Repository navigation
Expand file tree
/
Copy pathauth.cpp
More file actions
255 lines (210 loc) · 7.66 KB
/
Copy pathauth.cpp
File metadata and controls
255 lines (210 loc) · 7.66 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
/**
* Authentication utilities implementation
*/
#include "auth.h"
#include "config.h"
#include "lang.h"
#include "user_store.h"
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <fstream>
#include <sstream>
#include <iomanip>
#include <filesystem>
#include <random>
#include <cstdio>
#include <cstring>
#include <chrono>
#include <pwd.h>
#include <sys/stat.h>
#include <unistd.h>
#include <format>
namespace ragger {
namespace fs = std::filesystem;
// Base64url encoding (RFC 4648 section 5)
static std::string base64url_encode(const unsigned char* data, size_t len) {
static const char* base64_chars =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
std::string result;
result.reserve((len * 4 / 3) + 3);
for (size_t i = 0; i < len; ) {
uint32_t octet_a = i < len ? data[i++] : 0;
uint32_t octet_b = i < len ? data[i++] : 0;
uint32_t octet_c = i < len ? data[i++] : 0;
uint32_t triple = (octet_a << 16) + (octet_b << 8) + octet_c;
result.push_back(base64_chars[(triple >> 18) & 0x3F]);
result.push_back(base64_chars[(triple >> 12) & 0x3F]);
result.push_back(base64_chars[(triple >> 6) & 0x3F]);
result.push_back(base64_chars[triple & 0x3F]);
}
// Remove padding (base64url doesn't use padding)
size_t padding = (3 - (len % 3)) % 3;
if (padding > 0) {
result.resize(result.size() - padding);
}
return result;
}
std::string hash_token(const std::string& token) {
unsigned char hash[SHA256_DIGEST_LENGTH];
SHA256(reinterpret_cast<const unsigned char*>(token.c_str()),
token.size(), hash);
// Convert to hex string
std::ostringstream oss;
for (int i = 0; i < SHA256_DIGEST_LENGTH; ++i) {
oss << std::hex << std::setw(2) << std::setfill('0')
<< static_cast<int>(hash[i]);
}
return oss.str();
}
std::string token_path() {
return config().resolved_token_path();
}
std::string load_token() {
std::string path = token_path();
std::ifstream f(path);
if (!f.is_open()) return "";
std::string token;
std::getline(f, token);
// Trim whitespace
size_t start = token.find_first_not_of(" \t\r\n");
size_t end = token.find_last_not_of(" \t\r\n");
if (start == std::string::npos) return "";
return token.substr(start, end - start + 1);
}
std::string generate_token() {
unsigned char random_bytes[32];
// Read from /dev/urandom
FILE* f = fopen("/dev/urandom", "rb");
if (!f) {
throw std::runtime_error(lang::ERR_URANDOM_OPEN);
}
size_t read_count = fread(random_bytes, 1, 32, f);
fclose(f);
if (read_count != 32) {
throw std::runtime_error(lang::ERR_URANDOM_READ);
}
return base64url_encode(random_bytes, 32);
}
std::string ensure_token() {
std::string path = token_path();
// Check if token file exists
if (fs::exists(path)) {
std::string token = load_token();
if (!token.empty()) return token;
}
// Create parent directory
fs::create_directories(fs::path(path).parent_path());
// Generate new token
std::string token = generate_token();
// Write to file
std::ofstream f(path);
if (!f.is_open()) {
throw std::runtime_error(std::format(lang::ERR_TOKEN_WRITE, path));
}
f << token << std::endl;
f.close();
// Set permissions to 0640 (owner read/write + group read)
// Group read allows the daemon (_ragger) to read user tokens
chmod(path.c_str(), 0640);
return token;
}
// NOTE: The old time-seeded token rotation system (server.secret +
// token_for_minute + 24h verify window) has been removed. Tokens are now
// plain random values: generate_token() → hash_token() → stored in DB.
// The framework (users.token_hash, issue_token, verify_token) is kept for the
// planned labeled-token system (see GitHub issue: "Labeled API tokens").
