[Fixed] import token validation: validate activation/allow signing ke…

…ys (#124) Signed-off-by: Matthias Hanel <mh@synadia.com>
nats-io · Dec 7, 2020 · 5b8857f · 5b8857f
1 parent 0ea3265
commit 5b8857f
Show file tree

Hide file tree

Showing 2 changed files with 64 additions and 3 deletions.
diff --git a/v2/imports.go b/v2/imports.go
@@ -107,13 +107,14 @@ func (i *Import) Validate(actPubKey string, vr *ValidationResults) {
 	}
 
 	if act != nil {
-		if act.Issuer != i.Account {
-			vr.AddWarning("activation token doesn't match account for import %q", i.Subject)
+		if !(act.Issuer == i.Account || act.IssuerAccount == i.Account) {
+			vr.AddError("activation token doesn't match account for import %q", i.Subject)
 		}
 
 		if act.ClaimsData.Subject != actPubKey {
-			vr.AddWarning("activation token doesn't match account it is being included in, %q", i.Subject)
+			vr.AddError("activation token doesn't match account it is being included in, %q", i.Subject)
 		}
+		act.Validate(vr)
 	} else {
 		vr.AddWarning("no activation provided for import %s", i.Subject)
 	}

diff --git a/v2/imports_test.go b/v2/imports_test.go
@@ -70,6 +70,66 @@ func TestImportValidation(t *testing.T) {
 	}
 }
 
+func TestImportValidationExpiredToken(t *testing.T) {
+	ak := createAccountNKey(t)
+	ak2 := createAccountNKey(t)
+	akp := publicKey(ak, t)
+	akp2 := publicKey(ak2, t)
+	i := &Import{Subject: "test", Account: akp2, To: "bar", Type: Stream}
+
+	activation := NewActivationClaims(akp)
+	activation.Expires = time.Now().Add(-time.Hour).UTC().Unix()
+	activation.ImportSubject = "test"
+	activation.ImportType = Stream
+	i.Token = encode(activation, ak2, t)
+	vr := CreateValidationResults()
+	i.Validate(akp, vr)
+	if vr.IsEmpty() || !vr.IsBlocking(true) || vr.IsBlocking(false) {
+		t.Errorf("Expired token needs to result in a time check error")
+	}
+}
+
+func TestImportValidationDifferentAccount(t *testing.T) {
+	ak := createAccountNKey(t)
+	ak2 := createAccountNKey(t)
+	akp := publicKey(ak, t)
+	akp2 := publicKey(ak2, t)
+	otherAccount := publicKey(createAccountNKey(t), t)
+	i := &Import{Subject: "test", Account: akp2, To: "bar", Type: Stream}
+
+	activation := NewActivationClaims(otherAccount)
+	activation.Expires = time.Now().Add(-time.Hour).UTC().Unix()
+	activation.ImportSubject = "test"
+	activation.ImportType = Stream
+	i.Token = encode(activation, ak2, t)
+	vr := CreateValidationResults()
+	i.Validate(akp, vr)
+	if vr.IsEmpty() || !vr.IsBlocking(false) {
+		t.Errorf("Expired import needs to result in a time check error")
+	}
+}
+
+func TestImportValidationSigningKey(t *testing.T) {
+	ak := createAccountNKey(t)
+	ak2 := createAccountNKey(t)
+	ak2Sk := createAccountNKey(t)
+	akp := publicKey(ak, t)
+	akp2 := publicKey(ak2, t)
+	i := &Import{Subject: "test", Account: akp2, To: "bar", Type: Stream}
+
+	activation := NewActivationClaims(akp)
+	activation.Expires = time.Now().Add(time.Hour).UTC().Unix()
+	activation.ImportSubject = "test"
+	activation.ImportType = Stream
+	activation.IssuerAccount = akp2
+	i.Token = encode(activation, ak2Sk, t)
+	vr := CreateValidationResults()
+	i.Validate(akp, vr)
+	if !vr.IsEmpty() {
+		t.Errorf("Expired import needs to not result in an error")
+	}
+}
+
 func TestInvalidImportType(t *testing.T) {
 	ak := createAccountNKey(t)
 	akp := publicKey(ak, t)