util/sasl/scram.lua

   1 -- sasl.lua v0.4
   2 -- Copyright (C) 2008-2010 Tobias Markmann
   3 --
   4 --        All rights reserved.
   5 --
   6 --        Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
   7 --
   8 --                * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
   9 --                * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  10 --                * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
  11 --
  12 --        THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  13
  14 local s_match = string.match;
  15 local type = type
  16 local string = string
  17 local base64 = require "util.encodings".base64;
  18 local hmac_sha1 = require "util.hmac".sha1;
  19 local sha1 = require "util.hashes".sha1;
  20 local generate_uuid = require "util.uuid".generate;
  21 local saslprep = require "util.encodings".stringprep.saslprep;
  22 local log = require "util.logger".init("sasl");
  23 local t_concat = table.concat;
  24 local char = string.char;
  25 local byte = string.byte;
  26
  27 module "scram"
  28
  29 --=========================
  30 --SASL SCRAM-SHA-1 according to draft-ietf-sasl-scram-10
  31
  32 --[[
  33 Supported Authentication Backends
  34
  35 scram-{MECH}:
  36         function(username, realm)
  37                 return salted_password, iteration_count, salt, state;
  38         end
  39 ]]
  40
  41 local default_i = 4096
  42
  43 local function bp( b )
  44         local result = ""
  45         for i=1, b:len() do
  46                 result = result.."\\"..b:byte(i)
  47         end
  48         return result
  49 end
  50
  51 local xor_map = {0;1;2;3;4;5;6;7;8;9;10;11;12;13;14;15;1;0;3;2;5;4;7;6;9;8;11;10;13;12;15;14;2;3;0;1;6;7;4;5;10;11;8;9;14;15;12;13;3;2;1;0;7;6;5;4;11;10;9;8;15;14;13;12;4;5;6;7;0;1;2;3;12;13;14;15;8;9;10;11;5;4;7;6;1;0;3;2;13;12;15;14;9;8;11;10;6;7;4;5;2;3;0;1;14;15;12;13;10;11;8;9;7;6;5;4;3;2;1;0;15;14;13;12;11;10;9;8;8;9;10;11;12;13;14;15;0;1;2;3;4;5;6;7;9;8;11;10;13;12;15;14;1;0;3;2;5;4;7;6;10;11;8;9;14;15;12;13;2;3;0;1;6;7;4;5;11;10;9;8;15;14;13;12;3;2;1;0;7;6;5;4;12;13;14;15;8;9;10;11;4;5;6;7;0;1;2;3;13;12;15;14;9;8;11;10;5;4;7;6;1;0;3;2;14;15;12;13;10;11;8;9;6;7;4;5;2;3;0;1;15;14;13;12;11;10;9;8;7;6;5;4;3;2;1;0;};
  52
  53 local result = {};
  54 local function binaryXOR( a, b )
  55         for i=1, #a do
  56                 local x, y = byte(a, i), byte(b, i);
  57                 local lowx, lowy = x % 16, y % 16;
  58                 local hix, hiy = (x - lowx) / 16, (y - lowy) / 16;
  59                 local lowr, hir = xor_map[lowx * 16 + lowy + 1], xor_map[hix * 16 + hiy + 1];
  60                 local r = hir * 16 + lowr;
  61                 result[i] = char(r)
  62         end
  63         return t_concat(result);
  64 end
  65
  66 -- hash algorithm independent Hi(PBKDF2) implementation
  67 local function Hi(hmac, str, salt, i)
  68         local Ust = hmac(str, salt.."\0\0\0\1");
  69         local res = Ust;
  70         for n=1,i-1 do
  71                 local Und = hmac(str, Ust)
  72                 res = binaryXOR(res, Und)
  73                 Ust = Und
  74         end
  75         return res
  76 end
  77
  78 local function validate_username(username)
  79         -- check for forbidden char sequences
  80         for eq in username:gmatch("=(.?.?)") do
  81                 if eq ~= "2D" and eq ~= "3D" then
  82                         return false
  83                 end
  84         end
  85
  86         -- replace =2D with , and =3D with =
  87         username = username:gsub("=2D", ",");
  88         username = username:gsub("=3D", "=");
  89
  90         -- apply SASLprep
  91         username = saslprep(username);
  92         return username;
  93 end
  94
  95 function saltedPasswordSHA1(password, salt, iteration_count)
  96         local salted_password
  97         if type(password) ~= "string" and type(salt) ~= "string" and type(iteration_count) ~= "number" then
  98                 return false, "inappropriate argument types"
  99         end
 100         if iteration_count < 4096 then
 101                 log("warning", "Iteration count < 4096 which is the suggested minimum according to RFC 5802.")
 102         end
 103
 104         return true, Hi(hmac_sha1, password, salt, iteration_count);
 105 end
 106
 107 local function scram_gen(hash_name, H_f, HMAC_f)
 108         local function scram_hash(self, message)
 109                 if not self.state then self["state"] = {} end
 110
 111                 if type(message) ~= "string" or #message == 0 then return "failure", "malformed-request" end
 112                 if not self.state.name then
 113                         -- we are processing client_first_message
 114                         local client_first_message = message;
 115
 116                         -- TODO: fail if authzid is provided, since we don't support them yet
 117                         self.state["client_first_message"] = client_first_message;
 118                         self.state["gs2_cbind_flag"], self.state["authzid"], self.state["name"], self.state["clientnonce"]
 119                                 = client_first_message:match("^(%a),(.*),n=(.*),r=([^,]*).*");
 120
 121                         -- we don't do any channel binding yet
 122                         if self.state.gs2_cbind_flag ~= "n" and self.state.gs2_cbind_flag ~= "y" then
 123                                 return "failure", "malformed-request";
 124                         end
 125
 126                         if not self.state.name or not self.state.clientnonce then
 127                                 return "failure", "malformed-request", "Channel binding isn't support at this time.";
 128                         end
 129
 130                         self.state.name = validate_username(self.state.name);
 131                         if not self.state.name then
 132                                 log("debug", "Username violates either SASLprep or contains forbidden character sequences.")
 133                                 return "failure", "malformed-request", "Invalid username.";
 134                         end
 135
 136                         self.state["servernonce"] = generate_uuid();
 137
 138                         -- retreive credentials
 139                         if self.profile.plain then
 140                                 local password, state = self.profile.plain(self.state.name, self.realm)
 141                                 if state == nil then return "failure", "not-authorized"
 142                                 elseif state == false then return "failure", "account-disabled" end
 143
 144                                 password = saslprep(password);
 145                                 if not password then
 146                                         log("debug", "Password violates SASLprep.");
 147                                         return "failure", "not-authorized", "Invalid password."
 148                                 end
 149
 150                                 self.state.salt = generate_uuid();
 151                                 self.state.iteration_count = default_i;
 152
 153                                 local succ = false;
 154                                 succ, self.state.salted_password = saltedPasswordSHA1(password, self.state.salt, default_i, self.state.iteration_count);
 155                                 if not succ then
 156                                         log("error", "Generating salted password failed. Reason: %s", self.state.salted_password);
 157                                         return "failure", "temporary-auth-failure";
 158                                 end
 159                         elseif self.profile["scram_"..hash_name] then
 160                                 local salted_password, iteration_count, salt, state = self.profile["scram-"..hash_name](self.state.name, self.realm);
 161                                 if state == nil then return "failure", "not-authorized"
 162                                 elseif state == false then return "failure", "account-disabled" end
 163
 164                                 self.state.salted_password = salted_password;
 165                                 self.state.iteration_count = iteration_count;
 166                                 self.state.salt = salt
 167                         end
 168
 169                         local server_first_message = "r="..self.state.clientnonce..self.state.servernonce..",s="..base64.encode(self.state.salt)..",i="..self.state.iteration_count;
 170                         self.state["server_first_message"] = server_first_message;
 171                         return "challenge", server_first_message
 172                 else
 173                         -- we are processing client_final_message
 174                         local client_final_message = message;
 175
 176                         self.state["channelbinding"], self.state["nonce"], self.state["proof"] = client_final_message:match("^c=(.*),r=(.*),.*p=(.*)");
 177
 178                         if not self.state.proof or not self.state.nonce or not self.state.channelbinding then
 179                                 return "failure", "malformed-request", "Missing an attribute(p, r or c) in SASL message.";
 180                         end
 181
 182                         if self.state.nonce ~= self.state.clientnonce..self.state.servernonce then
 183                                 return "failure", "malformed-request", "Wrong nonce in client-final-message.";
 184                         end
 185
 186                         local SaltedPassword = self.state.salted_password;
 187                         local ClientKey = HMAC_f(SaltedPassword, "Client Key")
 188                         local ServerKey = HMAC_f(SaltedPassword, "Server Key")
 189                         local StoredKey = H_f(ClientKey)
 190                         local AuthMessage = "n=" .. s_match(self.state.client_first_message,"n=(.+)") .. "," .. self.state.server_first_message .. "," .. s_match(client_final_message, "(.+),p=.+")
 191                         local ClientSignature = HMAC_f(StoredKey, AuthMessage)
 192                         local ClientProof     = binaryXOR(ClientKey, ClientSignature)
 193                         local ServerSignature = HMAC_f(ServerKey, AuthMessage)
 194
 195                         if base64.encode(ClientProof) == self.state.proof then
 196                                 local server_final_message = "v="..base64.encode(ServerSignature);
 197                                 self["username"] = self.state.name;
 198                                 return "success", server_final_message;
 199                         else
 200                                 return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated.";
 201                         end
 202                 end
 203         end
 204         return scram_hash;
 205 end
 206
 207 function init(registerMechanism)
 208         local function registerSCRAMMechanism(hash_name, hash, hmac_hash)
 209                 registerMechanism("SCRAM-"..hash_name, {"plain", "scram_"..(hash_name:lower())}, scram_gen(hash_name:lower(), hash, hmac_hash));
 210         end
 211
 212         registerSCRAMMechanism("SHA-1", sha1, hmac_sha1);
 213 end
 214
 215 return _M;