|
| 1 | +module Moped |
| 2 | + module Protocol |
| 3 | + module Commands |
| 4 | + class ScramAuthenticate |
| 5 | + SCRAM_SHA_1_MECHANISM = 'SCRAM-SHA-1'.freeze |
| 6 | + CLIENT_CONTINUE_MESSAGE = { saslContinue: 1 }.freeze |
| 7 | + CLIENT_FIRST_MESSAGE = { saslStart: 1, autoAuthorize: 1 }.freeze |
| 8 | + CLIENT_KEY = 'Client Key'.freeze |
| 9 | + ID = 'conversationId'.freeze |
| 10 | + ITERATIONS = /i=(\d+)/.freeze |
| 11 | + MIN_ITER_COUNT = 4096 |
| 12 | + PAYLOAD = 'payload'.freeze |
| 13 | + RNONCE = /r=([^,]*)/.freeze |
| 14 | + SALT = /s=([^,]*)/.freeze |
| 15 | + SERVER_KEY = 'Server Key'.freeze |
| 16 | + VERIFIER = /v=([^,]*)/.freeze |
| 17 | + |
| 18 | + attr_reader \ |
| 19 | + :database, |
| 20 | + :username, |
| 21 | + :password, |
| 22 | + :nonce, |
| 23 | + :result |
| 24 | + |
| 25 | + def initialize(database, username, password) |
| 26 | + @database = database |
| 27 | + @username = username |
| 28 | + @password = password |
| 29 | + end |
| 30 | + |
| 31 | + def start(result) |
| 32 | + @nonce = result[Protocol::NONCE] |
| 33 | + Protocol::Command.new(database, { |
| 34 | + saslStart: 1, |
| 35 | + autoAuthorize: 1, |
| 36 | + payload: client_first_message, |
| 37 | + mechanism: SCRAM_SHA_1_MECHANISM |
| 38 | + }) |
| 39 | + end |
| 40 | + |
| 41 | + def continue(result) |
| 42 | + validate_first_message!(result) |
| 43 | + salted_password |
| 44 | + |
| 45 | + Protocol::Command.new(database, { |
| 46 | + saslContinue: 1, |
| 47 | + payload: client_final_message, |
| 48 | + conversationId: result[ID] |
| 49 | + }) |
| 50 | + end |
| 51 | + |
| 52 | + def finalize(result) |
| 53 | + Protocol::Command.new( |
| 54 | + database, |
| 55 | + CLIENT_CONTINUE_MESSAGE.merge( |
| 56 | + payload: client_empty_message, |
| 57 | + conversationId: result[ID] |
| 58 | + ) |
| 59 | + ) |
| 60 | + end |
| 61 | + |
| 62 | + private |
| 63 | + |
| 64 | + def client_empty_message |
| 65 | + BSON::Binary.new(:md5, '') |
| 66 | + end |
| 67 | + |
| 68 | + def hmac(data, key) |
| 69 | + OpenSSL::HMAC.digest(digest, data, key) |
| 70 | + end |
| 71 | + |
| 72 | + def xor(first, second) |
| 73 | + first.bytes.zip(second.bytes).map{ |(a,b)| (a ^ b).chr }.join('') |
| 74 | + end |
| 75 | + |
| 76 | + def validate_first_message!(result) |
| 77 | + validate!(result) |
| 78 | + raise Errors::InvalidNonce.new(nonce, rnonce) unless rnonce.start_with?(nonce) |
| 79 | + end |
| 80 | + |
| 81 | + def client_key |
| 82 | + @client_key ||= hmac(salted_password, CLIENT_KEY) |
| 83 | + end |
| 84 | + |
| 85 | + def client_proof(key, signature) |
| 86 | + @client_proof ||= Base64.strict_encode64(xor(key, signature)) |
| 87 | + end |
| 88 | + |
| 89 | + def client_final |
| 90 | + @client_final ||= client_proof(client_key, client_signature(stored_key(client_key), auth_message)) |
| 91 | + end |
| 92 | + |
| 93 | + def auth_message |
| 94 | + @auth_message ||= "#{first_bare},#{result[PAYLOAD].data},#{without_proof}" |
| 95 | + end |
| 96 | + |
| 97 | + def stored_key(key) |
| 98 | + h(key) |
| 99 | + end |
| 100 | + |
| 101 | + def h(string) |
| 102 | + digest.digest(string) |
| 103 | + end |
| 104 | + |
| 105 | + def client_signature(key, message) |
| 106 | + @client_signature ||= hmac(key, message) |
| 107 | + end |
| 108 | + |
| 109 | + def without_proof |
| 110 | + @without_proof ||= "c=biws,r=#{rnonce}" |
| 111 | + end |
| 112 | + |
| 113 | + def client_final_message |
| 114 | + BSON::Binary.new(:md5, "#{without_proof},p=#{client_final}") |
| 115 | + end |
| 116 | + |
| 117 | + def rnonce |
| 118 | + @rnonce ||= payload_data.match(RNONCE)[1] |
| 119 | + end |
| 120 | + |
| 121 | + def validate!(result) |
| 122 | + if result[Protocol::OK] != 1 |
| 123 | + raise Errors::AuthenticationFailure.new( |
| 124 | + 'scram.start', |
| 125 | + { "err" => "Invalid result ok = #{result[Protocol::OK]}" } |
| 126 | + ) |
| 127 | + end |
| 128 | + @result = result |
| 129 | + end |
| 130 | + |
| 131 | + def payload_data |
| 132 | + result[PAYLOAD].data |
| 133 | + end |
| 134 | + |
| 135 | + def iterations |
| 136 | + @iterations ||= payload_data.match(ITERATIONS)[1].to_i.tap do |i| |
| 137 | + if i < MIN_ITER_COUNT |
| 138 | + raise Errors::InsufficientIterationCount.new( |
| 139 | + Errors::InsufficientIterationCount.message(MIN_ITER_COUNT, i)) |
| 140 | + end |
| 141 | + end |
| 142 | + end |
| 143 | + |
| 144 | + def hi(data) |
| 145 | + OpenSSL::PKCS5.pbkdf2_hmac_sha1( |
| 146 | + data, |
| 147 | + Base64.strict_decode64(salt), |
| 148 | + iterations, |
| 149 | + digest.size |
| 150 | + ) |
| 151 | + end |
| 152 | + |
| 153 | + def salt |
| 154 | + @salt ||= payload_data.match(SALT)[1] |
| 155 | + end |
| 156 | + |
| 157 | + def digest |
| 158 | + @digest ||= OpenSSL::Digest::SHA1.new.freeze |
| 159 | + end |
| 160 | + |
| 161 | + def salted_password |
| 162 | + hi(hashed_password) |
| 163 | + end |
| 164 | + |
| 165 | + def hashed_password |
| 166 | + unless password |
| 167 | + raise Errors::MissingPassword |
| 168 | + end |
| 169 | + @hashed_password ||= Digest::MD5.hexdigest("#{username}:mongo:#{password}").encode('utf-8') |
| 170 | + end |
| 171 | + |
| 172 | + def client_first_message |
| 173 | + BSON::Binary.new(:md5, "n,,#{first_bare}") |
| 174 | + end |
| 175 | + |
| 176 | + def first_bare |
| 177 | + @first_bare ||= "n=#{username.encode('utf-8').gsub('=','=3D').gsub(',','=2C')},r=#{nonce}" |
| 178 | + end |
| 179 | + end |
| 180 | + end |
| 181 | + end |
| 182 | +end |
0 commit comments