Send bearer auth to ECR Public registry requests

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/config v1.33.5
 	github.com/aws/aws-sdk-go-v2/credentials v1.20.5
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.66.0
+	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.0
 	github.com/elazarl/goproxy v1.9.0
 	github.com/evalphobia/logrus_sentry v0.8.2
 	github.com/getsentry/raven-go v0.2.0

go.sum

@@ -14,6 +14,8 @@ github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3 h1:fuSCw4Z2qfRCztMPO3GXJNSiEp6W
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.3/go.mod h1:6SxcHheD1pPR5+kWm1wGvjlL/YqUsh267sAfEmN4K7A=
 github.com/aws/aws-sdk-go-v2/service/ecr v1.66.0 h1:9i19IigAYxnAxTUQcsxkiIXeeytHllTOetWBhr1DTQs=
 github.com/aws/aws-sdk-go-v2/service/ecr v1.66.0/go.mod h1:iSlv4VibruxMhWfiKrNbn97Yjhe2855EFrgUitSESfM=
+github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.0 h1:qLVBL6u7+Ob+H0s+eJAD54+UAn7eCBOlbngmBZRtv+k=
+github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.47.0/go.mod h1:r/ctJh/VqBZY1N0C6oKmdA4Dd4AeMHGQBTb46AGDs8A=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19 h1:bAdDl/HkGCcGPoe25ToSHEw23VIxt6CT5fLcg111BKg=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.19/go.mod h1:KaUzbLxv4CeSxh6ZCl9B4m7CuFenS8kUEaDs+f/DQr4=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.3 h1:bON1rJf67TSTDCKg816AAIE4xSTtoo9tl0XRkO72R+I=

internal/handlers/docker_registry.go

@@ -8,9 +8,11 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/aws/aws-sdk-go-v2/aws"
 	awsconfig "github.com/aws/aws-sdk-go-v2/config"
 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/ecr"
+	"github.com/aws/aws-sdk-go-v2/service/ecrpublic"
 	"github.com/elazarl/goproxy"
 	"github.com/stackrox/docker-registry-client/registry"
 
@@ -25,6 +27,16 @@ var (
 	ecrRe = regexp.MustCompile(`\A\d+.dkr.ecr.([a-z0-9-]+)\.amazonaws\.com\z`)
 )
 
+const (
+	ecrPublicHost = "public.ecr.aws"
+	// ECR Public only issues authorization tokens in us-east-1.
+	ecrPublicRegion = "us-east-1"
+	// ecrPublicTokenUsername is the username of a pre-generated ECR Public
+	// token from `aws ecr-public get-login-password`. Any other username is
+	// an AWS access key ID.
+	ecrPublicTokenUsername = "AWS"
+)
+
 type ecrClient interface {
 	GetAuthorizationToken(ctx context.Context, input *ecr.GetAuthorizationTokenInput, optFns ...func(*ecr.Options)) (*ecr.GetAuthorizationTokenOutput, error)
 }
@@ -242,6 +254,26 @@ func (h *DockerRegistryHandler) authenticateWithCredential(
 		return
 	}
 
+	if helpers.AreHostnamesEqual(req.URL.Hostname(), ecrPublicHost) {
+		// Without a token the request is sent anonymously, which public
+		// images still allow, rather than with the AWS secret key.
+		if !cred.getECRPublicCredentials(req.Context(), proxyCtx) {
+			return
+		}
+		// ECR Public rejects Basic auth on registry requests with a 400
+		// instead of a 401 challenge, so the token flow below would never
+		// start. Its HTTP API takes the GetAuthorizationToken token,
+		// base64("AWS:<password>"), as a bearer token, so send that
+		// directly. Other paths, such as /token, still accept Basic auth and
+		// keep the token flow below.
+		if _, ok := helpers.MatchingPathPrefix(req.URL.EscapedPath(), "/v2"); ok {
+			logging.RequestLogf(proxyCtx, "* authenticating docker ecr public request (host: %s)", req.URL.Hostname())
+			token := base64.StdEncoding.EncodeToString([]byte(cred.getUsername() + ":" + cred.getPassword()))
+			helpers.SetBearerAuthorization(req, token)
+			return
+		}
+	}
+
 	logging.RequestLogf(proxyCtx, "* authenticating docker registry request (host: %s)", req.URL.Hostname())
 	transport := &registry.BasicTransport{
 		Transport: &registry.TokenTransport{
@@ -396,19 +428,32 @@ func dockerRegistryCredentialLocation(location string, proxyOnly bool) (matchURL
 }
 
