Adapt webhook proxy to use HMAC

CHANGELOG.md

@@ -7,6 +7,7 @@
 - Add client credentials support to external services templates in the ODS API Service ([#1388](https://github.com/opendevstack/ods-core/pull/1388))
 
 ### Changed
+- Adapt webhook proxy to use HMAC ([#1403](https://github.com/opendevstack/ods-core/pull/1403))
 
 ### Fixed
 - Fixes VIT0089540 ([#1395](https://github.com/opendevstack/ods-core/pull/1395))

configuration-sample/ods-core.env.sample

@@ -344,6 +344,10 @@ OPENSHIFT_APPS_BASEDOMAIN=.192.168.56.101.nip.io
 PIPELINE_TRIGGER_SECRET_B64=changeme_base64
 PIPELINE_TRIGGER_SECRET=changeme
 
+# Webhook HMAC Secret used to sign and verify requests to/from the webhook proxy.
+# Use a high-entropy random value (e.g. generated by generate_hmac_secret.sh).
+WEBHOOK_HMAC_SECRET=changeme
+
 ###########
 # Storage #
 ###########

create-projects/Jenkinsfile

@@ -7,6 +7,8 @@ def projectId = env.PROJECT_ID
 def projectAdmins = env.PROJECT_ADMIN ?: ''
 def projectGroups = env.PROJECT_GROUPS ?: ''
 def pipelineTriggerSecret = env.PIPELINE_TRIGGER_SECRET
+def webhookHmacKey = env.WEBHOOK_HMAC_KEY
+def webhookAllowedIpRanges = env.WEBHOOK_ALLOWED_IP_RANGES
 def cdUserIdB64 = env.CD_USER_ID_B64
 def cdUserType = env.CD_USER_TYPE
 if (!(projectId ==~ /^[A-Za-z\d]+$/)) {
@@ -102,6 +104,8 @@ podTemplate(
             --ods-image-tag=${odsImageTag} \
             --ods-bitbucket-project ${odsBitbucketProject} \
             --pipeline-trigger-secret-b64=${pipelineTriggerSecret} \
+            --webhook-hmac-key-b64=${webhookHmacKey} \
+            --webhook-allowed-ip-ranges=${webhookAllowedIpRanges} \
             --cd-user-type=${cdUserType} \
             --cd-user-id-b64=${cdUserIdB64}""",
           label: 'Setup Jenkins in CD project'
@@ -178,7 +182,7 @@ podTemplate(
             env.POST_SCRIPTS_ENABLED = 'false'
             return
         }
-        
+
         echo("Scripts repository: ${scriptsRepoUrl}")
         echo("Scripts branch: ${scriptsBranch}")
         echo("Scripts order: ${scriptsOrder}")
@@ -251,6 +255,7 @@ podTemplate(
             "BITBUCKET_URL=${bitbucketUrl}",
             "DOCKER_REGISTRY=${dockerRegistry}",
             "CD_USERNAME=${username}",
+            "CD_PASSWORD=${password}",
             "CD_USER_CREDENTIALS_ID=${credentialsId}"
           ]) {
               echo("Environment variables for scripts:")

create-projects/create-cd-jenkins.sh

@@ -18,6 +18,8 @@ PROJECT_ID=""
 CD_USER_TYPE=""
 CD_USER_ID_B64=""
 PIPELINE_TRIGGER_SECRET_B64=""
+WEBHOOK_HMAC_KEY_B64=""
+WEBHOOK_ALLOWED_IP_RANGES=""
 TAILOR_VERBOSE=""
 TAILOR_NON_INTERACTIVE=""
 
@@ -31,6 +33,8 @@ function usage {
   printf "\t--ods-image-tag\t\t\tThe image tag to use. Default: %s\n" "${ODS_IMAGE_TAG}"
   printf "\t--ods-bitbucket-project\t\t\tThe Bitbucket project to use. Default: %s\n" "${ODS_BITBUCKET_PROJECT}"
   printf "\t--pipeline-trigger-secret-b64\tTrigger secret for pipelines (base64 encoded)\n"
+  printf "\t--webhook-hmac-key-b64\tHMAC key for the webhook proxy (base64 encoded)\n"
+  printf "\t--webhook-allowed-ip-ranges\tAllowed IP ranges for the webhook proxy\n"
   printf "\t--cd-user-type\t\t\tWhether CD user is general or project specific\n"
   printf "\t--cd-user-id-b64\t\tName of CD user (base64 encoded)\n"
 }
@@ -60,6 +64,12 @@ while [[ "$#" -gt 0 ]]; do case $1 in
   --pipeline-trigger-secret-b64=*) PIPELINE_TRIGGER_SECRET_B64="${1#*=}";;
   --pipeline-trigger-secret-b64)   PIPELINE_TRIGGER_SECRET_B64="$2"; shift;;
 
+  --webhook-hmac-key-b64=*) WEBHOOK_HMAC_KEY_B64="${1#*=}";;
+  --webhook-hmac-key-b64)   WEBHOOK_HMAC_KEY_B64="$2"; shift;;
+
+  --webhook-allowed-ip-ranges=*) WEBHOOK_ALLOWED_IP_RANGES="${1#*=}";;
+  --webhook-allowed-ip-ranges)   WEBHOOK_ALLOWED_IP_RANGES="$2"; shift;;
+
   --cd-user-type=*) CD_USER_TYPE="${1#*=}";;
   --cd-user-type)   CD_USER_TYPE="$2"; shift;;
 
@@ -81,6 +91,16 @@ if [ -z "${PIPELINE_TRIGGER_SECRET_B64}" ]; then
   exit 1
 fi
 
+if [ -z "${WEBHOOK_HMAC_KEY_B64}" ]; then
+  echo "--webhook-hmac-key-b64 is missing, but required"; usage
+  exit 1
+fi
+
+if [ -z "${WEBHOOK_ALLOWED_IP_RANGES}" ]; then
+  echo "--webhook-allowed-ip-ranges is missing, but required"; usage
+  exit 1
+fi
+
 if [ -z "${CD_USER_TYPE}" ]; then
   echo "--cd-user-type is missing, but required"; usage
   exit 1
@@ -111,6 +131,8 @@ cd "${ODS_CORE_DIR}/jenkins/ocp-config/deploy"
 ${TAILOR} ${TAILOR_VERBOSE} ${TAILOR_NON_INTERACTIVE} apply \
   "--namespace=${PROJECT_ID}-cd" \
   "--param=PIPELINE_TRIGGER_SECRET_B64=${PIPELINE_TRIGGER_SECRET_B64}" \
+  "--param=WEBHOOK_HMAC_KEY_B64=${WEBHOOK_HMAC_KEY_B64}" \
+  "--param=WEBHOOK_ALLOWED_IP_RANGES=${WEBHOOK_ALLOWED_IP_RANGES}" \
   "--param=PROJECT=${PROJECT_ID}" \
   "--param=CD_USER_ID_B64=${CD_USER_ID_B64}" \
   "--param=ODS_NAMESPACE=${ODS_NAMESPACE}" \

create-projects/tests/run.sh

@@ -97,7 +97,7 @@ echo "=== create-cd-jenkins: With general CD user ==="
 
 tailor mock --receive='version' --stdout='1.3.4'
 
-tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELINE_TRIGGER_SECRET_B64=czNjcjN0 --param=PROJECT=foo --param=CD_USER_ID_B64=Y2RfdXNlcg== --param=ODS_NAMESPACE=bar --param=ODS_IMAGE_TAG=3.x --param=ODS_BITBUCKET_PROJECT=opendevstack --selector template=ods-jenkins-template' --times 1
+tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELINE_TRIGGER_SECRET_B64=czNjcjN0 --param=WEBHOOK_HMAC_KEY_B64=d2ViaG9vay1zZWNyZXQ= --param=WEBHOOK_ALLOWED_IP_RANGES=0.0.0.0/0 --param=PROJECT=foo --param=CD_USER_ID_B64=Y2RfdXNlcg== --param=ODS_NAMESPACE=bar --param=ODS_IMAGE_TAG=3.x --param=ODS_BITBUCKET_PROJECT=opendevstack --selector template=ods-jenkins-template' --times 1
 
 ../create-cd-jenkins.sh \
     --project foo \
@@ -106,6 +106,8 @@ tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELI
     --ods-image-tag=3.x \
     --ods-bitbucket-project=opendevstack \
     --pipeline-trigger-secret-b64=$(echo -n "s3cr3t" | base64) \
+    --webhook-hmac-key-b64=$(echo -n "webhook-secret" | base64) \
+    --webhook-allowed-ip-ranges='0.0.0.0/0' \
     --cd-user-type=general \
     --cd-user-id-b64=$(echo -n "cd_user" | base64) \
 
@@ -116,7 +118,7 @@ echo "=== create-cd-jenkins: With project-specific CD user ==="
 
 tailor mock --receive='version' --stdout='1.3.4'
 
-tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELINE_TRIGGER_SECRET_B64=czNjcjN0 --param=PROJECT=foo --param=CD_USER_ID_B64=Zm9v --param=ODS_NAMESPACE=bar --param=ODS_IMAGE_TAG=3.x --param=ODS_BITBUCKET_PROJECT=opendevstack --param=CD_USER_PWD_B64=Y2hhbmdlbWU= --selector template=ods-jenkins-template' --times 1
+tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELINE_TRIGGER_SECRET_B64=czNjcjN0 --param=WEBHOOK_HMAC_KEY_B64=d2ViaG9vay1zZWNyZXQ= --param=WEBHOOK_ALLOWED_IP_RANGES=0.0.0.0/0 --param=PROJECT=foo --param=CD_USER_ID_B64=Zm9v --param=ODS_NAMESPACE=bar --param=ODS_IMAGE_TAG=3.x --param=ODS_BITBUCKET_PROJECT=opendevstack --param=CD_USER_PWD_B64=Y2hhbmdlbWU= --selector template=ods-jenkins-template' --times 1
 
 ../create-cd-jenkins.sh \
     --project foo \
@@ -125,6 +127,8 @@ tailor mock --receive='--non-interactive apply --namespace=foo-cd --param=PIPELI
     --ods-image-tag=3.x \
     --ods-bitbucket-project=opendevstack \
     --pipeline-trigger-secret-b64=$(echo -n "s3cr3t" | base64) \
+    --webhook-hmac-key-b64=$(echo -n "webhook-secret" | base64) \
+    --webhook-allowed-ip-ranges='0.0.0.0/0' \
     --cd-user-type=specific \
     --cd-user-id-b64=$(echo -n "foo" | base64) \
 

jenkins/ocp-config/deploy/jenkins-webhook-proxy.yml

@@ -18,12 +18,14 @@ parameters:
   required: true
 - name: PIPELINE_TRIGGER_SECRET_B64
   required: true
+- name: WEBHOOK_HMAC_KEY_B64
+  required: true
 - name: ODS_BITBUCKET_PROJECT
   required: true
 - name: MAX_DELETION_CHECKS
   value: '10'
   required: true
-- name: ALLOWED_WEBHOOK_IP_RANGES
+- name: WEBHOOK_ALLOWED_IP_RANGES
   description: >-
     Comma-separated list of allowed source IP addresses or CIDR ranges for
     incoming webhook requests (e.g. "185.166.140.0/22,10.0.0.1").
@@ -111,12 +113,17 @@ objects:
           - name: MAX_DELETION_CHECKS
             value: ${MAX_DELETION_CHECKS}
           - name: ALLOWED_WEBHOOK_IP_RANGES
-            value: ${ALLOWED_WEBHOOK_IP_RANGES}
+            value: ${WEBHOOK_ALLOWED_IP_RANGES}
           - name: TRIGGER_SECRET
             valueFrom:
               secretKeyRef:
                 key: trigger-secret
                 name: webhook-proxy
+          - name: WEBHOOK_HMAC_SECRET
+            valueFrom:
+              secretKeyRef:
+                key: webhook-hmac-secret
+                name: webhook-proxy
           image: '${DOCKER_REGISTRY}/${ODS_NAMESPACE}/jenkins-webhook-proxy:${ODS_IMAGE_TAG}'
           imagePullPolicy: Always
           name: webhook-proxy
@@ -150,3 +157,4 @@ objects:
   type: opaque
   data:
     trigger-secret: ${PIPELINE_TRIGGER_SECRET_B64}
+    webhook-hmac-secret: ${WEBHOOK_HMAC_KEY_B64}

jenkins/webhook-proxy/generate_hmac_secret.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Generates a high-entropy secret suitable for WEBHOOK_HMAC_SECRET.
+# Usage:
+#   bash generate_hmac_secret.sh
+#   bash generate_hmac_secret.sh 64
+
+length="${1:-64}"
+
+if ! [[ "$length" =~ ^[0-9]+$ ]]; then
+    echo "error: length must be a positive integer" >&2
+    exit 1
+fi
+
+if (( length < 32 )); then
+    echo "error: length must be at least 32 characters" >&2
+    exit 1
+fi
+
+if command -v openssl >/dev/null 2>&1; then
+    secret=$(openssl rand -hex $(((length + 1) / 2)) | cut -c1-"$length")
+elif [[ -r /dev/urandom ]]; then
+    secret=$(tr -dc 'a-f0-9' </dev/urandom | head -c "$length")
+else
+    echo "error: neither openssl nor /dev/urandom is available" >&2
+    exit 1
+fi
+
+printf 'WEBHOOK_HMAC_SECRET=%s\n' "$secret"

jenkins/webhook-proxy/main.go

@@ -2,13 +2,16 @@ package main
 
 import (
 	"bytes"
+	"crypto/hmac"
 	"crypto/sha1"
+	"crypto/sha256"
 	"crypto/subtle"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"hash"
 	"io"
 	"log"
 	"math/rand"
@@ -33,9 +36,6 @@ var (
 	// which implicitly rejects absolute paths ("/..."), path traversal ("../"),
 	// and hidden-file tricks (".").
 	safeJenkinsfilePathRegex = regexp.MustCompile(`^[a-zA-Z0-9][a-zA-Z0-9._-]*(?:/[a-zA-Z0-9][a-zA-Z0-9._-]*)*$`)
-	// safeTriggerSecretRegex matches a UUID as produced by Java's
-	// UUID.randomUUID().toString(): 8-4-4-4-12 lowercase hex digits.
-	safeTriggerSecretRegex = regexp.MustCompile(`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`)
 )
 
 const (
@@ -46,6 +46,7 @@ const (
 	pipelineConfigFilename         = "pipeline.json.tmpl"
 	repoBaseEnvVar                 = "REPO_BASE"
 	triggerSecretEnvVar            = "TRIGGER_SECRET"
+	webhookHMACSecretEnvVar        = "WEBHOOK_HMAC_SECRET"
 	jenkinsfilePathDefault         = "Jenkinsfile"
 	protectedBranchesEnvVar        = "PROTECTED_BRANCHES"
 	protectedBranchesDefault       = "master,develop,production,staging,release/"
@@ -62,6 +63,7 @@ const (
 	allowedChangeRefTypesEnvVar    = "ALLOWED_CHANGE_REF_TYPES"
 	allowedChangeRefTypesDefault   = "BRANCH"
 	allowedWebhookIPRangesEnvVar   = "ALLOWED_WEBHOOK_IP_RANGES"
+	bitbucketSignatureHeader       = "X-Hub-Signature"
 	namespaceSuffix                = "-cd"
 	letterBytes                    = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
 )
@@ -143,6 +145,7 @@ type Server struct {
 	Client                  Client
 	Namespace               string
 	Project                 string
+	WebhookHMACSecret       string
 	TriggerSecret           string
 	ProtectedBranches       []string
 	AcceptedEvents          []string
@@ -194,8 +197,13 @@ func main() {
 	}
 
 	triggerSecret := os.Getenv(triggerSecretEnvVar)
-	if !safeTriggerSecretRegex.MatchString(triggerSecret) {
-		log.Fatalln("Trigger secret must be a valid UUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx).")
+	if len(triggerSecret) == 0 {
+		log.Fatalln(triggerSecretEnvVar, "must be set")
+	}
+
+	webhookHMACSecret := os.Getenv(webhookHMACSecretEnvVar)
+	if len(webhookHMACSecret) == 0 {
+		log.Fatalln(webhookHMACSecretEnvVar, "must be set")
 	}
 
 	openShiftAPIHost := os.Getenv(openShiftAPIHostEnvVar)
@@ -295,6 +303,7 @@ func main() {
 		Client:                  client,
 		Namespace:               namespace,
 		Project:                 project,
+		WebhookHMACSecret:       webhookHMACSecret,
 		TriggerSecret:           triggerSecret,
 		ProtectedBranches:       protectedBranches,
 		AcceptedEvents:          acceptedEvents,
@@ -373,14 +382,22 @@ func (s *Server) HandleRoot() http.HandlerFunc {
 			return
 		}
 
-		queryValues := r.URL.Query()
-		triggerSecretParam := queryValues.Get("trigger_secret")
-		if subtle.ConstantTimeCompare([]byte(triggerSecretParam), []byte(s.TriggerSecret)) != 1 {
-			log.Println(requestID, "trigger_secret param not given / not matching")
+		body, readErr := io.ReadAll(r.Body)
+		if readErr != nil {
+			log.Println(requestID, "Cannot read request body:", readErr)
+			http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)
+			return
+		}
+
+		signatureErr := verifyBitbucketPayloadSignature(s.WebhookHMACSecret, body, r.Header.Get(bitbucketSignatureHeader))
+		if signatureErr != nil {
+			log.Println(requestID, "Bitbucket payload signature rejected:", signatureErr)
 			http.Error(w, "Not authorized", http.StatusUnauthorized)
 			return
 		}
 
+		queryValues := r.URL.Query()
+
 		jenkinsfilePath := jenkinsfilePathDefault
 		jenkinsfilePathParam := queryValues.Get("jenkinsfile_path")
 		if jenkinsfilePathParam != "" {
@@ -399,7 +416,7 @@ func (s *Server) HandleRoot() http.HandlerFunc {
 
 		if strings.HasPrefix(r.URL.Path, "/build") {
 			req := &requestBuild{}
-			err := json.NewDecoder(r.Body).Decode(req)
+			err := json.Unmarshal(body, req)
 			if err != nil {
 				msg := fmt.Sprintf("Cannot parse JSON: %s", err)
 				log.Println(requestID, msg)
@@ -431,9 +448,8 @@ func (s *Server) HandleRoot() http.HandlerFunc {
 			}
 
 		} else if r.URL.Path == "/" {
-
 			req := &requestBitbucket{}
-			err := json.NewDecoder(r.Body).Decode(req)
+			err := json.Unmarshal(body, req)
 			if err != nil {
 				msg := fmt.Sprintf("Cannot parse JSON: %s", err)
 				log.Println(requestID, msg)
@@ -1121,6 +1137,50 @@ func makePipelineName(project string, component string, branch string) string {
 	return pipeline
 }
 
+func verifyBitbucketPayloadSignature(secret string, payload []byte, signatureHeader string) error {
+	if signatureHeader == "" {
+		return errors.New("missing signature header")
+	}
+
+	parts := strings.SplitN(signatureHeader, "=", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return errors.New("invalid signature header format")
+	}
+
+	algorithm := strings.ToLower(parts[0])
+	expectedDigest, err := computeHMACDigest(algorithm, secret, payload)
+	if err != nil {
+		return err
+	}
+
+	providedDigest := strings.ToLower(parts[1])
+	if subtle.ConstantTimeCompare([]byte(providedDigest), []byte(expectedDigest)) != 1 {
+		return errors.New("signature mismatch")
+	}
+
+	return nil
+}
+
+func computeHMACDigest(algorithm string, secret string, payload []byte) (string, error) {
+	var mac hash.Hash
+
+	switch algorithm {
+	case "sha256":
+		mac = hmac.New(sha256.New, []byte(secret))
+	case "sha1":
+		mac = hmac.New(sha1.New, []byte(secret))
+	default:
+		return "", fmt.Errorf("unsupported signature algorithm: %s", algorithm)
+	}
+
+	_, err := mac.Write(payload)
+	if err != nil {
+		return "", err
+	}
+
+	return fmt.Sprintf("%x", mac.Sum(nil)), nil
+}
+
 func isProtectedBranch(protectedBranches []string, branch string) bool {
 	for _, b := range protectedBranches {
 		if b == "*" {