syz-manager: support oauth when calling syz-hub

Permit empty hub_key to indicate oauth.

7 files changed, 58 insertions, 14 deletions

diff --git a/dashboard/dashapi/dashapi.go b/dashboard/dashapi/dashapi.go
index 14fa44faa..a78e25073 100644
--- a/dashboard/dashapi/dashapi.go
+++ b/dashboard/dashapi/dashapi.go
@@ -53,12 +53,12 @@ func NewCustom(client, addr, key string, ctor RequestCtor, doer RequestDoer,
 			return nil, err
 		}
 		wrappedDoer = func(req *http.Request) (*http.Response, error) {
-			if token, err := tokenCache.Get(time.Now()); err == nil {
-				req.Header.Add("Authorization", "Bearer "+token)
-				return doer(req)
-			} else {
+			token, err := tokenCache.Get(time.Now())
+			if err != nil {
 				return nil, err
 			}
+			req.Header.Add("Authorization", token)
+			return doer(req)
 		}
 	}
 	return &Dashboard{
diff --git a/pkg/auth/jwt.go b/pkg/auth/jwt.go
index 3e2313d11..f6d219323 100644
--- a/pkg/auth/jwt.go
+++ b/pkg/auth/jwt.go
@@ -101,7 +101,8 @@ func MakeCache(ctor func(method, url string, body io.Reader) (*http.Request, err
 
 // Get returns a potentially cached value of the token or renews as
 // necessary. The now parameter provides the current time for cache
-// expiration.
+// expiration. The returned value is suitable for Authorization header
+// and syz-hub Key requests.
 func (cache *TokenCache) Get(now time.Time) (string, error) {
 	cache.lock.Lock()
 	defer cache.lock.Unlock()
@@ -118,5 +119,5 @@ func (cache *TokenCache) Get(now time.Time) (string, error) {
 		}
 		cache.token = t
 	}
-	return cache.token.value, nil
+	return "Bearer " + cache.token.value, nil
 }
diff --git a/pkg/mgrconfig/load.go b/pkg/mgrconfig/load.go
index b16e72540..f26b26124 100644
--- a/pkg/mgrconfig/load.go
+++ b/pkg/mgrconfig/load.go
@@ -151,7 +151,6 @@ func Complete(cfg *Config) error {
 		if err := checkNonEmpty(
 			cfg.Name, "name",
 			cfg.HubAddr, "hub_addr",
-			cfg.HubKey, "hub_key",
 		); err != nil {
 			return err
 		}
diff --git a/syz-hub/hub.go b/syz-hub/hub.go
index 195ab74d7..187d4a1eb 100644
--- a/syz-hub/hub.go
+++ b/syz-hub/hub.go
@@ -135,6 +135,8 @@ func (hub *Hub) verifyKey(key, expectedKey string) error {
 		if subj != expectedKey {
 			return fmt.Errorf("bad token")
 		}
+		// Success due to correct token.
+		return nil
 	}
 	if key != expectedKey {
 		return fmt.Errorf("bad password")
diff --git a/syz-manager/hub.go b/syz-manager/hub.go
index f42c71206..25c628580 100644
--- a/syz-manager/hub.go
+++ b/syz-manager/hub.go
@@ -4,9 +4,11 @@
 package main
 
 import (
+	"net/http"
 	"strings"
 	"time"
 
+	"github.com/google/syzkaller/pkg/auth"
 	"github.com/google/syzkaller/pkg/hash"
 	"github.com/google/syzkaller/pkg/host"
 	"github.com/google/syzkaller/pkg/log"
@@ -16,7 +18,23 @@ import (
 	"github.com/google/syzkaller/prog"
 )
 
-func (mgr *Manager) hubSyncLoop() {
+type keyGetter func() (string, error)
+
+func pickGetter(key string) keyGetter {
+	if key != "" {
+		return func() (string, error) { return key, nil }
+	}
+	// Attempts oauth when the configured hub_key is empty.
+	tokenCache, err := auth.MakeCache(http.NewRequest, http.DefaultClient.Do)
+	if err != nil {
+		log.Fatalf("failed to make auth cache %v", err)
+	}
+	return func() (string, error) {
+		return tokenCache.Get(time.Now())
+	}
+}
+
+func (mgr *Manager) hubSyncLoop(keyGet keyGetter) {
 	hc := &HubConnector{
 		mgr:           mgr,
 		cfg:           mgr.cfg,
@@ -27,6 +45,7 @@ func (mgr *Manager) hubSyncLoop() {
 		leak:          mgr.checkResult.Features[host.FeatureLeak].Enabled,
 		fresh:         mgr.fresh,
 		hubReproQueue: mgr.hubReproQueue,
+		keyGet:        keyGet,
 	}
 	if mgr.cfg.Reproduce && mgr.dash != nil {
 		hc.needMoreRepros = mgr.needMoreRepros
@@ -47,6 +66,7 @@ type HubConnector struct {
 	newRepros      [][]byte
 	hubReproQueue  chan *Crash
 	needMoreRepros chan chan bool
+	keyGet         keyGetter
 }
 
