToBase64String(alg.Hash); |
| | 392 | 67 | | } |
| | | 68 | | |
| | | 69 | | private void AddHeaders(HttpMessage message, string contentHash) |
| | | 70 | | { |
| | 784 | 71 | | var utcNowString = DateTimeOffset.UtcNow.ToString("r", CultureInfo.InvariantCulture); |
| | 784 | 72 | | var authorization = GetAuthorizationHeader(message.Request, contentHash, utcNowString); |
| | | 73 | | |
| | 784 | 74 | | message.Request.Headers.SetValue("x-ms-content-sha256", contentHash); |
| | 784 | 75 | | message.Request.Headers.SetValue(HttpHeader.Names.Date, utcNowString); |
| | 784 | 76 | | message.Request.Headers.SetValue(HttpHeader.Names.Authorization, authorization); |
| | 784 | 77 | | } |
| | | 78 | | |
| | | 79 | | private string GetAuthorizationHeader(Request request, string contentHash, string date) { |
| | | 80 | | const string signedHeaders = "date;host;x-ms-content-sha256"; // Semicolon separated header names |
| | | 81 | | |
| | 784 | 82 | | var uri = request.Uri.ToUri(); |
| | 784 | 83 | | var host = uri.Host; |
| | 784 | 84 | | var pathAndQuery = uri.PathAndQuery; |
| | 784 | 85 | | var method = request.Method.Method; |
| | | 86 | | |
| | 784 | 87 | | var stringToSign = $"{method}\n{pathAndQuery}\n{date};{host};{contentHash}"; |
| | 784 | 88 | | var signature = ComputeHash(stringToSign); // Calculate the signature |
| | 784 | 89 | | return $"HMAC-SHA256 Credential={_credential}&SignedHeaders={signedHeaders}&Signature={signature}"; |
| | | 90 | | } |
| | | 91 | | |
| | | 92 | | private string ComputeHash(string value) |
| | | 93 | | { |
| | 784 | 94 | | using var hmac = new HMACSHA256(_secret); |
| | 784 | 95 | | return Convert.ToBase64String(hmac.ComputeHash(Encoding.ASCII.GetBytes(value))); |
| | 784 | 96 | | } |
| | | 97 | | } |
| | | 98 | | } |