// PBKDF2 password hashing
static const int PBKDF2_ITERATIONS = 600000;
static const int PBKDF2_SALT_LEN = 16;
static const int PBKDF2_KEY_LEN = 32;
static std::string bytes_to_hex(const unsigned char* data, size_t len) {
std::ostringstream oss;
for (size_t i = 0; i < len; ++i) {
oss << std::hex << std::setw(2) << std::setfill('0')
<< static_cast<int>(data[i]);
}
return oss.str();
}
static std::vector<unsigned char> hex_to_bytes(const std::string& hex) {
std::vector<unsigned char> bytes;
for (size_t i = 0; i + 1 < hex.size(); i += 2) {
unsigned int byte;
std::sscanf(hex.c_str() + i, "%02x", &byte);
bytes.push_back(static_cast<unsigned char>(byte));
}
return bytes;
}
std::string generate_random_token(int bytes) {
std::vector<unsigned char> buf(bytes);
if (RAND_bytes(buf.data(), bytes) != 1) {
throw std::runtime_error(lang::ERR_RANDOM_BYTES);
}
// URL-safe base64-like: hex encoding (simple, always works)
return bytes_to_hex(buf.data(), bytes);
}
std::string hash_password(const std::string& password) {
unsigned char salt[PBKDF2_SALT_LEN];
if (RAND_bytes(salt, PBKDF2_SALT_LEN) != 1) {
throw std::runtime_error(lang::ERR_RANDOM_SALT);
}
unsigned char key[PBKDF2_KEY_LEN];
if (PKCS5_PBKDF2_HMAC(
password.c_str(), static_cast<int>(password.size()),
salt, PBKDF2_SALT_LEN,
PBKDF2_ITERATIONS,
EVP_sha256(),
PBKDF2_KEY_LEN, key) != 1) {
throw std::runtime_error(lang::ERR_PBKDF2);
}
// Format: pbkdf2:iterations:salt_hex:key_hex
return "pbkdf2:" + std::to_string(PBKDF2_ITERATIONS) + ":"
+ bytes_to_hex(salt, PBKDF2_SALT_LEN) + ":"
+ bytes_to_hex(key, PBKDF2_KEY_LEN);
}
bool verify_password(const std::string& password, const std::string& stored_hash) {
// Parse "pbkdf2:iterations:salt_hex:key_hex"
if (stored_hash.substr(0, 7) != "pbkdf2:") return false;
size_t pos1 = 7;
size_t pos2 = stored_hash.find(':', pos1);
if (pos2 == std::string::npos) return false;
size_t pos3 = stored_hash.find(':', pos2 + 1);
if (pos3 == std::string::npos) return false;
int iterations = std::stoi(stored_hash.substr(pos1, pos2 - pos1));
auto salt = hex_to_bytes(stored_hash.substr(pos2 + 1, pos3 - pos2 - 1));
auto expected_key = hex_to_bytes(stored_hash.substr(pos3 + 1));
unsigned char key[PBKDF2_KEY_LEN];
if (PKCS5_PBKDF2_HMAC(
password.c_str(), static_cast<int>(password.size()),
salt.data(), static_cast<int>(salt.size()),
iterations,
EVP_sha256(),
PBKDF2_KEY_LEN, key) != 1) {
return false;
}
// Constant-time comparison
return CRYPTO_memcmp(key, expected_key.data(),
std::min(static_cast<size_t>(PBKDF2_KEY_LEN), expected_key.size())) == 0;
}
// --- DB-backed API ---
void userdel(UserStore& db, const std::string& user) {
db.delete_user(user);
}
bool verify_password(UserStore& db, const std::string& user, const std::string& pw) {
auto stored = db.get_user_password(user);
if (!stored || stored->empty()) return false;
return verify_password(pw, *stored);
}
std::string issue_token(UserStore& db, const std::string& user) {
std::string token = generate_token();
std::string token_hash = hash_token(token);
db.update_user_token(user, token_hash);
return token;
}
AuthResult verify_token(UserStore& db, const std::string& token) {
std::string token_hash = hash_token(token);
auto user_info = db.get_user_by_token_hash(token_hash);
if (!user_info) return {};
return {true, user_info->username};
}
} // namespace ragger