 // HubManagerView restricts interface between HubConnector and Manager.
@@ -77,9 +97,13 @@ func (hc *HubConnector) loop() {
 }
 
 func (hc *HubConnector) connect(corpus [][]byte) (*rpctype.RPCClient, error) {
+	key, err := hc.keyGet()
+	if err != nil {
+		return nil, err
+	}
 	a := &rpctype.HubConnectArgs{
 		Client:  hc.cfg.HubClient,
-		Key:     hc.cfg.HubKey,
+		Key:     key,
 		Manager: hc.cfg.Name,
 		Domain:  hc.domain,
 		Fresh:   hc.fresh,
@@ -114,9 +138,13 @@ func (hc *HubConnector) connect(corpus [][]byte) (*rpctype.RPCClient, error) {
 }
 
 func (hc *HubConnector) sync(hub *rpctype.RPCClient, corpus [][]byte) error {
+	key, err := hc.keyGet()
+	if err != nil {
+		return err
+	}
 	a := &rpctype.HubSyncArgs{
 		Client:  hc.cfg.HubClient,
-		Key:     hc.cfg.HubKey,
+		Key:     key,
 		Manager: hc.cfg.Name,
 	}
 	sigs := make(map[hash.Sig]bool)
diff --git a/syz-manager/manager.go b/syz-manager/manager.go
index 47f066780..add89116e 100644
--- a/syz-manager/manager.go
+++ b/syz-manager/manager.go
@@ -1138,7 +1138,7 @@ func (mgr *Manager) candidateBatch(size int) []rpctype.RPCCandidate {
 		if mgr.phase == phaseLoadedCorpus {
 			if mgr.cfg.HubClient != "" {
 				mgr.phase = phaseTriagedCorpus
-				go mgr.hubSyncLoop()
+				go mgr.hubSyncLoop(pickGetter(mgr.cfg.HubKey))
 			} else {
 				mgr.phase = phaseTriagedHub
 			}
diff --git a/tools/syz-hubtool/hubtool.go b/tools/syz-hubtool/hubtool.go
index 491191a4c..916c7e9ab 100644
--- a/tools/syz-hubtool/hubtool.go
+++ b/tools/syz-hubtool/hubtool.go
@@ -8,9 +8,12 @@ import (
 	"flag"
 	"io/ioutil"
 	"log"
+	"net/http"
 	"path/filepath"
 	"runtime"
+	"time"
 
+	"github.com/google/syzkaller/pkg/auth"
 	"github.com/google/syzkaller/pkg/db"
 	"github.com/google/syzkaller/pkg/rpctype"
 	"github.com/google/syzkaller/prog"
@@ -55,9 +58,20 @@ func main() {
 	if err != nil {
 		log.Fatalf("failed to connect to hub: %v", err)
 	}
+	key := *flagHubKey
+	if *flagHubKey == "" {
+		tokenCache, err := auth.MakeCache(http.NewRequest, http.DefaultClient.Do)
+		if err != nil {
+			log.Fatalf("failed to make auth cache %v", err)
+		}
+		key, err = tokenCache.Get(time.Now())
+		if err != nil {
+			log.Fatalf("failed to get a token %v", err)
+		}
+	}
 	connectArgs := &rpctype.HubConnectArgs{
 		Client:  *flagHubClient,
-		Key:     *flagHubKey,
+		Key:     key,
 		Manager: *flagHubManager,
 		Fresh:   false,
 		Calls:   nil,
@@ -70,7 +84,7 @@ func main() {
 	if len(repros) != 0 {
 		syncArgs := &rpctype.HubSyncArgs{
 			Client:  *flagHubClient,
-			Key:     *flagHubKey,
+			Key:     key,
 			Manager: *flagHubManager,
 			Repros:  repros,
 		}
@@ -82,7 +96,7 @@ func main() {
 	for *flagDrain {
 		syncArgs := &rpctype.HubSyncArgs{
 			Client:     *flagHubClient,
-			Key:        *flagHubKey,
+			Key:        key,
 			Manager:    *flagHubManager,
 			NeedRepros: true,
 		}