 func defaultGetECRClient(ctx context.Context, region, keyID, secretKey string, client *http.Client) (ecrClient, error) {
-	cfg, err := awsconfig.LoadDefaultConfig(
-		ctx,
-		awsconfig.WithRegion(region),
-		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(keyID, secretKey, "")),
-		awsconfig.WithHTTPClient(client),
-	)
+	cfg, err := loadAWSConfig(ctx, region, keyID, secretKey, client)
 	if err != nil {
 		return nil, err
 	}
 
 	return ecr.NewFromConfig(cfg), nil
 }
 
+func defaultGetECRPublicClient(ctx context.Context, keyID, secretKey string, client *http.Client) (*ecrpublic.Client, error) {
+	cfg, err := loadAWSConfig(ctx, ecrPublicRegion, keyID, secretKey, client)
+	if err != nil {
+		return nil, err
+	}
+
+	return ecrpublic.NewFromConfig(cfg), nil
+}
+
+func loadAWSConfig(ctx context.Context, region, keyID, secretKey string, client *http.Client) (aws.Config, error) {
+	return awsconfig.LoadDefaultConfig(
+		ctx,
+		awsconfig.WithRegion(region),
+		awsconfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(keyID, secretKey, "")),
+		awsconfig.WithHTTPClient(client),
+	)
+}
+
 type dockerOIDCCredential struct {
 	matchURL   string
 	path       string
@@ -429,20 +474,21 @@ type dockerRegistryCredentials struct {
 }
 
 func (c *dockerRegistryCredentials) getECRCredentials(requestCtx context.Context, proxyCtx *goproxy.ProxyCtx) bool {
-	if c.ecrUsername != "" && c.ecrPassword != "" {
-		return true
-	}
-
 	regURL, err := helpers.ParseURLLax(c.registry)
 	if err != nil {
 		return false
 	}
 
+	// Checked before the cached token, which may be an ECR Public one.
 	match := ecrRe.FindStringSubmatch(regURL.Hostname())
 	if match == nil || len(match) != 2 {
 		return false
 	}
 
+	if c.ecrUsername != "" && c.ecrPassword != "" {
+		return true
+	}
+
 	region := match[1]
 	ecrSvc, err := c.getECRClient(requestCtx, region, c.username, c.password, c.httpClient)
 	if err != nil {
@@ -475,6 +521,41 @@ func (c *dockerRegistryCredentials) getECRCredentials(requestCtx context.Context
 	return false
 }
 
+// getECRPublicCredentials exchanges an AWS access key pair for an ECR Public
+// authorization token. A pre-generated token is used as is.
+func (c *dockerRegistryCredentials) getECRPublicCredentials(requestCtx context.Context, proxyCtx *goproxy.ProxyCtx) bool {
+	if c.username == ecrPublicTokenUsername || (c.ecrUsername != "" && c.ecrPassword != "") {
+		return true
+	}
+
+	ecrSvc, err := defaultGetECRPublicClient(requestCtx, c.username, c.password, c.httpClient)
+	if err != nil {
+		logging.RequestLogf(proxyCtx, "! failed to initialize aws ecr public client (key_id=%s)", c.username)
+		return false
+	}
+
+	rsp, err := ecrSvc.GetAuthorizationToken(requestCtx, &ecrpublic.GetAuthorizationTokenInput{})
+	if err != nil {
+		logging.RequestLogf(proxyCtx, "! failed to get ecr public authorization token (key_id=%s)", c.username)
+		return false
+	}
+	if rsp.AuthorizationData == nil || rsp.AuthorizationData.AuthorizationToken == nil {
+		return false
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(*rsp.AuthorizationData.AuthorizationToken)
+	if err != nil {
+		return false
+	}
+	username, password, found := strings.Cut(string(decoded), ":")
+	if !found {
+		return false
+	}
+	c.ecrUsername = username
+	c.ecrPassword = password
+	return true
+}
+
 func (c *dockerRegistryCredentials) getUsername() string {
 	if c.ecrUsername != "" {
 		return c.ecrUsername

internal/handlers/docker_registry_test.go

@@ -33,6 +33,7 @@ func TestDockerRegistryHandler(t *testing.T) {
 	ecrSecretKey := "BigLongAWSSecretKey"
 	ecrDockerUser := "AWS"
 	ecrDockerPassword := "BigLongGeneratedRegistryPassword"
+	ecrPublicToken := "BigLongGeneratedPublicRegistryPassword"
 	credentials := config.Credentials{
 		config.Credential{
 			"type":     "docker_registry",
@@ -52,6 +53,12 @@ func TestDockerRegistryHandler(t *testing.T) {
 			"username": ecrKeyID,
 			"password": ecrSecretKey,
 		},
+		config.Credential{
+			"type":     "docker_registry",
+			"registry": "public.ecr.aws",
+			"username": ecrDockerUser,
+			"password": ecrPublicToken,
+		},
 		config.Credential{
 			"type":     "docker_registry",
 			"registry": "nexus.someco.com",
@@ -159,6 +166,13 @@ func TestDockerRegistryHandler(t *testing.T) {
 	assert.False(t, ok, "ecr request isn't assigned a docker registry transport")
 	assertUnauthenticated(t, req, "leaked ecr credentials")
 
