Merge branch 'master' of https://github.com/emqx/emqx into merge-4.3-to-5.0
This commit is contained in:
zhanghongtong
commit
d6e531bd8f
|
|
@ -1,26 +0,0 @@
|
||||||
.eunit
|
|
||||||
deps
|
|
||||||
*.o
|
|
||||||
*.beam
|
|
||||||
*.plt
|
|
||||||
erl_crash.dump
|
|
||||||
ebin
|
|
||||||
rel/example_project
|
|
||||||
.concrete/DEV_MODE
|
|
||||||
.rebar
|
|
||||||
data/
|
|
||||||
*.swp
|
|
||||||
*.swo
|
|
||||||
.erlang.mk/
|
|
||||||
emqx_sasl.d
|
|
||||||
erlang.mk
|
|
||||||
rebar3.crashdump
|
|
||||||
_build
|
|
||||||
cover/
|
|
||||||
ct.coverdata
|
|
||||||
eunit.coverdata
|
|
||||||
logs/
|
|
||||||
rebar.lock
|
|
||||||
test/ct.cover.spec
|
|
||||||
etc/emqx_sasl.conf.rendered
|
|
||||||
.rebar3/
|
|
||||||
|
|
@ -1,2 +0,0 @@
|
||||||
# emqx-sasl
|
|
||||||
Simple Authentication and Security Layer
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-define(APP, emqx_sasl).
|
|
||||||
|
|
||||||
-define(SCRAM_AUTH_TAB, scram_auth).
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
{deps,
|
|
||||||
[{pbkdf2, {git, "https://github.com/emqx/erlang-pbkdf2.git", {branch, "2.0.4"}}}
|
|
||||||
]}.
|
|
||||||
|
|
||||||
{edoc_opts, [{preprocess, true}]}.
|
|
||||||
{erl_opts, [warn_unused_vars,
|
|
||||||
warn_shadow_vars,
|
|
||||||
warnings_as_errors,
|
|
||||||
warn_unused_import,
|
|
||||||
warn_obsolete_guard,
|
|
||||||
debug_info,
|
|
||||||
{parse_transform}]}.
|
|
||||||
|
|
||||||
{xref_checks, [undefined_function_calls, undefined_functions,
|
|
||||||
locals_not_used, deprecated_function_calls,
|
|
||||||
warnings_as_errors, deprecated_functions]}.
|
|
||||||
{cover_enabled, true}.
|
|
||||||
{cover_opts, [verbose]}.
|
|
||||||
{cover_export_enabled, true}.
|
|
||||||
|
|
@ -1,227 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-module(emqx_sasl_api).
|
|
||||||
|
|
||||||
-include("emqx_sasl.hrl").
|
|
||||||
|
|
||||||
-import(minirest, [ return/0
|
|
||||||
, return/1
|
|
||||||
]).
|
|
||||||
|
|
||||||
-rest_api(#{name => add,
|
|
||||||
method => 'POST',
|
|
||||||
path => "/sasl",
|
|
||||||
func => add,
|
|
||||||
descr => "Add authentication information"}).
|
|
||||||
|
|
||||||
-rest_api(#{name => delete,
|
|
||||||
method => 'DELETE',
|
|
||||||
path => "/sasl",
|
|
||||||
func => delete,
|
|
||||||
descr => "Delete authentication information"}).
|
|
||||||
|
|
||||||
-rest_api(#{name => update,
|
|
||||||
method => 'PUT',
|
|
||||||
path => "/sasl",
|
|
||||||
func => update,
|
|
||||||
descr => "Update authentication information"}).
|
|
||||||
|
|
||||||
-rest_api(#{name => get,
|
|
||||||
method => 'GET',
|
|
||||||
path => "/sasl",
|
|
||||||
func => get,
|
|
||||||
descr => "Get authentication information"}).
|
|
||||||
|
|
||||||
-export([ add/2
|
|
||||||
, delete/2
|
|
||||||
, update/2
|
|
||||||
, get/2
|
|
||||||
]).
|
|
||||||
|
|
||||||
add(_Bindings, Params) ->
|
|
||||||
case pipeline([fun ensure_required_add_params/1,
|
|
||||||
fun validate_params/1,
|
|
||||||
fun do_add/1], Params) of
|
|
||||||
ok ->
|
|
||||||
return();
|
|
||||||
{error, Reason} ->
|
|
||||||
return({error, Reason})
|
|
||||||
end.
|
|
||||||
|
|
||||||
delete(_Bindings, Params) ->
|
|
||||||
case pipeline([fun ensure_required_delete_params/1,
|
|
||||||
fun validate_params/1,
|
|
||||||
fun do_delete/1], Params) of
|
|
||||||
ok ->
|
|
||||||
return();
|
|
||||||
{error, Reason} ->
|
|
||||||
return({error, Reason})
|
|
||||||
end.
|
|
||||||
|
|
||||||
update(_Bindings, Params) ->
|
|
||||||
case pipeline([fun ensure_required_add_params/1,
|
|
||||||
fun validate_params/1,
|
|
||||||
fun do_update/1], Params) of
|
|
||||||
ok ->
|
|
||||||
return();
|
|
||||||
{error, Reason} ->
|
|
||||||
return({error, Reason})
|
|
||||||
end.
|
|
||||||
|
|
||||||
get(Bindings, Params) when is_list(Params) ->
|
|
||||||
get(Bindings, maps:from_list(Params));
|
|
||||||
|
|
||||||
get(_Bindings, #{<<"mechanism">> := Mechanism0,
|
|
||||||
<<"username">> := Username0}) ->
|
|
||||||
Mechanism = urldecode(Mechanism0),
|
|
||||||
Username = urldecode(Username0),
|
|
||||||
case Mechanism of
|
|
||||||
<<"SCRAM-SHA-1">> ->
|
|
||||||
case emqx_sasl_scram:lookup(Username) of
|
|
||||||
{ok, AuthInfo = #{salt := Salt}} ->
|
|
||||||
return({ok, AuthInfo#{salt => base64:decode(Salt)}});
|
|
||||||
{error, Reason} ->
|
|
||||||
return({error, Reason})
|
|
||||||
end;
|
|
||||||
_ ->
|
|
||||||
return({error, unsupported_mechanism})
|
|
||||||
end;
|
|
||||||
get(_Bindings, #{<<"mechanism">> := Mechanism}) ->
|
|
||||||
case urldecode(Mechanism) of
|
|
||||||
<<"SCRAM-SHA-1">> ->
|
|
||||||
Data = #{Mechanism => mnesia:dirty_all_keys(?SCRAM_AUTH_TAB)},
|
|
||||||
return({ok, Data});
|
|
||||||
_ ->
|
|
||||||
return({error, <<"Unsupported mechanism">>})
|
|
||||||
end;
|
|
||||||
|
|
||||||
get(_Bindings, _Params) ->
|
|
||||||
Data = lists:foldl(fun(Mechanism, Acc) ->
|
|
||||||
case Mechanism of
|
|
||||||
<<"SCRAM-SHA-1">> ->
|
|
||||||
[#{Mechanism => mnesia:dirty_all_keys(?SCRAM_AUTH_TAB)} | Acc]
|
|
||||||
end
|
|
||||||
end, [], emqx_sasl:supported()),
|
|
||||||
return({ok, Data}).
|
|
||||||
|
|
||||||
ensure_required_add_params(Params) when is_list(Params) ->
|
|
||||||
case proplists:get_value(<<"mechanism">>, Params) of
|
|
||||||
undefined ->
|
|
||||||
{missing, missing_required_param};
|
|
||||||
Mechaism ->
|
|
||||||
ensure_required_add_params(Mechaism, Params)
|
|
||||||
end.
|
|
||||||
|
|
||||||
ensure_required_add_params(<<"SCRAM-SHA-1">>, Params) ->
|
|
||||||
Required = [<<"username">>, <<"password">>, <<"salt">>],
|
|
||||||
case erlang:map_size(maps:with(Required, maps:from_list(Params))) =:= erlang:length(Required) of
|
|
||||||
true -> ok;
|
|
||||||
false -> {missing, missing_required_param}
|
|
||||||
end;
|
|
||||||
ensure_required_add_params(_, _) ->
|
|
||||||
{error, unsupported_mechanism}.
|
|
||||||
|
|
||||||
ensure_required_delete_params(Params) when is_list(Params) ->
|
|
||||||
case proplists:get_value(<<"mechanism">>, Params) of
|
|
||||||
undefined ->
|
|
||||||
{missing, missing_required_param};
|
|
||||||
Mechaism ->
|
|
||||||
ensure_required_delete_params(Mechaism, Params)
|
|
||||||
end.
|
|
||||||
|
|
||||||
ensure_required_delete_params(<<"SCRAM-SHA-1">>, Params) ->
|
|
||||||
Required = [<<"username">>],
|
|
||||||
case erlang:map_size(maps:with(Required, maps:from_list(Params))) =:= erlang:length(Required) of
|
|
||||||
true -> ok;
|
|
||||||
false -> {missing, missing_required_param}
|
|
||||||
end;
|
|
||||||
ensure_required_delete_params(_, _) ->
|
|
||||||
{error, unsupported_mechanism}.
|
|
||||||
|
|
||||||
validate_params(Params) ->
|
|
||||||
Mechaism = proplists:get_value(<<"mechanism">>, Params),
|
|
||||||
validate_params(Mechaism, Params).
|
|
||||||
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, []) ->
|
|
||||||
ok;
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"username">>, Username} | More]) when is_binary(Username) ->
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, More);
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"username">>, _} | _]) ->
|
|
||||||
{error, invalid_username};
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"password">>, Password} | More]) when is_binary(Password) ->
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, More);
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"password">>, _} | _]) ->
|
|
||||||
{error, invalid_password};
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"salt">>, Salt} | More]) when is_binary(Salt) ->
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, More);
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"salt">>, _} | _]) ->
|
|
||||||
{error, invalid_salt};
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"iteration_count">>, IterationCount} | More]) when is_integer(IterationCount) ->
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, More);
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [{<<"iteration_count">>, _} | _]) ->
|
|
||||||
{error, invalid_iteration_count};
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, [_ | More]) ->
|
|
||||||
validate_params(<<"SCRAM-SHA-1">>, More).
|
|
||||||
|
|
||||||
do_add(Params) ->
|
|
||||||
Mechaism = proplists:get_value(<<"mechanism">>, Params),
|
|
||||||
do_add(Mechaism, Params).
|
|
||||||
|
|
||||||
do_add(<<"SCRAM-SHA-1">>, Params) ->
|
|
||||||
Username = proplists:get_value(<<"username">>, Params),
|
|
||||||
Password = proplists:get_value(<<"password">>, Params),
|
|
||||||
Salt = proplists:get_value(<<"salt">>, Params),
|
|
||||||
IterationCount = proplists:get_value(<<"iteration_count">>, Params, 4096),
|
|
||||||
emqx_sasl_scram:add(Username, Password, Salt, IterationCount);
|
|
||||||
do_add(_, _) ->
|
|
||||||
{error, unsupported_mechanism}.
