|
| 1 | +package auth |
| 2 | + |
| 3 | +import ( |
| 4 | + "crypto/sha256" |
| 5 | + "crypto/subtle" |
| 6 | + "encoding/hex" |
| 7 | + "encoding/json" |
| 8 | + "fmt" |
| 9 | + "net/http" |
| 10 | + "strings" |
| 11 | + |
| 12 | + "github.com/git-ecosystem/git-bundle-server/pkg/auth" |
| 13 | +) |
| 14 | + |
| 15 | +/* Built-in auth modes */ |
| 16 | +// Authorize users with credentials matching a static username/password pair |
| 17 | +// that applies to the whole server. |
| 18 | +type fixedCredentialAuth struct { |
| 19 | + usernameHash [32]byte |
| 20 | + passwordHash [32]byte |
| 21 | +} |
| 22 | + |
| 23 | +type fixedCredentialAuthParams struct { |
| 24 | + Username string `json:"username"` |
| 25 | + PasswordHash string `json:"passwordHash"` |
| 26 | +} |
| 27 | + |
| 28 | +func NewFixedCredentialAuth(rawParameters json.RawMessage) (auth.AuthMiddleware, error) { |
| 29 | + if len(rawParameters) == 0 { |
| 30 | + return nil, fmt.Errorf("parameters JSON must exist") |
| 31 | + } |
| 32 | + |
| 33 | + var params fixedCredentialAuthParams |
| 34 | + err := json.Unmarshal(rawParameters, ¶ms) |
| 35 | + if err != nil { |
| 36 | + return nil, err |
| 37 | + } |
| 38 | + |
| 39 | + // Check for invalid username characters |
| 40 | + if strings.Contains(params.Username, ":") { |
| 41 | + return nil, fmt.Errorf("username contains a colon (\":\")") |
| 42 | + } |
| 43 | + |
| 44 | + // Make sure password hash is a valid hash |
| 45 | + passwordHashBytes, err := hex.DecodeString(params.PasswordHash) |
| 46 | + if err != nil { |
| 47 | + return nil, fmt.Errorf("passwordHash is invalid: %w", err) |
| 48 | + } else if len(passwordHashBytes) != 32 { |
| 49 | + return nil, fmt.Errorf("passwordHash is incorrect length (%d vs. expected 32)", len(passwordHashBytes)) |
| 50 | + } |
| 51 | + |
| 52 | + return &fixedCredentialAuth{ |
| 53 | + usernameHash: sha256.Sum256([]byte(params.Username)), |
| 54 | + passwordHash: [32]byte(passwordHashBytes), |
| 55 | + }, nil |
| 56 | +} |
| 57 | + |
| 58 | +func (a *fixedCredentialAuth) Authorize(r *http.Request, _ string, _ string) auth.AuthResult { |
| 59 | + username, password, ok := r.BasicAuth() |
| 60 | + if ok { |
| 61 | + usernameHash := sha256.Sum256([]byte(username)) |
| 62 | + passwordHash := sha256.Sum256([]byte(password)) |
| 63 | + |
| 64 | + usernameMatch := (subtle.ConstantTimeCompare(usernameHash[:], a.usernameHash[:]) == 1) |
| 65 | + passwordMatch := (subtle.ConstantTimeCompare(passwordHash[:], a.passwordHash[:]) == 1) |
| 66 | + |
| 67 | + if usernameMatch && passwordMatch { |
| 68 | + return auth.Allow() |
| 69 | + } else { |
| 70 | + // Return a 404 status even though the issue is that the user is |
| 71 | + // forbidden so we don't indirectly reveal which repositories are |
| 72 | + // configured in the bundle server. |
| 73 | + return auth.Deny(404) |
| 74 | + } |
| 75 | + } |
| 76 | + |
| 77 | + return auth.Deny(401, auth.Header{Key: "WWW-Authenticate", Value: `Basic realm="restricted", charset="UTF-8"`}) |
| 78 | +} |
0 commit comments