add license key check

2023-01-15 12:06:37 +01:00
parent 7084eb4a36
commit e0d02e8f40
4 changed files with 168 additions and 8 deletions
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -452,6 +452,12 @@ dependencies = [
 "unicode-width",
 ]

+[[package]]
+name = "const-oid"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cec318a675afcb6a1ea1d4340e2d377e56e47c266f28043ceccbf4412ddfdd3b"
+
 [[package]]
 name = "const_format"
 version = "0.2.30"
@@ -707,6 +713,17 @@ dependencies = [
 "syn",
 ]

+[[package]]
+name = "der"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "derive_more"
 version = "0.99.17"
@@ -753,6 +770,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
 dependencies = [
 "block-buffer 0.10.3",
+ "const-oid",
 "crypto-common",
 "subtle",
 ]
@@ -1516,6 +1534,9 @@ name = "lazy_static"
 version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin",
+]

 [[package]]
 name = "lexical"
@@ -1596,6 +1617,12 @@ version = "0.2.139"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"

+[[package]]
+name = "libm"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "348108ab3fba42ec82ff6e9564fc4ca0247bdccdc68dd8af9764bbc79c3c8ffb"
+
 [[package]]
 name = "link-cplusplus"
 version = "1.0.8"
@@ -1787,6 +1814,23 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "num-bigint-dig"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2399c9463abc5f909349d8aa9ba080e0b88b3ce2885389b60b993f39b1a56905"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.2"
@@ -1807,6 +1851,17 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.15"
@@ -1814,6 +1869,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
 dependencies = [
 "autocfg",
+ "libm",
 ]

 [[package]]
@@ -1977,6 +2033,15 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d01a5bd0424d00070b0098dd17ebca6f961a959dead1dbcbbbc1d1cd8d3deeba"

+[[package]]
+name = "pem-rfc7468"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d159833a9105500e0398934e205e0773f0b27529557134ecfc51c27646adac"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.2.0"
@@ -2121,6 +2186,28 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"

+[[package]]
+name = "pkcs1"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eff33bdbdfc54cc98a2eca766ebdec3e1b8fb7387523d5c9c9a2891da856f719"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+ "zeroize",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.26"
@@ -2449,6 +2536,27 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "rsa"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "094052d5470cbcef561cb848a7209968c9f12dfa6d668f4bca048ac5de51099c"
+dependencies = [
+ "byteorder",
+ "digest 0.10.6",
+ "num-bigint-dig",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core",
+ "signature",
+ "smallvec",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rust-embed"
 version = "6.4.2"
@@ -2914,6 +3022,16 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "signature"
+version = "1.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+dependencies = [
+ "digest 0.10.6",
+ "rand_core",
+]
+
 [[package]]
 name = "siphasher"
 version = "0.3.10"
@@ -2967,6 +3085,16 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"

+[[package]]
+name = "spki"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "sql-builder"
 version = "3.1.1"
@@ -4181,13 +4309,16 @@ version = "1.60.0"
 dependencies = [
 "anyhow",
 "axum",
+ "base64 0.11.0",
 "chrono",
 "dotenv",
 "futures",
 "git-version",
 "rand",
 "reqwest",
+ "rsa",
 "serde_json",
+ "sha2 0.10.6",
 "sqlx",
 "tokio",
 "tokio-metrics",
@@ -4497,3 +4628,9 @@ checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
 dependencies = [
 "libc",
 ]
+
+[[package]]
+name = "zeroize"
+version = "1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c394b5bd0c6f669e7275d9c20aa90ae064cb22e75a1cad54e1b34088034b149f"
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -45,6 +45,9 @@ tokio-metrics.workspace = true
 rand.workspace = true
 chrono.workspace = true
 git-version.workspace = true
+rsa.workspace = true
+base64.workspace = true
+sha2.workspace = true

 [dev-dependencies]
 serde_json.workspace = true
@@ -140,3 +143,4 @@ lazy_static = "1.4.0"
 serde_derive = "1.0.147"
 const_format = { version = "0.2", features = ["rust_1_64", "rust_1_51"] }
 dyn-iter = "0.2.0"
+rsa = "0.7.2"
--- a/backend/src/ee.rs
+++ b/backend/src/ee.rs
@@ -0,0 +1,24 @@
+#[cfg(feature = "enterprise")]
+use rsa::{pkcs8::DecodePublicKey, signature::Verifier};
+#[cfg(feature = "enterprise")]
+use sha2::Sha256;
+
+#[cfg(feature = "enterprise")]
+pub fn verify_license_key(license_key: Option<String>) -> anyhow::Result<()> {
+    if let Some(license_key) = license_key {
+        let splitted_lk = license_key
+            .split_once(".")
+            .expect("license_key can be splitted with a .");
+
+        let pub_key = rsa::RsaPublicKey::from_public_key_der(
+    &base64::decode("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgVShzcLSPiOi+8ET8fggob1kmi47/cE12JaidPkwfGnScZItghkqtiLsct0U4kJhlp5gO89DYTBmIKadvxwY7kMsLlZzmi2emVH7c27cByGASY8QmWDNdG4Ggy/NDflGGBdAtN6gHawZAg4zHv3qpbPQGHH1/6sXIohcXhOnouwIDAQAB")?)?;
+        let msg = base64::decode(splitted_lk.0)?;
+        let signature = base64::decode(splitted_lk.1)?;
+        rsa::pss::VerifyingKey::<Sha256>::new(pub_key)
+            .verify(&msg, &rsa::pss::Signature::from(signature))
+            .map_err(|_| anyhow::anyhow!("Invalid license key".to_string()))?;
+    } else {
+        panic!("License key is required for the enterprise edition");
+    }
+    Ok(())
+}
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -15,6 +15,8 @@ use windmill_worker::WorkerConfig;

 const GIT_VERSION: &str = git_version!(args = ["--tag", "--always"], fallback = "unknown-version");

+mod ee;
+
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
    dotenv::dotenv().ok();
@@ -190,19 +192,12 @@ pub async fn run_workers(
    license_key: Option<String>,
 ) -> anyhow::Result<()> {
    #[cfg(feature = "enterprise")]
-    if let Some(license_key) = license_key {
-        if license_key != "REQUIRED_DEC1" {
-            panic!("Invalid license key");
-        }
-    } else {
-        panic!("License key is required for the enterprise edition");
-    }
+    ee::verify_license_key(license_key)?;

    #[cfg(not(feature = "enterprise"))]
    if license_key.is_some() {
        panic!("License key is required ONLY for the enterprise edition");
    }
-
    #[cfg(not(feature = "enterprise"))]
    if !worker_config.disable_nsjail {
        tracing::warn!(