|
|
||||||
|
|
||||||
do_delete(Params) ->
|
|
||||||
Mechaism = proplists:get_value(<<"mechanism">>, Params),
|
|
||||||
do_delete(Mechaism, Params).
|
|
||||||
|
|
||||||
do_delete(<<"SCRAM-SHA-1">>, Params) ->
|
|
||||||
Username = proplists:get_value(<<"username">>, Params),
|
|
||||||
emqx_sasl_scram:delete(Username);
|
|
||||||
do_delete(_, _) ->
|
|
||||||
{error, unsupported_mechanism}.
|
|
||||||
|
|
||||||
do_update(Params) ->
|
|
||||||
Mechaism = proplists:get_value(<<"mechanism">>, Params),
|
|
||||||
do_update(Mechaism, Params).
|
|
||||||
|
|
||||||
do_update(<<"SCRAM-SHA-1">>, Params) ->
|
|
||||||
Username = proplists:get_value(<<"username">>, Params),
|
|
||||||
Password = proplists:get_value(<<"password">>, Params),
|
|
||||||
Salt = proplists:get_value(<<"salt">>, Params),
|
|
||||||
IterationCount = proplists:get_value(<<"iteration_count">>, Params, 4096),
|
|
||||||
emqx_sasl_scram:update(Username, Password, Salt, IterationCount);
|
|
||||||
do_update(_, _) ->
|
|
||||||
{error, unsupported_mechanism}.
|
|
||||||
|
|
||||||
pipeline([], _) ->
|
|
||||||
ok;
|
|
||||||
pipeline([Fun | More], Params) ->
|
|
||||||
case Fun(Params) of
|
|
||||||
ok ->
|
|
||||||
pipeline(More, Params);
|
|
||||||
{error, Reason} ->
|
|
||||||
{error, Reason}
|
|
||||||
end.
|
|
||||||
|
|
||||||
urldecode(S) ->
|
|
||||||
emqx_http_lib:uri_decode(S).
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-module(emqx_sasl_app).
|
|
||||||
|
|
||||||
-behaviour(application).
|
|
||||||
|
|
||||||
-emqx_plugin(?MODULE).
|
|
||||||
|
|
||||||
-export([ start/2
|
|
||||||
, stop/1
|
|
||||||
]).
|
|
||||||
|
|
||||||
-behaviour(supervisor).
|
|
||||||
|
|
||||||
-export([init/1]).
|
|
||||||
|
|
||||||
start(_Type, _Args) ->
|
|
||||||
ok = emqx_sasl:init(),
|
|
||||||
_ = emqx_sasl:load(),
|
|
||||||
emqx_sasl_cli:load(),
|
|
||||||
supervisor:start_link({local, ?MODULE}, ?MODULE, []).
|
|
||||||
|
|
||||||
stop(_State) ->
|
|
||||||
emqx_sasl_cli:unload(),
|
|
||||||
emqx_sasl:unload().
|
|
||||||
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Dummy supervisor
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
init([]) ->
|
|
||||||
{ok, { {one_for_all, 1, 10}, []} }.
|
|
||||||
|
|
@ -1,82 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-module(emqx_sasl_cli).
|
|
||||||
|
|
||||||
-include("emqx_sasl.hrl").
|
|
||||||
|
|
||||||
%% APIs
|
|
||||||
-export([ load/0
|
|
||||||
, unload/0
|
|
||||||
, cli/1
|
|
||||||
]).
|
|
||||||
|
|
||||||
load() ->
|
|
||||||
emqx_ctl:register_command(sasl, {?MODULE, cli}, []).
|
|
||||||
|
|
||||||
unload() ->
|
|
||||||
emqx_ctl:unregister_command(sasl).
