Secure controller to compute communication using HTTP basic authentication

gns3server/api/routes/compute/__init__.py

@@ -15,13 +15,15 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, Depends
 from fastapi.responses import JSONResponse
 from starlette.exceptions import HTTPException as StarletteHTTPException
 from gns3server.controller.gns3vm.gns3_vm_error import GNS3VMError
 from gns3server.compute.error import ImageMissingError, NodeError
 from gns3server.compute.ubridge.ubridge_error import UbridgeError
 
+from .dependencies.authentication import compute_authentication
+
 from gns3server.compute.compute_error import (
     ComputeError,
     ComputeNotFoundError,
@@ -49,9 +51,9 @@ from . import virtualbox_nodes
 from . import vmware_nodes
 from . import vpcs_nodes
 
-
 compute_api = FastAPI(
     title="GNS3 compute API",
+    dependencies=[Depends(compute_authentication)],
     description="This page describes the private compute API for GNS3. PLEASE DO NOT USE DIRECTLY!",
     version="v3",
 )

gns3server/api/routes/compute/dependencies/authentication.py

@@ -0,0 +1,37 @@
+#
+# Copyright (C) 2021 GNS3 Technologies Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import secrets
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPBasic, HTTPBasicCredentials
+from gns3server.config import Config
+from typing import Optional
+
+security = HTTPBasic()
+
+
+def compute_authentication(credentials: Optional[HTTPBasicCredentials] = Depends(security)) -> None:
+
+    server_settings = Config.instance().settings.Server
+    username = secrets.compare_digest(credentials.username, server_settings.compute_username)
+    password = secrets.compare_digest(credentials.password, server_settings.compute_password.get_secret_value())
+    if not (username and password):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid compute username or password",
+            headers={"WWW-Authenticate": "Basic"},
+        )

gns3server/api/routes/compute/notifications.py

@@ -18,7 +18,11 @@
 API routes for compute notifications.
 """
 
-from fastapi import APIRouter, WebSocket, WebSocketDisconnect
+import base64
+import binascii
+
+from fastapi import APIRouter, WebSocket, WebSocketDisconnect, status, HTTPException
+from fastapi.security.utils import get_authorization_scheme_param
 from websockets.exceptions import ConnectionClosed, WebSocketException
 
 from gns3server.compute.notification_manager import NotificationManager
@@ -37,6 +41,32 @@ async def notification_ws(websocket: WebSocket) -> None:
     """
 
     await websocket.accept()
+
+    # handle basic HTTP authentication
+    invalid_user_credentials_exc = HTTPException(
+        status_code=status.HTTP_401_UNAUTHORIZED,
+        detail="Invalid authentication credentials",
+        headers={"WWW-Authenticate": "Basic"},
+    )
+
+    try:
+        authorization = websocket.headers.get("Authorization")
+        scheme, param = get_authorization_scheme_param(authorization)
+        if not authorization or scheme.lower() != "basic":
+            raise invalid_user_credentials_exc
+        try:
+            data = base64.b64decode(param).decode("ascii")
+        except (ValueError, UnicodeDecodeError, binascii.Error):
+            raise invalid_user_credentials_exc
+        username, separator, password = data.partition(":")
+        if not separator:
+            raise invalid_user_credentials_exc
+    except invalid_user_credentials_exc as e:
+        websocket_error = {"action": "log.error", "event": {"message": f"Could not authenticate while connecting to "
+                                                                       f"compute WebSocket: {e.detail}"}}
+        await websocket.send_json(websocket_error)
+        return await websocket.close(code=1008)
+
     log.info(f"New client {websocket.client.host}:{websocket.client.port} has connected to compute WebSocket")
     try:
         with NotificationManager.instance().queue() as queue: