echo: add CSRF middleware

3 files changed, 385 insertions, 1 deletions

diff --git a/echo/go.mod b/echo/go.mod
index 2fe2e2b..d62094d 100644
--- a/echo/go.mod
+++ b/echo/go.mod
@@ -1,6 +1,6 @@
 module code.crute.us/mcrute/golib/echo
 
-go 1.17
+go 1.18
 
 replace code.crute.us/mcrute/golib => ../
 
diff --git a/echo/middleware/csrf.go b/echo/middleware/csrf.go
new file mode 100644
index 0000000..f709964
--- /dev/null
+++ b/echo/middleware/csrf.go
@@ -0,0 +1,337 @@
+package middleware
+
+import (
+        "crypto/rand"
+        "crypto/subtle"
+        "encoding/base64"
+        "fmt"
+        "net/http"
+        "net/url"
+        "strings"
+
+        "code.crute.us/mcrute/golib/echo/session"
+        "github.com/labstack/echo/v4"
+        "github.com/labstack/echo/v4/middleware"
+)
+
+const (
+        csrfTokenContextKey = "__golib_echo_csrfToken"
+        csrfSkipContextKey  = "__golib_echo_skipCsrf"
+)
+
+var (
+        ErrInvalidOrigin    = echo.NewHTTPError(http.StatusBadRequest, "invalid origin")
+        ErrInvalidReferer   = echo.NewHTTPError(http.StatusBadRequest, "invalid referer")
+        ErrMissingReferer   = echo.NewHTTPError(http.StatusBadRequest, "referer header is missing")
+        ErrCSRFTokenMissing = echo.NewHTTPError(http.StatusBadRequest, "CSRF token is missing")
+        ErrCSRFTokenInvalid = echo.NewHTTPError(http.StatusBadRequest, "CSRF token is invalid")
+)
+
+type CSRFAwareSession interface {
+        session.Session
+        GetCSRFSecret() string
+        SetCSRFSecret(string)
+}
+
+func generateRandomBytes(l int) ([]byte, error) {
+        o := make([]byte, l)
+        if _, err := rand.Read(o); err != nil {
+                return nil, err
+        }
+        return o, nil
+}
+
+func xorBytes(a, b []byte) []byte {
+        n := len(a)
+        if len(b) < n {
+                n = len(b)
+        }
+
+        res := make([]byte, n)
+        for i := 0; i < n; i++ {
+                res[i] = a[i] ^ b[i]
+        }
+
+        return res
+}
+
+func mask(token []byte, size int) string {
+        sec, err := generateRandomBytes(size)
+        if err != nil {
+                return ""
+        }
+        val := append(sec, xorBytes(sec, token)...)
+        return base64.StdEncoding.EncodeToString(val)
+}
+
+func decodeAndMask(token string, size int) string {
+        t, err := base64.StdEncoding.DecodeString(token)
+        if err != nil {
+                return ""
+        }
+        return mask(t, size)
+}
+
+func unmask(token string, size int) ([]byte, error) {
+        t, err := base64.StdEncoding.DecodeString(token)
+        if err != nil {
+                return nil, err
+        }
+
+        if len(t) != size*2 {
+                return nil, fmt.Errorf("unmask: token length incorrect")
+        }
+
+        return xorBytes(t[size:], t[:size]), nil
+}
+
+func GetCSRFToken(c echo.Context) string {
+        return c.Get(csrfTokenContextKey).(string)
+}
+
+func DisableCSRFProtection() echo.MiddlewareFunc {
+        return func(next echo.HandlerFunc) echo.HandlerFunc {
+                return func(c echo.Context) error {
+                        c.Set(csrfSkipContextKey, true)
+                        return next(c)
+                }
+        }
+}
+
+type CSRFConfig[T CSRFAwareSession] struct {
+        Skipper        middleware.Skipper
+        HeaderName     string
+        FieldName      string
+        TokenSize      int
+        SessionStore   session.Store[T]
+        TrustedOrigins []string
+}
+
+func CSRFProtect[T CSRFAwareSession](store session.Store[T]) echo.MiddlewareFunc {
+        return CSRFProtectWithConfig(CSRFConfig[T]{
+                Skipper:        middleware.DefaultSkipper,
+                HeaderName:     "X-CSRF-Token",
+                FieldName:      "csrf-token",
+                TokenSize:      32,
+                SessionStore:   store,
+                TrustedOrigins: []string{},
+        })
+}
+
+func CSRFProtectWithConfig[T CSRFAwareSession](cfg CSRFConfig[T]) echo.MiddlewareFunc {
+        if cfg.Skipper == nil {
+                cfg.Skipper = DefaultContentSecurityPolicyConfig.Skipper
+        }
+        if cfg.SessionStore == nil {
+                panic("CSRFProtectWithConfig: SessionStore must not be nil")
+        }
+
+        trustedOrigins := make([]*url.URL, len(cfg.TrustedOrigins))
+        for i, u := range cfg.TrustedOrigins {
+                pu, err := url.Parse(u)
+                if err != nil {
+                        // These are critical errors that should fail at server boot
+                        panic(fmt.Errorf("Error parsing TrustedOrigins URL: %w", err))
+                }
+                trustedOrigins[i] = pu
+        }
+
+        return func(next echo.HandlerFunc) echo.HandlerFunc {
+                return func(c echo.Context) error {
+                        if cfg.Skipper(c) {
+                                return next(c)
+                        }
+
+                        if skip, ok := c.Get(csrfSkipContextKey).(bool); ok && skip {
+                                return next(c)
+                        }
+
+                        // If there's no CSRF token in the session then set one for future
+                        // requests, even if this request is safe.
+                        session := cfg.SessionStore.Get(c)
+                        if session.GetCSRFSecret() == "" {
+                                tok, err := generateRandomBytes(cfg.TokenSize)
+                                if err != nil {
+                                        c.Logger().Errorf("CSRF: error generating token: %w", err)
+                                        return echo.ErrInternalServerError
+                                }
+                                session.SetCSRFSecret(base64.StdEncoding.EncodeToString(tok))
+                        }
+
+                        // Stash this in the request context so that other things can get to
+                        // it without needing a direct session dependency.
+                        c.Set(csrfTokenContextKey, decodeAndMask(session.GetCSRFSecret(), cfg.TokenSize))
+
+                        // These methods are considered safe and do not require CRSF
+                        // protection.
+                        switch c.Request().Method {
+                        case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace:
+                                return next(c)
+                        }
+
+                        if origin := c.Request().Header.Get("Origin"); origin != "" {
+                                if err := validateOrigin(c, origin, trustedOrigins); err != nil {
+                                        return err
+                                }
+                        } else if c.Request().URL.Scheme == "https" {
+                                // If the Origin header wasn't provided, reject HTTPS requests if
+                                // the Referer header doesn't match an allowed value.
+                                //
+                                // Suppose user visits http://example.com/
+                                // An active network attacker (man-in-the-middle, MITM) sends a
+                                // POST form that targets https://example.com/detonate-bomb/ and
+                                // submits it via JavaScript.
+                                //
+                                // The attacker will need to provide a CSRF cookie and token, but
+                                // that's no problem for a MITM and the session-independent secret
+                                // we're using. So the MITM can circumvent the CSRF protection. This
+                                // is true for any HTTP connection, but anyone using HTTPS expects
+                                // better! For this reason, for https://example.com/ we need
+                                // additional protection that treats http://example.com/ as
+                                // completely untrusted. Under HTTPS, Barth et al. found that the
+                                // Referer header is missing for same-domain requests in only about
+                                // 0.2% of cases or less, so we can use strict Referer checking.
+                                if err := validateReferer(c, trustedOrigins); err != nil {
+                                        return err
+                                }
+                        }
+
+                        requestToken := getRequestToken(c.Request(), cfg.FieldName, cfg.HeaderName)
+                        if requestToken == "" {
+                                return ErrCSRFTokenMissing
+                        }
+
+                        unmasked, err := unmask(requestToken, cfg.TokenSize)
+                        if err != nil {
+                                c.Logger().Debugf("CSRF: error unmasking request token: %w", err)
+                                return ErrCSRFTokenInvalid
+                        }
+
+                        sessionToken, err := base64.StdEncoding.DecodeString(session.GetCSRFSecret())
+                        if err != nil {
+                                c.Logger().Debugf("CSRF: error decoding session token: %w", err)
+                                return ErrCSRFTokenInvalid
+                        }
+
+                        if subtle.ConstantTimeCompare(unmasked, sessionToken) != 1 {
+                                c.Logger().Debug("CSRF: session token and request token are not equal")
+                                return ErrCSRFTokenInvalid
+                        }
+
+                        c.Response().Header().Add("Vary", "Cookie")
+
+                        return next(c)
+                }
+        }
+}
+
+func getRequestToken(r *http.Request, fieldName, headerName string) string {
+        token := r.Header.Get(headerName)
+        if token == "" {
+                token = r.PostFormValue(fieldName)
+        }
+        if token == "" && r.MultipartForm != nil {
+                vals := r.MultipartForm.Value[fieldName]
+                if len(vals) > 0 {
+                        token = vals[0]
+                }
+        }
+        return token
+}
+
+func validateReferer(c echo.Context, trusted []*url.URL) error {
+        referer := c.Request().Referer()