|
|
||||||
|
|
||||||
cli(["scram", "add", Username, Password, Salt]) ->
|
|
||||||
cli(["scram", "add", Username, Password, Salt, "4096"]);
|
|
||||||
cli(["scram", "add", Username, Password, Salt, IterationCount]) ->
|
|
||||||
case emqx_sasl_scram:add(list_to_binary(Username),
|
|
||||||
list_to_binary(Password),
|
|
||||||
list_to_binary(Salt),
|
|
||||||
list_to_integer(IterationCount)) of
|
|
||||||
ok ->
|
|
||||||
emqx_ctl:print("Authentication information added successfully~n");
|
|
||||||
{error, already_existed} ->
|
|
||||||
emqx_ctl:print("Authentication information already exists~n")
|
|
||||||
end;
|
|
||||||
|
|
||||||
cli(["scram", "delete", Username0]) ->
|
|
||||||
Username = list_to_binary(Username0),
|
|
||||||
ok = emqx_sasl_scram:delete(Username),
|
|
||||||
emqx_ctl:print("Authentication information deleted successfully~n");
|
|
||||||
|
|
||||||
cli(["scram", "update", Username, Password, Salt]) ->
|
|
||||||
cli(["scram", "update", Username, Password, Salt, "4096"]);
|
|
||||||
cli(["scram", "update", Username, Password, Salt, IterationCount]) ->
|
|
||||||
case emqx_sasl_scram:update(list_to_binary(Username),
|
|
||||||
list_to_binary(Password),
|
|
||||||
list_to_binary(Salt),
|
|
||||||
list_to_integer(IterationCount)) of
|
|
||||||
ok ->
|
|
||||||
emqx_ctl:print("Authentication information updated successfully~n");
|
|
||||||
{error, not_found} ->
|
|
||||||
emqx_ctl:print("Authentication information not found~n")
|
|
||||||
end;
|
|
||||||
|
|
||||||
cli(["scram", "lookup", Username0]) ->
|
|
||||||
Username = list_to_binary(Username0),
|
|
||||||
case emqx_sasl_scram:lookup(Username) of
|
|
||||||
{ok, #{username := Username,
|
|
||||||
stored_key := StoredKey,
|
|
||||||
server_key := ServerKey,
|
|
||||||
salt := Salt,
|
|
||||||
iteration_count := IterationCount}} ->
|
|
||||||
emqx_ctl:print("Username: ~s, Stored Key: ~s, Server Key: ~s, Salt: ~s, Iteration Count: ~p~n",
|
|
||||||
[Username, StoredKey, ServerKey, base64:decode(Salt), IterationCount]);
|
|
||||||
{error, not_found} ->
|
|
||||||
emqx_ctl:print("Authentication information not found~n")
|
|
||||||
end;
|
|
||||||
|
|
||||||
cli(_) ->
|
|
||||||
emqx_ctl:usage([{"sasl scram add <Username> <Password> <Salt> [<IterationCount>]", "Add SCRAM-SHA-1 authentication information"},
|
|
||||||
{"sasl scram delete <Username>", "Delete SCRAM-SHA-1 authentication information"},
|
|
||||||
{"sasl scram update <Username> <Password> <Salt> [<IterationCount>]", "Update SCRAM-SHA-1 authentication information"},
|
|
||||||
{"sasl scram lookup <Username>", "Check if SCRAM-SHA-1 authentication information exists"}]).
|
|
||||||
|
|
@ -1,310 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-module(emqx_sasl_scram).
|
|
||||||
|
|
||||||
-include("emqx_sasl.hrl").
|
|
||||||
|
|
||||||
-export([ init/0
|
|
||||||
, add/3
|
|
||||||
, add/4
|
|
||||||
, update/3
|
|
||||||
, update/4
|
|
||||||
, delete/1
|
|
||||||
, lookup/1
|
|
||||||
, check/2
|
|
||||||
, make_client_first/1]).
|
|
||||||
|
|
||||||
-record(?SCRAM_AUTH_TAB, {
|
|
||||||
username,
|
|
||||||
stored_key,
|
|
||||||
server_key,
|
|
||||||
salt,
|
|
||||||
iteration_count :: integer()
|
|
||||||
}).
|
|
||||||
|
|
||||||
-ifdef(TEST).
|
|
||||||
-compile(export_all).
|
|
||||||
-compile(nowarn_export_all).
|
|
||||||
-endif.
|
|
||||||
|
|
||||||
init() ->
|
|
||||||
ok = ekka_mnesia:create_table(?SCRAM_AUTH_TAB, [
|
|
||||||
{disc_copies, [node()]},
|
|
||||||
{attributes, record_info(fields, ?SCRAM_AUTH_TAB)},
|
|
||||||
{storage_properties, [{ets, [{read_concurrency, true}]}]}]),
|
|
||||||
ok = ekka_mnesia:copy_table(?SCRAM_AUTH_TAB, disc_copies).
|
|
||||||
|
|
||||||
add(Username, Password, Salt) ->
|
|
||||||
add(Username, Password, Salt, 4096).
|
|
||||||
|
|
||||||
add(Username, Password, Salt, IterationCount) ->
|
|
||||||
case lookup(Username) of
|
|
||||||
{error, not_found} ->
|
|
||||||
do_add(Username, Password, Salt, IterationCount);
|
|
||||||
_ ->
|
|
||||||
{error, already_existed}
|
|
||||||
end.
|
|
||||||
|
|
||||||
update(Username, Password, Salt) ->
|
|
||||||
update(Username, Password, Salt, 4096).
|
|
||||||
|
|
||||||
update(Username, Password, Salt, IterationCount) ->
|
|
||||||
case lookup(Username) of
|
|
||||||
{error, not_found} ->
|
|
||||||
{error, not_found};
|
|
||||||
_ ->
|
|
||||||
do_add(Username, Password, Salt, IterationCount)
|
|
||||||
end.
|
|
||||||
|
|
||||||
delete(Username) ->
|
|
||||||
ret(mnesia:transaction(fun mnesia:delete/3, [?SCRAM_AUTH_TAB, Username, write])).
|
|
||||||
|
|
||||||
lookup(Username) ->
|
|
||||||
case mnesia:dirty_read(?SCRAM_AUTH_TAB, Username) of
|
|
||||||
[#scram_auth{username = Username,
|
|
||||||
stored_key = StoredKey,
|
|
||||||
server_key = ServerKey,
|
|
||||||
salt = Salt,
|
|
||||||
iteration_count = IterationCount}] ->
|
|
||||||
{ok, #{username => Username,
|
|
||||||
stored_key => StoredKey,
|
|
||||||
server_key => ServerKey,
|
|
||||||
salt => Salt,
|
|
||||||
iteration_count => IterationCount}};
|
|
||||||
[] ->
|
|
||||||
{error, not_found}
|
|
||||||
end.
|
|
||||||
|
|
||||||
do_add(Username, Password, Salt, IterationCount) ->
|
|
||||||
SaltedPassword = pbkdf2_sha_1(Password, Salt, IterationCount),
|
|
||||||
ClientKey = client_key(SaltedPassword),
|
|
||||||
ServerKey = server_key(SaltedPassword),
|
|
||||||
StoredKey = crypto:hash(sha, ClientKey),
|
|
||||||
AuthInfo = #scram_auth{username = Username,
|
|
||||||
stored_key = base64:encode(StoredKey),
|
|
||||||
server_key = base64:encode(ServerKey),
|
|
||||||
salt = base64:encode(Salt),
|
|
||||||
iteration_count = IterationCount},
|
|
||||||
ret(mnesia:transaction(fun mnesia:write/3, [?SCRAM_AUTH_TAB, AuthInfo, write])).
|
|
||||||
|
|
||||||
ret({atomic, ok}) -> ok;
|
|
||||||
ret({aborted, Error}) -> {error, Error}.
|
|
||||||
|
|
||||||
check(Data, Cache) when map_size(Cache) =:= 0 ->
|
|
||||||
check_client_first(Data);
|
|
||||||
check(Data, Cache) ->
|
|
||||||
case maps:get(next_step, Cache, undefined) of
|
|
||||||
undefined -> check_server_first(Data, Cache);
|
|
||||||
check_client_final -> check_client_final(Data, Cache);
|
|
||||||
check_server_final -> check_server_final(Data, Cache)
|
|
||||||
end.
|
|
||||||
|
|
||||||
check_client_first(ClientFirst) ->
|
|
||||||
ClientFirstWithoutHeader = without_header(ClientFirst),
|
|
||||||
Attributes = parse(ClientFirstWithoutHeader),
|
|
||||||
Username = proplists:get_value(username, Attributes),
|
|
||||||
ClientNonce = proplists:get_value(nonce, Attributes),
|
|
||||||
case lookup(Username) of
|
|
||||||
{error, not_found} ->
|
|
||||||
{error, not_found};
|
|
||||||
{ok, #{stored_key := StoredKey0,
|
|
||||||
server_key := ServerKey0,
|
|
||||||
salt := Salt0,
|
|
||||||
iteration_count := IterationCount}} ->
|
|
||||||
StoredKey = base64:decode(StoredKey0),
|
|
||||||
ServerKey = base64:decode(ServerKey0),
|
|
||||||
Salt = base64:decode(Salt0),
|
|
||||||
ServerNonce = nonce(),
|
|
||||||
Nonce = list_to_binary(binary_to_list(ClientNonce) ++ binary_to_list(ServerNonce)),
|
|
||||||
ServerFirst = make_server_first(Nonce, Salt, IterationCount),
|
|
||||||
{continue, ServerFirst, #{next_step => check_client_final,
|
|
||||||
client_first_without_header => ClientFirstWithoutHeader,
|
|
||||||
server_first => ServerFirst,
|
|
||||||
stored_key => StoredKey,
|
|
||||||
server_key => ServerKey,
|
|
||||||
nonce => Nonce}}
|
|
||||||
end.
|
|
||||||
|
|
||||||
check_client_final(ClientFinal, #{client_first_without_header := ClientFirstWithoutHeader,
|
|
||||||
server_first := ServerFirst,
|
|
||||||
server_key := ServerKey,
|
|
||||||
stored_key := StoredKey,
|
|
||||||
nonce := OldNonce}) ->
|
|
||||||
ClientFinalWithoutProof = without_proof(ClientFinal),
|
|
||||||
Attributes = parse(ClientFinal),
|
|
||||||
ClientProof = base64:decode(proplists:get_value(proof, Attributes)),
|
|
||||||
NewNonce = proplists:get_value(nonce, Attributes),
|
|
||||||
Auth0 = io_lib:format("~s,~s,~s", [ClientFirstWithoutHeader, ServerFirst, ClientFinalWithoutProof]),
|
|
||||||
Auth = iolist_to_binary(Auth0),
|
|
||||||
ClientSignature = hmac(StoredKey, Auth),
|
|
||||||
ClientKey = crypto:exor(ClientProof, ClientSignature),
|
|
||||||
case NewNonce =:= OldNonce andalso crypto:hash(sha, ClientKey) =:= StoredKey of
|
|
||||||
true ->
|
|
||||||
ServerSignature = hmac(ServerKey, Auth),
|
|
||||||
ServerFinal = make_server_final(ServerSignature),
|
|
||||||
{ok, ServerFinal, #{}};
|
|
||||||
false ->
|
|
||||||
{error, invalid_client_final}
|
|
||||||
end.
|
|
||||||
|
|
||||||
check_server_first(ServerFirst, #{password := Password,
|
|
||||||
client_first := ClientFirst}) ->
|
|
||||||
Attributes = parse(ServerFirst),
|
|
||||||
Nonce = proplists:get_value(nonce, Attributes),
|
|
||||||
ClientFirstWithoutHeader = without_header(ClientFirst),
|
|
||||||
ClientFinalWithoutProof = serialize([{channel_binding, <<"biws">>}, {nonce, Nonce}]),
|
|
||||||
Auth = list_to_binary(io_lib:format("~s,~s,~s", [ClientFirstWithoutHeader, ServerFirst, ClientFinalWithoutProof])),
|
|
||||||
Salt = base64:decode(proplists:get_value(salt, Attributes)),
|
|
||||||
IterationCount = binary_to_integer(proplists:get_value(iteration_count, Attributes)),
|
|
||||||
SaltedPassword = pbkdf2_sha_1(Password, Salt, IterationCount),
|
|
||||||
ClientKey = client_key(SaltedPassword),
|
|
||||||
StoredKey = crypto:hash(sha, ClientKey),
|
|
||||||
ClientSignature = hmac(StoredKey, Auth),
|
|
||||||
ClientProof = base64:encode(crypto:exor(ClientKey, ClientSignature)),
|
|
||||||
ClientFinal = serialize([{channel_binding, <<"biws">>},
|
|
||||||
{nonce, Nonce},
|
|
||||||
{proof, ClientProof}]),
|
|
||||||
{continue, ClientFinal, #{next_step => check_server_final,
|
|
||||||
password => Password,
|
|
||||||
client_first => ClientFirst,
|
|
||||||
server_first => ServerFirst}}.
