mirror of https://gitlab.com/famedly/conduit
Merge pull request 'Uiaa + Close registration + optimizations' (#113) from uiaa into master
Timo Kösters
4 years ago
commit
c681f0c494
@ -1,11 +1,13 @@
|
||||
[global]
|
||||
server_name = "your.server.name"
|
||||
port = 8448
|
||||
address = "0.0.0.0"
|
||||
#registration_disabled = true
|
||||
|
||||
# Default path is in this user's data
|
||||
#database_path = "/home/timo/MyConduitServer"
|
||||
|
||||
port = 14004
|
||||
address = "0.0.0.0"
|
||||
|
||||
#[global.tls]
|
||||
#certs = "/etc/letsencrypt/live/your.server.name/fullchain.pem"
|
||||
#key = "/etc/letsencrypt/live/your.server.name/privkey.pem"
|
||||
|
||||
@ -0,0 +1,161 @@
|
||||
use crate::{utils, Error, Result};
|
||||
use js_int::UInt;
|
||||
use log::debug;
|
||||
use ruma::{
|
||||
api::client::{
|
||||
error::ErrorKind,
|
||||
r0::{
|
||||
device::Device,
|
||||
keys::{AlgorithmAndDeviceId, DeviceKeys, KeyAlgorithm, OneTimeKey},
|
||||
uiaa::{AuthData, AuthFlow, UiaaInfo, UiaaResponse},
|
||||
},
|
||||
},
|
||||
events::{to_device::AnyToDeviceEvent, EventJson, EventType},
|
||||
identifiers::UserId,
|
||||
};
|
||||
use serde_json::value::RawValue;
|
||||
use std::{collections::BTreeMap, convert::TryFrom, time::SystemTime};
|
||||
|
||||
pub struct Uiaa {
|
||||
pub(super) userdeviceid_uiaainfo: sled::Tree, // User-interactive authentication
|
||||
}
|
||||
|
||||
impl Uiaa {
|
||||
/// Creates a new Uiaa session. Make sure the session token is unique.
|
||||
pub fn create(&self, user_id: &UserId, device_id: &str, uiaainfo: &UiaaInfo) -> Result<()> {
|
||||
self.update_uiaa_session(user_id, device_id, Some(uiaainfo))
|
||||
}
|
||||
|
||||
pub fn try_auth(
|
||||
&self,
|
||||
user_id: &UserId,
|
||||
device_id: &str,
|
||||
auth: &AuthData,
|
||||
uiaainfo: &UiaaInfo,
|
||||
users: &super::users::Users,
|
||||
globals: &super::globals::Globals,
|
||||
) -> Result<(bool, UiaaInfo)> {
|
||||
if let AuthData::DirectRequest {
|
||||
kind,
|
||||
session,
|
||||
auth_parameters,
|
||||
} = &auth
|
||||
{
|
||||
let mut uiaainfo = session
|
||||
.as_ref()
|
||||
.map(|session| {
|
||||
Ok::<_, Error>(self.get_uiaa_session(&user_id, &"".to_owned(), session)?)
|
||||
})
|
||||
.unwrap_or(Ok(uiaainfo.clone()))?;
|
||||
|
||||
// Find out what the user completed
|
||||
match &**kind {
|
||||
"m.login.password" => {
|
||||
if auth_parameters["identifier"]["type"] != "m.id.user" {
|
||||
panic!("identifier not supported");
|
||||
}
|
||||
|
||||
let user_id = UserId::parse_with_server_name(
|
||||
auth_parameters["identifier"]["user"].as_str().unwrap(),
|
||||
globals.server_name(),
|
||||
)?;
|
||||
let password = auth_parameters["password"].as_str().unwrap();
|
||||
|
||||
// Check if password is correct
|
||||
if let Some(hash) = users.password_hash(&user_id)? {
|
||||
let hash_matches =
|
||||
argon2::verify_encoded(&hash, password.as_bytes()).unwrap_or(false);
|
||||
|
||||
if !hash_matches {
|
||||
debug!("Invalid password.");
|
||||
uiaainfo.auth_error = Some(ruma::api::client::error::ErrorBody {
|
||||
kind: ErrorKind::Forbidden,
|
||||
message: "Invalid username or password.".to_owned(),
|
||||
});
|
||||
return Ok((false, uiaainfo));
|
||||
}
|
||||
}
|
||||
|
||||
// Password was correct! Let's add it to `completed`
|
||||
uiaainfo.completed.push("m.login.password".to_owned());
|
||||
}
|
||||
"m.login.dummy" => {
|
||||
uiaainfo.completed.push("m.login.dummy".to_owned());
|
||||
}
|
||||
k => panic!("type not supported: {}", k),
|
||||
}
|
||||
|
||||
// Check if a flow now succeeds
|
||||
let mut completed = false;
|
||||
'flows: for flow in &mut uiaainfo.flows {
|
||||
for stage in &flow.stages {
|
||||
if !uiaainfo.completed.contains(stage) {
|
||||
continue 'flows;
|
||||
}
|
||||
}
|
||||
// We didn't break, so this flow succeeded!
|
||||
completed = true;
|
||||
}
|
||||
|
||||
if !completed {
|
||||
self.update_uiaa_session(user_id, device_id, Some(&uiaainfo))?;
|
||||
return Ok((false, uiaainfo));
|
||||
}
|
||||
|
||||
// UIAA was successful! Remove this session and return true
|
||||
self.update_uiaa_session(user_id, device_id, None)?;
|
||||
return Ok((true, uiaainfo));
|
||||
} else {
|
||||
panic!("FallbackAcknowledgement is not supported yet");
|
||||
}
|
||||
}
|
||||
|
||||
fn update_uiaa_session(
|
||||
&self,
|
||||
user_id: &UserId,
|
||||
device_id: &str,
|
||||
uiaainfo: Option<&UiaaInfo>,
|
||||
) -> Result<()> {
|
||||
let mut userdeviceid = user_id.to_string().as_bytes().to_vec();
|
||||
userdeviceid.push(0xff);
|
||||
userdeviceid.extend_from_slice(device_id.as_bytes());
|
||||
|
||||
if let Some(uiaainfo) = uiaainfo {
|
||||
self.userdeviceid_uiaainfo
|
||||
.insert(&userdeviceid, &*serde_json::to_string(&uiaainfo)?)?;
|
||||
} else {
|
||||
self.userdeviceid_uiaainfo.remove(&userdeviceid)?;
|
||||
}
|
||||
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn get_uiaa_session(
|
||||
&self,
|
||||
user_id: &UserId,
|
||||
device_id: &str,
|
||||
session: &str,
|
||||
) -> Result<UiaaInfo> {
|
||||
let mut userdeviceid = user_id.to_string().as_bytes().to_vec();
|
||||
userdeviceid.push(0xff);
|
||||
userdeviceid.extend_from_slice(device_id.as_bytes());
|
||||
|
||||
let uiaainfo = serde_json::from_slice::<UiaaInfo>(
|
||||
&self
|
||||
.userdeviceid_uiaainfo
|
||||
.get(&userdeviceid)?
|
||||
.ok_or(Error::BadRequest("session does not exist"))?,
|
||||
)?;
|
||||
|
||||
if uiaainfo
|
||||
.session
|
||||
.as_ref()
|
||||
.filter(|&s| s == session)
|
||||
.is_none()
|
||||
{
|
||||
return Err(Error::BadRequest("wrong session token"));
|
||||
}
|
||||
|
||||
Ok(uiaainfo)
|
||||
}
|
||||
}
|
||||
Loading…
Reference in New Issue