+	// ECR Public
+	req = httptest.NewRequestWithContext(t.Context(), "GET", "https://public.ecr.aws/v2/docker/library/alpine/manifests/latest", nil)
+	proxyCtx = &goproxy.ProxyCtx{}
+	req = handleRequestAndClose(handler, req, proxyCtx)
+	assert.Nil(t, proxyCtx.RoundTripper, "ecr public request isn't assigned a docker registry transport")
+	assertHasTokenAuth(t, req, "Bearer", base64.StdEncoding.EncodeToString([]byte(ecrDockerUser+":"+ecrPublicToken)), "has ecr public bearer token")
+
 	// Missing repo subdomain
 	req = httptest.NewRequestWithContext(t.Context(), "GET", "https://bigco.com/v2/their-repo/manifests/latest", nil)
 	proxyCtx = &goproxy.ProxyCtx{}
@@ -492,6 +506,144 @@ func TestDockerRegistryHandlerPathScopedCredentialFallsBackToHost(t *testing.T)
 	}
 }
 
+func TestDockerRegistryHandlerECRPublic(t *testing.T) {
+	client := &http.Client{Transport: &recordingECRTransport{}, Timeout: testOIDCClient.Timeout}
+	bearer := base64.StdEncoding.EncodeToString([]byte("AWS:public-password"))
+
+	tests := []struct {
+		name          string
+		credential    config.Credential
+		requestURL    string
+		authorization string
+		// bearer is the expected bearer token; empty means the request keeps
+		// the Basic token flow transport.
+		bearer string
+	}{
+		{
+			name:       "registry API",
+			credential: config.Credential{"registry": "public.ecr.aws"},
+			requestURL: "https://public.ecr.aws/v2/docker/library/alpine/manifests/latest",
+			bearer:     bearer,
+		},
+		{
+			name:       "path scoped credential",
+			credential: config.Credential{"registry": "public.ecr.aws/my-alias"},
+			requestURL: "https://public.ecr.aws/v2/my-alias/app/manifests/latest",
+			bearer:     bearer,
+		},
+		{
+			name:       "proxy-only credential",
+			credential: config.Credential{"registry": "public.ecr.aws", "proxy-only": true},
+			requestURL: "https://public.ecr.aws/v2/docker/library/alpine/manifests/latest",
+			bearer:     bearer,
+		},
+		{
+			name:          "client authorization is kept",
+			credential:    config.Credential{"registry": "public.ecr.aws"},
+			requestURL:    "https://public.ecr.aws/v2/docker/library/alpine/manifests/latest",
+			authorization: "Bearer client-token",
+			bearer:        "client-token",
+		},
+		{
+			name:       "token endpoint",
+			credential: config.Credential{"registry": "public.ecr.aws"},
+			requestURL: "https://public.ecr.aws/token/?service=public.ecr.aws&scope=repository:docker/library/alpine:pull",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cred := config.Credential{"type": "docker_registry", "username": "AWS", "password": "public-password"}
+			for key, value := range test.credential {
+				cred[key] = value
+			}
+			handler := NewDockerRegistryHandler(config.Credentials{cred}, client, nil)
+
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, test.requestURL, nil)
+			if test.authorization != "" {
+				req.Header.Set("Authorization", test.authorization)
+			}
+			proxyCtx := &goproxy.ProxyCtx{}
+			req = handleRequestAndClose(handler, req, proxyCtx)
+
+			if test.bearer != "" {
+				assert.Nil(t, proxyCtx.RoundTripper, "no docker registry transport")
+				assertHasTokenAuth(t, req, "Bearer", test.bearer, "has ecr public bearer token")
+				return
+			}
+			rt, ok := proxyCtx.RoundTripper.(*dockerRegistryRoundTripper)
+			require.True(t, ok, "request is assigned a docker registry transport")
+			transport := rt.transport.(*registry.BasicTransport)
+			assert.Equal(t, "AWS", transport.Username)
+			assert.Equal(t, "public-password", transport.Password)
+		})
+	}
+}
+
+func TestDockerRegistryHandlerECRPublicAccessKey(t *testing.T) {
+	const manifestURL = "https://public.ecr.aws/v2/docker/library/alpine/manifests/latest"
+	newHandler := func(username string, transport *ecrPublicTokenTransport) *DockerRegistryHandler {
+		client := &http.Client{Transport: transport, Timeout: testOIDCClient.Timeout}
+		return NewDockerRegistryHandler(config.Credentials{{