|
|
||||||
|
|
||||||
check_server_final(ServerFinal, #{password := Password,
|
|
||||||
client_first := ClientFirst,
|
|
||||||
server_first := ServerFirst}) ->
|
|
||||||
NewAttributes = parse(ServerFinal),
|
|
||||||
Attributes = parse(ServerFirst),
|
|
||||||
Nonce = proplists:get_value(nonce, Attributes),
|
|
||||||
ClientFirstWithoutHeader = without_header(ClientFirst),
|
|
||||||
ClientFinalWithoutProof = serialize([{channel_binding, <<"biws">>}, {nonce, Nonce}]),
|
|
||||||
Auth = list_to_binary(io_lib:format("~s,~s,~s", [ClientFirstWithoutHeader, ServerFirst, ClientFinalWithoutProof])),
|
|
||||||
Salt = base64:decode(proplists:get_value(salt, Attributes)),
|
|
||||||
IterationCount = binary_to_integer(proplists:get_value(iteration_count, Attributes)),
|
|
||||||
SaltedPassword = pbkdf2_sha_1(Password, Salt, IterationCount),
|
|
||||||
ServerKey = server_key(SaltedPassword),
|
|
||||||
ServerSignature = hmac(ServerKey, Auth),
|
|
||||||
case base64:encode(ServerSignature) =:= proplists:get_value(verifier, NewAttributes) of
|
|
||||||
true ->
|
|
||||||
{ok, <<>>, #{}};
|
|
||||||
false ->
|
|
||||||
{stop, invalid_server_final}
|
|
||||||
end.
|
|
||||||
|
|
||||||
make_client_first(Username) ->
|
|
||||||
list_to_binary("n,," ++ binary_to_list(serialize([{username, Username}, {nonce, nonce()}]))).
|
|
||||||
|
|
||||||
make_server_first(Nonce, Salt, IterationCount) ->
|
|
||||||
serialize([{nonce, Nonce}, {salt, base64:encode(Salt)}, {iteration_count, IterationCount}]).
|
|
||||||
|
|
||||||
make_server_final(ServerSignature) ->
|
|
||||||
serialize([{verifier, base64:encode(ServerSignature)}]).
|
|
||||||
|
|
||||||
nonce() ->
|
|
||||||
base64:encode([$a + rand:uniform(26) || _ <- lists:seq(1, 10)]).
|
|
||||||
|
|
||||||
pbkdf2_sha_1(Password, Salt, IterationCount) ->
|
|
||||||
{ok, Bin} = pbkdf2:pbkdf2(sha, Password, Salt, IterationCount),
|
|
||||||
pbkdf2:to_hex(Bin).
|
|
||||||
|
|
||||||
-if(?OTP_RELEASE >= 23).
|
|
||||||
hmac(Key, Data) ->
|
|
||||||
HMAC = crypto:mac_init(hmac, sha, Key),
|
|
||||||
HMAC1 = crypto:mac_update(HMAC, Data),
|
|
||||||
crypto:mac_final(HMAC1).
|
|
||||||
-else.
|
|
||||||
hmac(Key, Data) ->
|
|
||||||
HMAC = crypto:hmac_init(sha, Key),
|
|
||||||
HMAC1 = crypto:hmac_update(HMAC, Data),
|
|
||||||
crypto:hmac_final(HMAC1).
|
|
||||||
-endif.
|
|
||||||
|
|
||||||
client_key(SaltedPassword) ->
|
|
||||||
hmac(<<"Client Key">>, SaltedPassword).
|
|
||||||
|
|
||||||
server_key(SaltedPassword) ->
|
|
||||||
hmac(<<"Server Key">>, SaltedPassword).
|
|
||||||
|
|
||||||
without_header(<<"n,,", ClientFirstWithoutHeader/binary>>) ->
|
|
||||||
ClientFirstWithoutHeader;
|
|
||||||
without_header(<<GS2CbindFlag:1/binary, _/binary>>) ->
|
|
||||||
error({unsupported_gs2_cbind_flag, binary_to_atom(GS2CbindFlag, utf8)}).
|
|
||||||
|
|
||||||
without_proof(ClientFinal) ->
|
|
||||||
[ClientFinalWithoutProof | _] = binary:split(ClientFinal, <<",p=">>, [global, trim_all]),
|
|
||||||
ClientFinalWithoutProof.
|
|
||||||
|
|
||||||
parse(Message) ->
|
|
||||||
Attributes = binary:split(Message, <<$,>>, [global, trim_all]),
|
|
||||||
lists:foldl(fun(<<Key:1/binary, "=", Value/binary>>, Acc) ->
|
|
||||||
[{to_long(Key), Value} | Acc]
|
|
||||||
end, [], Attributes).
