From e0d02e8f40d8bf784983aed11788f9faa3587585 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sun, 15 Jan 2023 12:06:37 +0100 Subject: [PATCH] add license key check --- backend/Cargo.lock | 137 ++++++++++++++++++++++++++++++++++++++++++++ backend/Cargo.toml | 4 ++ backend/src/ee.rs | 24 ++++++++ backend/src/main.rs | 11 +--- 4 files changed, 168 insertions(+), 8 deletions(-) create mode 100644 backend/src/ee.rs diff --git a/backend/Cargo.lock b/backend/Cargo.lock index 36eceac12a..587d37e567 100644 --- a/backend/Cargo.lock +++ b/backend/Cargo.lock @@ -452,6 +452,12 @@ dependencies = [ "unicode-width", ] +[[package]] +name = "const-oid" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "cec318a675afcb6a1ea1d4340e2d377e56e47c266f28043ceccbf4412ddfdd3b" + [[package]] name = "const_format" version = "0.2.30" @@ -707,6 +713,17 @@ dependencies = [ "syn", ] +[[package]] +name = "der" +version = "0.6.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de" +dependencies = [ + "const-oid", + "pem-rfc7468", + "zeroize", +] + [[package]] name = "derive_more" version = "0.99.17" @@ -753,6 +770,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f" dependencies = [ "block-buffer 0.10.3", + "const-oid", "crypto-common", "subtle", ] @@ -1516,6 +1534,9 @@ name = "lazy_static" version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646" +dependencies = [ + "spin", +] [[package]] name = "lexical" @@ -1596,6 +1617,12 @@ version = "0.2.139" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79" +[[package]] +name = "libm" +version = "0.2.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "348108ab3fba42ec82ff6e9564fc4ca0247bdccdc68dd8af9764bbc79c3c8ffb" + [[package]] name = "link-cplusplus" version = "1.0.8" @@ -1787,6 +1814,23 @@ dependencies = [ "serde", ] +[[package]] +name = "num-bigint-dig" +version = "0.8.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2399c9463abc5f909349d8aa9ba080e0b88b3ce2885389b60b993f39b1a56905" +dependencies = [ + "byteorder", + "lazy_static", + "libm", + "num-integer", + "num-iter", + "num-traits", + "rand", + "smallvec", + "zeroize", +] + [[package]] name = "num-complex" version = "0.4.2" @@ -1807,6 +1851,17 @@ dependencies = [ "num-traits", ] +[[package]] +name = "num-iter" +version = "0.1.43" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252" +dependencies = [ + "autocfg", + "num-integer", + "num-traits", +] + [[package]] name = "num-traits" version = "0.2.15" @@ -1814,6 +1869,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd" dependencies = [ "autocfg", + "libm", ] [[package]] @@ -1977,6 +2033,15 @@ version = "1.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d01a5bd0424d00070b0098dd17ebca6f961a959dead1dbcbbbc1d1cd8d3deeba" +[[package]] +name = "pem-rfc7468" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "24d159833a9105500e0398934e205e0773f0b27529557134ecfc51c27646adac" +dependencies = [ + "base64ct", +] + [[package]] name = "percent-encoding" version = "2.2.0" @@ -2121,6 +2186,28 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" +[[package]] +name = "pkcs1" +version = "0.4.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eff33bdbdfc54cc98a2eca766ebdec3e1b8fb7387523d5c9c9a2891da856f719" +dependencies = [ + "der", + "pkcs8", + "spki", + "zeroize", +] + +[[package]] +name = "pkcs8" +version = "0.9.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba" +dependencies = [ + "der", + "spki", +] + [[package]] name = "pkg-config" version = "0.3.26" @@ -2449,6 +2536,27 @@ dependencies = [ "winapi", ] +[[package]] +name = "rsa" +version = "0.7.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "094052d5470cbcef561cb848a7209968c9f12dfa6d668f4bca048ac5de51099c" +dependencies = [ + "byteorder", + "digest 0.10.6", + "num-bigint-dig", + "num-integer", + "num-iter", + "num-traits", + "pkcs1", + "pkcs8", + "rand_core", + "signature", + "smallvec", + "subtle", + "zeroize", +] + [[package]] name = "rust-embed" version = "6.4.2" @@ -2914,6 +3022,16 @@ dependencies = [ "libc", ] +[[package]] +name = "signature" +version = "1.6.4" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c" +dependencies = [ + "digest 0.10.6", + "rand_core", +] + [[package]] name = "siphasher" version = "0.3.10" @@ -2967,6 +3085,16 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d" +[[package]] +name = "spki" +version = "0.6.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b" +dependencies = [ + "base64ct", + "der", +] + [[package]] name = "sql-builder" version = "3.1.1" @@ -4181,13 +4309,16 @@ version = "1.60.0" dependencies = [ "anyhow", "axum", + "base64 0.11.0", "chrono", "dotenv", "futures", "git-version", "rand", "reqwest", + "rsa", "serde_json", + "sha2 0.10.6", "sqlx", "tokio", "tokio-metrics", @@ -4497,3 +4628,9 @@ checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc" dependencies = [ "libc", ] + +[[package]] +name = "zeroize" +version = "1.5.7" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "c394b5bd0c6f669e7275d9c20aa90ae064cb22e75a1cad54e1b34088034b149f" diff --git a/backend/Cargo.toml b/backend/Cargo.toml index c2356ab2d3..250574c19e 100644 --- a/backend/Cargo.toml +++ b/backend/Cargo.toml @@ -45,6 +45,9 @@ tokio-metrics.workspace = true rand.workspace = true chrono.workspace = true git-version.workspace = true +rsa.workspace = true +base64.workspace = true +sha2.workspace = true [dev-dependencies] serde_json.workspace = true @@ -140,3 +143,4 @@ lazy_static = "1.4.0" serde_derive = "1.0.147" const_format = { version = "0.2", features = ["rust_1_64", "rust_1_51"] } dyn-iter = "0.2.0" +rsa = "0.7.2" diff --git a/backend/src/ee.rs b/backend/src/ee.rs new file mode 100644 index 0000000000..0c5cd8c493 --- /dev/null +++ b/backend/src/ee.rs @@ -0,0 +1,24 @@ +#[cfg(feature = "enterprise")] +use rsa::{pkcs8::DecodePublicKey, signature::Verifier}; +#[cfg(feature = "enterprise")] +use sha2::Sha256; + +#[cfg(feature = "enterprise")] +pub fn verify_license_key(license_key: Option) -> anyhow::Result<()> { + if let Some(license_key) = license_key { + let splitted_lk = license_key + .split_once(".") + .expect("license_key can be splitted with a ."); + + let pub_key = rsa::RsaPublicKey::from_public_key_der( + &base64::decode("MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDgVShzcLSPiOi+8ET8fggob1kmi47/cE12JaidPkwfGnScZItghkqtiLsct0U4kJhlp5gO89DYTBmIKadvxwY7kMsLlZzmi2emVH7c27cByGASY8QmWDNdG4Ggy/NDflGGBdAtN6gHawZAg4zHv3qpbPQGHH1/6sXIohcXhOnouwIDAQAB")?)?; + let msg = base64::decode(splitted_lk.0)?; + let signature = base64::decode(splitted_lk.1)?; + rsa::pss::VerifyingKey::::new(pub_key) + .verify(&msg, &rsa::pss::Signature::from(signature)) + .map_err(|_| anyhow::anyhow!("Invalid license key".to_string()))?; + } else { + panic!("License key is required for the enterprise edition"); + } + Ok(()) +} diff --git a/backend/src/main.rs b/backend/src/main.rs index 584e03b2b0..faf87424e4 100644 --- a/backend/src/main.rs +++ b/backend/src/main.rs @@ -15,6 +15,8 @@ use windmill_worker::WorkerConfig; const GIT_VERSION: &str = git_version!(args = ["--tag", "--always"], fallback = "unknown-version"); +mod ee; + #[tokio::main] async fn main() -> anyhow::Result<()> { dotenv::dotenv().ok(); @@ -190,19 +192,12 @@ pub async fn run_workers( license_key: Option, ) -> anyhow::Result<()> { #[cfg(feature = "enterprise")] - if let Some(license_key) = license_key { - if license_key != "REQUIRED_DEC1" { - panic!("Invalid license key"); - } - } else { - panic!("License key is required for the enterprise edition"); - } + ee::verify_license_key(license_key)?; #[cfg(not(feature = "enterprise"))] if license_key.is_some() { panic!("License key is required ONLY for the enterprise edition"); } - #[cfg(not(feature = "enterprise"))] if !worker_config.disable_nsjail { tracing::warn!(