+        if referer == "" {
+                c.Logger().Debugf("CSRF: no referer in request")
+                return ErrMissingReferer
+        }
+
+        u, err := url.Parse(referer)
+        if err != nil {
+                c.Logger().Debugf("CSRF: error parsing referer: %w", err)
+                return ErrInvalidReferer
+        }
+
+        if u.Host == "" {
+                c.Logger().Debugf("CSRF: no host in referer")
+                return ErrInvalidReferer
+        }
+
+        if u.Scheme != "https" {
+                c.Logger().Debugf("CSRF: referer is not https")
+                return ErrInvalidReferer
+        }
+
+        for _, o := range trusted {
+                if isSameDomain(u, o) {
+                        return nil
+                }
+        }
+
+        return ErrInvalidReferer
+}
+
+func validateOrigin(c echo.Context, origin string, trusted []*url.URL) error {
+        parsedOrigin, err := url.Parse(origin)
+        if err != nil {
+                c.Logger().Debugf("CSRF: Error parsing origin: %w", err)
+                return ErrInvalidOrigin
+        }
+
+        thisHost := &url.URL{
+                Scheme: c.Request().URL.Scheme,
+                Host:   c.Request().Host,
+        }
+
+        if thisHost.Scheme == "" {
+                if c.Request().TLS != nil {
+                        thisHost.Scheme = "https"
+                } else {
+                        thisHost.Scheme = "http"
+                }
+        }
+
+        if isSameDomain(parsedOrigin, thisHost) {
+                return nil
+        }
+
+        for _, to := range trusted {
+                if isSameDomain(parsedOrigin, to) {
+                        return nil
+                }
+        }
+
+        return ErrInvalidOrigin
+}
+
+// isSameDomain checks that the host is either an exact match for the
+// pattern, or in the case that a pattern starts with a dot, that the
+// host has a suffix of that pattern to allow for subdomain matches
+// (e.g. .example.com matches example.com and foo.example.com)
+func isSameDomain(host, pattern *url.URL) bool {
+        if host == nil || pattern == nil {
+                return false
+        }
+
+        if host.Scheme != pattern.Scheme {
+                return false
+        }
+
+        host.Host = strings.ToLower(host.Host)
+        pattern.Host = strings.ToLower(pattern.Host)
+
+        if pattern.Host == host.Host {
+                return true
+        }
+
+        if strings.HasPrefix(pattern.Host, "*") {
+                if strings.HasSuffix(host.Host, pattern.Host[1:]) {
+                        return true
+                }
+                if host.Host == pattern.Host[2:] {
+                        return true
+                }
+        }
+
+        return false
+}
diff --git a/echo/middleware/csrf_test.go b/echo/middleware/csrf_test.go
new file mode 100644
index 0000000..6ac1d35
--- /dev/null
+++ b/echo/middleware/csrf_test.go
@@ -0,0 +1,47 @@
+package middleware
+
+import (
+        "net/url"
+        "testing"
+
+        "github.com/stretchr/testify/assert"
+)
+
+func TestIsSameDomain(t *testing.T) {
+        tests := []struct {
+                host          string
+                pattern       string
+                expectedMatch bool
+        }{
+                {"http://example.com", "http://EXAMPLE.com", true},           // Case difference
+                {"http://EXAMPLE.com", "http://EXAMPLE.com", true},           // Case difference
+                {"http://example.com", "http://example.com", true},           // Exact match
+                {"http://example.com", "http://*.example.com", true},         // Star match
+                {"http://www.example.com", "http://*.example.com", true},     // Subdomain match
+                {"http://www.foo.example.com", "http://*.example.com", true}, // Sub-subdomain match
+                {"https://example.com", "http://example.com", false},         // Scheme differs
+                {"http://www.example.com", "http://example.com", false},      // Subdomain vs exact
+                {"http://fooexample.com", "http://example.com", false},       // Similar suffix
+                {"http://fooexample.com", "http://*.example.com", false},     // Similar suffix wildcard
+        }
+
+        for _, tc := range tests {
+                host, err := url.Parse(tc.host)
+                assert.NoError(t, err)
+
+                pattern, err := url.Parse(tc.pattern)
+                assert.NoError(t, err)
+
+                if tc.expectedMatch {
+                        assert.True(t, isSameDomain(host, pattern), "%s does not match %s but should", tc.host, tc.pattern)
+                } else {
+                        assert.False(t, isSameDomain(host, pattern), "%s matches %s but should not", tc.host, tc.pattern)
+                }
+        }
+
+        testUrl, err := url.Parse("http://example.com")
+        assert.NoError(t, err)
+        assert.False(t, isSameDomain(nil, nil), "nil should never match")
+        assert.False(t, isSameDomain(testUrl, nil), "nil should never match")
+        assert.False(t, isSameDomain(nil, testUrl), "nil should never match")
+}