|
|
||||||
|
|
||||||
serialize(Attributes) ->
|
|
||||||
iolist_to_binary(
|
|
||||||
lists:foldl(fun({Key, Value}, []) ->
|
|
||||||
[to_short(Key), "=", to_list(Value)];
|
|
||||||
({Key, Value}, Acc) ->
|
|
||||||
Acc ++ [",", to_short(Key), "=", to_list(Value)]
|
|
||||||
end, [], Attributes)).
|
|
||||||
|
|
||||||
to_long(<<"a">>) ->
|
|
||||||
authzid;
|
|
||||||
to_long(<<"c">>) ->
|
|
||||||
channel_binding;
|
|
||||||
to_long(<<"n">>) ->
|
|
||||||
username;
|
|
||||||
to_long(<<"p">>) ->
|
|
||||||
proof;
|
|
||||||
to_long(<<"r">>) ->
|
|
||||||
nonce;
|
|
||||||
to_long(<<"s">>) ->
|
|
||||||
salt;
|
|
||||||
to_long(<<"v">>) ->
|
|
||||||
verifier;
|
|
||||||
to_long(<<"i">>) ->
|
|
||||||
iteration_count;
|
|
||||||
to_long(_) ->
|
|
||||||
error(test).
|
|
||||||
|
|
||||||
to_short(authzid) ->
|
|
||||||
"a";
|
|
||||||
to_short(channel_binding) ->
|
|
||||||
"c";
|
|
||||||
to_short(username) ->
|
|
||||||
"n";
|
|
||||||
to_short(proof) ->
|
|
||||||
"p";
|
|
||||||
to_short(nonce) ->
|
|
||||||
"r";
|
|
||||||
to_short(salt) ->
|
|
||||||
"s";
|
|
||||||
to_short(verifier) ->
|
|
||||||
"v";
|
|
||||||
to_short(iteration_count) ->
|
|
||||||
"i";
|
|
||||||
to_short(_) ->
|
|
||||||
error(test).
|
|
||||||
|
|
||||||
to_list(V) when is_binary(V) ->
|
|
||||||
binary_to_list(V);
|
|
||||||
to_list(V) when is_list(V) ->
|
|
||||||
V;
|
|
||||||
to_list(V) when is_integer(V) ->
|
|
||||||
integer_to_list(V);
|
|
||||||
to_list(_) ->
|
|
||||||
error(bad_type).
|
|
||||||
|
|
||||||
|
|
@ -1,140 +0,0 @@
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
%% Copyright (c) 2020-2021 EMQ Technologies Co., Ltd. All Rights Reserved.
|
|
||||||
%%
|
|
||||||
%% Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
%% you may not use this file except in compliance with the License.
|
|
||||||
%% You may obtain a copy of the License at
|
|
||||||
%%
|
|
||||||
%% http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
%%
|
|
||||||
%% Unless required by applicable law or agreed to in writing, software
|
|
||||||
%% distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
%% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
%% See the License for the specific language governing permissions and
|
|
||||||
%% limitations under the License.
|
|
||||||
%%--------------------------------------------------------------------
|
|
||||||
|
|
||||||
-module(emqx_sasl_scram_SUITE).
|
|
||||||
|
|
||||||
-compile(export_all).
|
|
||||||
-compile(nowarn_export_all).
|
|
||||||
|
|
||||||
-include_lib("common_test/include/ct.hrl").
|
|
||||||
-include_lib("eunit/include/eunit.hrl").
|
|
||||||
|
|
||||||
init_per_suite(Config) ->
|
|
||||||
emqx_ct_helpers:start_apps([emqx_sasl]),
|
|
||||||
Config.
|
|
||||||
|
|
||||||
end_per_suite(_Config) ->
|
|
||||||
emqx_ct_helpers:stop_apps([]).
|
|
||||||
|
|
||||||
all() -> emqx_ct:all(?MODULE).
|
|
||||||
|
|
||||||
t_crud(_) ->
|
|
||||||
Username = <<"test">>,
|
|
||||||
Password = <<"public">>,
|
|
||||||
Salt = <<"emqx">>,
|
|
||||||
IterationCount = 4096,
|
|
||||||
EncodedSalt = base64:encode(Salt),
|
|
||||||
SaltedPassword = emqx_sasl_scram:pbkdf2_sha_1(Password, Salt, IterationCount),
|
|
||||||
ClientKey = emqx_sasl_scram:client_key(SaltedPassword),
|
|
||||||
ServerKey = base64:encode(emqx_sasl_scram:server_key(SaltedPassword)),
|
|
||||||
StoredKey = base64:encode(crypto:hash(sha, ClientKey)),
|
|
||||||
|
|
||||||
{error, not_found} = emqx_sasl_scram:lookup(Username),
|
|
||||||
ok = emqx_sasl_scram:add(Username, Password, Salt),
|
|
||||||
{error, already_existed} = emqx_sasl_scram:add(Username, Password, Salt),
|
|
||||||
|
|
||||||
{ok, #{username := Username,
|
|
||||||
stored_key := StoredKey,
|
|
||||||
server_key := ServerKey,
|
|
||||||
salt := EncodedSalt,
|
|
||||||
iteration_count := IterationCount}} = emqx_sasl_scram:lookup(Username),
|
|
||||||
|
|
||||||
NewSalt = <<"new salt">>,
|
|
||||||
NewEncodedSalt = base64:encode(NewSalt),
|
|
||||||
emqx_sasl_scram:update(Username, Password, NewSalt),
|
|
||||||
{ok, #{username := Username,
|
|
||||||
salt := NewEncodedSalt}} = emqx_sasl_scram:lookup(Username),
|
|
||||||
emqx_sasl_scram:delete(Username),
|
|
||||||
{error, not_found} = emqx_sasl_scram:lookup(Username).
|
|
||||||
|
|
||||||
t_scram(_) ->
|
|
||||||
AuthMethod = <<"SCRAM-SHA-1">>,
|
|
||||||
[AuthMethod] = emqx_sasl:supported(),
|
|
||||||
|
|
||||||
Username = <<"test">>,
|
|
||||||
Password = <<"public">>,
|
|
||||||
Salt = <<"emqx">>,
|
|
||||||
ok = emqx_sasl_scram:add(Username, Password, Salt),
|
|
||||||
ClientFirst = emqx_sasl_scram:make_client_first(Username),
|
|
||||||
|
|
||||||
{ok, {continue, ServerFirst, Cache}} = emqx_sasl:check(AuthMethod, ClientFirst, #{}),
|
|
||||||
|
|
||||||
{ok, {continue, ClientFinal, ClientCache}} = emqx_sasl:check(AuthMethod, ServerFirst, #{password => Password, client_first => ClientFirst}),
|
|
||||||
|
|
||||||
{ok, {ok, ServerFinal, #{}}} = emqx_sasl:check(AuthMethod, ClientFinal, Cache),
|
|
||||||
|
|
||||||
{ok, _} = emqx_sasl:check(AuthMethod, ServerFinal, ClientCache).
|
|
||||||
|
|
||||||
%t_proto(_) ->
|
|
||||||
% process_flag(trap_exit, true),
|
|
||||||
%
|
|
||||||
% Username = <<"username">>,
|
|
||||||
% Password = <<"password">>,
|
|
||||||
% Salt = <<"emqx">>,
|
|
||||||
% AuthMethod = <<"SCRAM-SHA-1">>,
|
|
||||||
%
|
|
||||||
% {ok, Client0} = emqtt:start_link([{clean_start, true},
|
|
||||||
% {proto_ver, v5},
|
|
||||||
% {enhanced_auth, #{method => AuthMethod,
|
|
||||||
% params => #{username => Username,
|
|
||||||
% password => Password,
|
|
||||||
% salt => Salt}}},
|
|
||||||
% {connect_timeout, 6000}]),
|
|
||||||
% {error,{not_authorized,#{}}} = emqtt:connect(Client0),
|
|
||||||
%
|
|
||||||
% ok = emqx_sasl_scram:add(Username, Password, Salt),
|
|
||||||
% {ok, Client1} = emqtt:start_link([{clean_start, true},
|
|
||||||
% {proto_ver, v5},
|
|
||||||
% {enhanced_auth, #{method => AuthMethod,
|
|
||||||
% params => #{username => Username,
|
|
||||||
% password => Password,
|
|
||||||
% salt => Salt}}},
|
|
||||||
% {connect_timeout, 6000}]),
|
|
||||||
% {ok, _} = emqtt:connect(Client1),
|
|
||||||
%
|
|
||||||
% timer:sleep(200),
|
|
||||||
% ok = emqtt:reauthentication(Client1, #{params => #{username => Username,
|
|
||||||
% password => Password,
|
|
||||||
% salt => Salt}}),
|
|
||||||
%
|
|
||||||
% timer:sleep(200),
|
|
||||||
% ErrorFun = fun (_State) -> {ok, <<>>, #{}} end,
|
|
||||||
% ok = emqtt:reauthentication(Client1, #{params => #{},function => ErrorFun}),
|
|
||||||
% receive
|
|
||||||
% {disconnected,ReasonCode2,#{}} ->
|
|
||||||
% ?assertEqual(ReasonCode2, 135)
|
|
||||||
% after 500 ->
|
|
||||||
% error("emqx re-authentication failed")
|
|
||||||
% end,
|
|
||||||
%
|
|
||||||
% {ok, Client2} = emqtt:start_link([{clean_start, true},
|
|
||||||
% {proto_ver, v5},
|
|
||||||
% {enhanced_auth, #{method => AuthMethod,
|
|
||||||
% params => #{},
|
|
||||||
% function =>fun (_State) -> {ok, <<>>, #{}} end}},
|
|
||||||
% {connect_timeout, 6000}]),
|
|
||||||
% {error,{not_authorized,#{}}} = emqtt:connect(Client2),
|
|
||||||
%
|
|
||||||
% receive_msg(),
|
|
||||||
% process_flag(trap_exit, false).
|
|
||||||
|
|
||||||
receive_msg() ->
|
|
||||||
receive
|
|
||||||
{'EXIT', Msg} ->
|
|
||||||
ct:print("==========+~p~n", [Msg]),
|
|
||||||
receive_msg()
|
|
||||||
after 200 -> ok
|
|
||||||
end.
|
|
||||||
|
|
@ -287,7 +287,6 @@ relx_plugin_apps(ReleaseType) ->
|
||||||
, emqx_authentication
|
, emqx_authentication
|
||||||
, emqx_web_hook
|
, emqx_web_hook
|
||||||
, emqx_rule_engine
|
, emqx_rule_engine
|
||||||
, emqx_sasl
|
|
||||||
, emqx_statsd
|
, emqx_statsd
|
||||||
]
|
]
|
||||||
++ relx_plugin_apps_per_rel(ReleaseType)
|
++ relx_plugin_apps_per_rel(ReleaseType)
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue