|
| 1 | +using Amazon.Runtime; |
| 2 | +using Amazon.Runtime.CredentialManagement; |
| 3 | +using IdesLspPoc.Credentials; |
| 4 | +using IdesLspPoc.Output; |
| 5 | +using Microsoft.VisualStudio.Threading; |
| 6 | +using Newtonsoft.Json; |
| 7 | +using Newtonsoft.Json.Serialization; |
| 8 | +using Org.BouncyCastle.Crypto.Engines; |
| 9 | +using Org.BouncyCastle.Crypto.Modes; |
| 10 | +using Org.BouncyCastle.Crypto.Parameters; |
| 11 | +using Org.BouncyCastle.Security; |
| 12 | +using StreamJsonRpc; |
| 13 | +using System; |
| 14 | +using System.Text; |
| 15 | +using System.Threading.Tasks; |
| 16 | +using System.Timers; |
| 17 | + |
| 18 | +namespace IdesLspPoc.LspClient.S3 |
| 19 | +{ |
| 20 | + /// <summary> |
| 21 | + /// This class knows how to push credentials over to the language server (via SendIamCredentialsAsync) |
| 22 | + /// PROOF OF CONCEPT - this class would be used in a product like the AWS Toolkit |
| 23 | + /// to push credentials to the server whenever the credentials state changes (eg: user selects another profile, or |
| 24 | + /// credentials expire). For this concept, it is resolving and pushing credentials every 10 seconds as a |
| 25 | + /// simulation of the Toolkit sending credentials to the server. |
| 26 | + /// This class would also know how to clear credentials from the language server. |
| 27 | + /// </summary> |
| 28 | + internal class S3CredentialsUpdater |
| 29 | + { |
| 30 | + private static readonly JsonSerializerSettings _serializerSettings = new JsonSerializerSettings |
| 31 | + { |
| 32 | + ContractResolver = new DefaultContractResolver |
| 33 | + { |
| 34 | + NamingStrategy = new CamelCaseNamingStrategy(), |
| 35 | + } |
| 36 | + }; |
| 37 | + |
| 38 | + private Timer _resendTimer; |
| 39 | + private OutputWindow _outputWindow; |
| 40 | + private JsonRpc _rpc; |
| 41 | + private byte[] _aesKey; |
| 42 | + |
| 43 | + public S3CredentialsUpdater(JsonRpc rpc, byte[] aesKey, OutputWindow outputWindow) |
| 44 | + { |
| 45 | + this._rpc = rpc; |
| 46 | + _aesKey = aesKey; |
| 47 | + _outputWindow = outputWindow; |
| 48 | + } |
| 49 | + |
| 50 | + /// <summary> |
| 51 | + /// We start sending the lsp server credentials every 10 seconds as a simulation of the credentials state changing |
| 52 | + /// </summary> |
| 53 | + public void StartCredentialsRefreshSimulation() |
| 54 | + { |
| 55 | + _resendTimer?.Stop(); |
| 56 | + |
| 57 | + _resendTimer = new Timer() |
| 58 | + { |
| 59 | + AutoReset = true, |
| 60 | + Interval = 10_000, |
| 61 | + }; |
| 62 | + |
| 63 | + _resendTimer.Elapsed += OnRefreshCredentials; |
| 64 | + |
| 65 | + _resendTimer.Start(); |
| 66 | + } |
| 67 | + |
| 68 | + private void OnRefreshCredentials(object sender, ElapsedEventArgs e) |
| 69 | + { |
| 70 | + // PROOF OF CONCEPT |
| 71 | + // We will resolve the default profile from the local system. |
| 72 | + // In a product, the host extension would know which profile it is configured to provide to the language server. |
| 73 | + var creds = new SharedCredentialsFile(); |
| 74 | + if (!creds.TryGetProfile("default", out var profile)) |