+			"type":     "docker_registry",
+			"registry": "public.ecr.aws",
+			"username": username,
+			"password": "secret-key",
+		}}, client, nil)
+	}
+
+	t.Run("registry API", func(t *testing.T) {
+		transport := &ecrPublicTokenTransport{status: http.StatusOK}
+		handler := newHandler("access-key", transport)
+
+		for range 2 {
+			req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, manifestURL, nil)
+			proxyCtx := &goproxy.ProxyCtx{}
+			req = handleRequestAndClose(handler, req, proxyCtx)
+			assert.Nil(t, proxyCtx.RoundTripper, "no docker registry transport")
+			assertHasTokenAuth(t, req, "Bearer", base64.StdEncoding.EncodeToString([]byte("AWS:fetched-password")), "has fetched bearer token")
+		}
+		assert.Equal(t, []string{"api.ecr-public.us-east-1.amazonaws.com"}, transport.hosts, "token is fetched once from us-east-1")
+	})
+
+	t.Run("token endpoint", func(t *testing.T) {
+		transport := &ecrPublicTokenTransport{status: http.StatusOK}
+		handler := newHandler("access-key", transport)
+
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet,
+			"https://public.ecr.aws/token/?service=public.ecr.aws&scope=repository:docker/library/alpine:pull", nil)
+		proxyCtx := &goproxy.ProxyCtx{}
+		handleRequestAndClose(handler, req, proxyCtx)
+		rt, ok := proxyCtx.RoundTripper.(*dockerRegistryRoundTripper)
+		require.True(t, ok, "request is assigned a docker registry transport")
+		trans := rt.transport.(*registry.BasicTransport)
+		assert.Equal(t, "AWS", trans.Username)
+		assert.Equal(t, "fetched-password", trans.Password)
+	})
+
+	t.Run("failed token request", func(t *testing.T) {
+		transport := &ecrPublicTokenTransport{status: http.StatusBadRequest}
+		handler := newHandler("access-key", transport)
+
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, manifestURL, nil)
+		proxyCtx := &goproxy.ProxyCtx{}
+		req = handleRequestAndClose(handler, req, proxyCtx)
+		assert.Nil(t, proxyCtx.RoundTripper, "no docker registry transport")
+		assertUnauthenticated(t, req, "secret key isn't sent")
+	})
+
+	t.Run("pre-generated token", func(t *testing.T) {
+		transport := &ecrPublicTokenTransport{status: http.StatusOK}
+		handler := newHandler("AWS", transport)
+
+		req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, manifestURL, nil)
+		proxyCtx := &goproxy.ProxyCtx{}
+		req = handleRequestAndClose(handler, req, proxyCtx)
+		assertHasTokenAuth(t, req, "Bearer", base64.StdEncoding.EncodeToString([]byte("AWS:secret-key")), "has pre-generated bearer token")
+		assert.Empty(t, transport.hosts, "no token is fetched")
+	})
+}
+
 func TestDockerRegistryHandlerPathScopedOIDCCredentialFallsBackToHost(t *testing.T) {
 	const tokenURL = "https://token.actions.example.com"                       //nolint:gosec // test URL
 	const jfrogTokenURL = "https://jfrog.example.com/access/api/v1/oidc/token" //nolint:gosec // test URL
@@ -689,6 +841,30 @@ func (t *recordingECRTransport) RoundTrip(req *http.Request) (*http.Response, er
 	}, nil
 }
 
+// ecrPublicTokenTransport answers ECR Public GetAuthorizationToken requests
+// with a token for AWS:fetched-password, or an error for a non-200 status.
+type ecrPublicTokenTransport struct {
+	status int
+	hosts  []string
+}
+
+func (t *ecrPublicTokenTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	t.hosts = append(t.hosts, req.URL.Host)
+	body := `{"__type":"InvalidParameterException","message":"invalid"}`
+	if t.status == http.StatusOK {
+		token := base64.StdEncoding.EncodeToString([]byte("AWS:fetched-password"))
+		body = `{"authorizationData":{"authorizationToken":"` + token + `"}}`
+	}
+	header := make(http.Header)
+	header.Set("Content-Type", "application/x-amz-json-1.1")
+	return &http.Response{
+		StatusCode: t.status,
+		Body:       io.NopCloser(strings.NewReader(body)),
+		Header:     header,
+		Request:    req,
+	}, nil
+}
+
 type dockerChallengeTransport struct {
 	t     *testing.T
 	paths []string