| 75 | + { |
| 76 | + _outputWindow.WriteLine("Client: Unable to get default profile"); |
| 77 | + return; |
| 78 | + } |
| 79 | + |
| 80 | + Task.Run(async () => |
| 81 | + { |
| 82 | + AWSCredentials awsCredentials = profile.GetAWSCredentials(creds); |
| 83 | + var request = CreateUpdateCredentialsRequest(await awsCredentials.GetCredentialsAsync(), _aesKey); |
| 84 | + await SendIamCredentialsAsync(request); |
| 85 | + }).Forget(); |
| 86 | + } |
| 87 | + |
| 88 | + public async Task SendIamCredentialsAsync(UpdateCredentialsRequest request) |
| 89 | + { |
| 90 | + _outputWindow.WriteLine("Client: Sending (simulated) refreshed Credentials to the server"); |
| 91 | + await this._rpc.NotifyAsync("$/aws/credentials/iam/update", request); |
| 92 | + } |
| 93 | + |
| 94 | + private static UpdateCredentialsRequest CreateUpdateCredentialsRequest(ImmutableCredentials credentials, byte[] aesKey) |
| 95 | + { |
| 96 | + var requestData = new UpdateIamCredentialsRequestData |
| 97 | + { |
| 98 | + AccessKeyId = credentials.AccessKey, |
| 99 | + SecretAccessKey = credentials.SecretKey, |
| 100 | + SessionToken = credentials.Token, |
| 101 | + }; |
| 102 | + |
| 103 | + return CreateUpdateCredentialsRequest(requestData, aesKey); |
| 104 | + } |
| 105 | + |
| 106 | + /// <summary> |
| 107 | + /// Creates an "update credentials" request that contains encrypted data |
| 108 | + /// </summary> |
| 109 | + private static UpdateCredentialsRequest CreateUpdateCredentialsRequest(object data, byte[] aesKey) |
| 110 | + { |
| 111 | + byte[] iv = CreateInitializationVector(); |
| 112 | + |
| 113 | + var aesEngine = new AesEngine(); |
| 114 | + int macSize = 8 * aesEngine.GetBlockSize(); |
| 115 | + |
| 116 | + GcmBlockCipher cipher = new GcmBlockCipher(aesEngine); |
| 117 | + AeadParameters parameters = new AeadParameters(new KeyParameter(aesKey), macSize, iv); |
| 118 | + cipher.Init(true, parameters); |
| 119 | + |
| 120 | + var json = JsonConvert.SerializeObject(data, _serializerSettings); |
| 121 | + |
| 122 | + // Encrypt json |
| 123 | + byte[] cipherText = new byte[cipher.GetOutputSize(json.Length)]; |
| 124 | + int len = cipher.ProcessBytes(Encoding.UTF8.GetBytes(json), 0, json.Length, cipherText, 0); |
| 125 | + cipher.DoFinal(cipherText, len); |
| 126 | + |
| 127 | + // Get the authTag |
| 128 | + byte[] mac = cipher.GetMac(); |
| 129 | + string authtag = Convert.ToBase64String(mac); |
| 130 | + var dataLength = cipherText.Length - mac.Length; |
| 131 | + |
| 132 | + return new UpdateCredentialsRequest |
| 133 | + { |
| 134 | + Iv = Convert.ToBase64String(iv), |
| 135 | + // Remove Mac from end of cipherText |
| 136 | + Data = Convert.ToBase64String(cipherText, 0, dataLength), |
| 137 | + AuthTag = authtag, |
| 138 | + }; |
| 139 | + } |
| 140 | + |
| 141 | + private static byte[] CreateInitializationVector() |
| 142 | + { |
| 143 | + var iv = new byte[16]; |
| 144 | + SecureRandom random = new SecureRandom(); |
| 145 | + random.NextBytes(iv); |
| 146 | + return iv; |
| 147 | + } |
| 148 | + } |
| 149 | +} |
0 commit comments