1
0
Fork 0

Use saved token for email 2fa codes

Dieser Commit ist enthalten in:
vpl 2019-08-04 16:55:43 +02:00
Ursprung efd8d9f528
Commit 6d460b44b0
11 geänderte Dateien mit 148 neuen und 139 gelöschten Zeilen

1
Cargo.lock generiert
Datei anzeigen

@ -118,6 +118,7 @@ dependencies = [
"oath 0.10.2 (registry+https://github.com/rust-lang/crates.io-index)",
"percent-encoding 2.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
"quoted_printable 0.4.1 (registry+https://github.com/rust-lang/crates.io-index)",
"rand 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)",
"regex 1.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
"reqwest 0.9.19 (registry+https://github.com/rust-lang/crates.io-index)",
"ring 0.14.6 (registry+https://github.com/rust-lang/crates.io-index)",

Datei anzeigen

@ -108,6 +108,9 @@ regex = "1.2.0"
# URL encoding library
percent-encoding = "2.0.0"
# Random
rand = "0.7.0"
[patch.crates-io]
# Add support for Timestamp type
rmp = { git = 'https://github.com/dani-garcia/msgpack-rust' }

Datei anzeigen

@ -1,18 +1,16 @@
use data_encoding::{BASE32};
use data_encoding::BASE32;
use rocket::Route;
use rocket_contrib::json::Json;
use crate::api::{JsonResult, JsonUpcase, NumberOrString, PasswordData};
use crate::api::core::two_factor::{_generate_recover_code, totp};
use crate::api::core::two_factor::_generate_recover_code;
use crate::api::{EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData};
use crate::auth::Headers;
use crate::crypto;
use crate::db::{
DbConn,
models::{TwoFactor, TwoFactorType},
DbConn,
};
const TOTP_TIME_STEP: u64 = 30;
pub fn routes() -> Vec<Route> {
routes![
generate_authenticator,
@ -20,7 +18,6 @@ pub fn routes() -> Vec<Route> {
activate_authenticator_put,
]
}
#[post("/two-factor/get-authenticator", data = "<data>")]
fn generate_authenticator(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) -> JsonResult {
let data: PasswordData = data.into_inner().data;
@ -80,7 +77,7 @@ fn activate_authenticator(data: JsonUpcase<EnableAuthenticatorData>, headers: He
let twofactor = TwoFactor::new(user.uuid.clone(), type_, key.to_uppercase());
// Validate the token provided with the key
totp::validate_totp_code(token, &twofactor.data)?;
validate_totp_code(token, &twofactor.data)?;
_generate_recover_code(&mut user, &conn);
twofactor.save(&conn)?;
@ -96,3 +93,28 @@ fn activate_authenticator(data: JsonUpcase<EnableAuthenticatorData>, headers: He
fn activate_authenticator_put(data: JsonUpcase<EnableAuthenticatorData>, headers: Headers, conn: DbConn) -> JsonResult {
activate_authenticator(data, headers, conn)
}
pub fn validate_totp_code_str(totp_code: &str, secret: &str) -> EmptyResult {
let totp_code: u64 = match totp_code.parse() {
Ok(code) => code,
_ => err!("TOTP code is not a number"),
};
validate_totp_code(totp_code, secret)
}
pub fn validate_totp_code(totp_code: u64, secret: &str) -> EmptyResult {
use oath::{totp_raw_now, HashType};
let decoded_secret = match BASE32.decode(secret.as_bytes()) {
Ok(s) => s,
Err(_) => err!("Invalid TOTP secret"),
};
let generated = totp_raw_now(&decoded_secret, 6, 0, 30, &HashType::SHA1);
if generated != totp_code {
err!("Invalid TOTP code");
}
Ok(())
}

Datei anzeigen

@ -1,18 +1,18 @@
use chrono::Utc;
use data_encoding::{BASE64};
use data_encoding::BASE64;
use rocket::Route;
use rocket_contrib::json::Json;
use serde_json;
use crate::api::{ApiResult, EmptyResult, JsonResult, JsonUpcase, PasswordData};
use crate::auth::Headers;
use crate::CONFIG;
use crate::crypto;
use crate::db::{
DbConn,
models::{TwoFactor, TwoFactorType, User},
DbConn,
};
use crate::error::{MapResult};
use crate::error::MapResult;
use crate::CONFIG;
pub fn routes() -> Vec<Route> {
routes![

Datei anzeigen

@ -1,23 +1,29 @@
use data_encoding::{BASE32};
use oath::{totp_raw_now, HashType};
use rocket::Route;
use rocket_contrib::json::Json;
use serde_json;
use crate::api::core::two_factor::totp;
use crate::api::{EmptyResult, JsonResult, JsonUpcase, PasswordData};
use crate::auth::Headers;
use crate::db::{
models::{TwoFactor, TwoFactorType},
DbConn,
};
use crate::error::{Error};
use crate::{crypto, mail};
use crate::error::Error;
use crate::mail;
use chrono::{Duration, NaiveDateTime, Utc};
use rand::Rng;
use std::char;
use std::ops::Add;
const TOTP_TIME_STEP: u64 = 120;
const MAX_TIME_DIFFERENCE: i64 = 600;
pub fn routes() -> Vec<Route> {
routes![get_email, send_email_login, send_email, email,]
routes![
get_email,
send_email_login,
send_email,
email,
]
}
#[derive(Deserialize)]
@ -27,7 +33,8 @@ struct SendEmailLoginData {
MasterPasswordHash: String,
}
// Does not require Bearer token
/// User is trying to login and wants to use email 2FA.
/// Does not require Bearer token
#[post("/two-factor/send-email-login", data = "<data>")] // JsonResult
fn send_email_login(data: JsonUpcase<SendEmailLoginData>, conn: DbConn) -> EmptyResult {
let data: SendEmailLoginData = data.into_inner().data;
@ -46,16 +53,15 @@ fn send_email_login(data: JsonUpcase<SendEmailLoginData>, conn: DbConn) -> Empty
}
let type_ = TwoFactorType::Email as i32;
let twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn)?;
let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn)?;
let twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
let generated_token = generate_token();
let mut twofactor_data = EmailTokenData::from_json(&twofactor.data)?;
twofactor_data.set_token(generated_token);
twofactor.data = twofactor_data.to_json();
twofactor.save(&conn)?;
let decoded_key = totp::validate_decode_key(&twofactor_data.totp_secret)?;
let generated_token = totp_raw_now(&decoded_key, 6, 0, TOTP_TIME_STEP, &HashType::SHA1);
let token_string = generated_token.to_string();
mail::send_token(&twofactor_data.email, &token_string)?;
mail::send_token(&twofactor_data.email, &twofactor_data.last_token?)?;
Ok(())
}
@ -75,7 +81,7 @@ fn get_email(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) ->
_ => false,
};
Ok(Json(json!({// TODO check! FIX!
Ok(Json(json!({
"Email": user.email,
"Enabled": enabled,
"Object": "twoFactorEmail"
@ -85,16 +91,26 @@ fn get_email(data: JsonUpcase<PasswordData>, headers: Headers, conn: DbConn) ->
#[derive(Deserialize)]
#[allow(non_snake_case)]
struct SendEmailData {
/// Email where 2FA codes will be sent to, can be different than user email account.
Email: String,
// Email where 2FA codes will be sent to, can be different than user email account.
MasterPasswordHash: String,
}
// Send a verification email to the specified email address to check whether it exists/belongs to user.
fn generate_token() -> String {
const TOKEN_LEN: usize = 6;
let mut rng = rand::thread_rng();
(0..TOKEN_LEN)
.map(|_| {
let num = rng.gen_range(0, 9);
char::from_digit(num, 10).unwrap()
})
.collect()
}
/// Send a verification email to the specified email address to check whether it exists/belongs to user.
#[post("/two-factor/send-email", data = "<data>")]
fn send_email(data: JsonUpcase<SendEmailData>, headers: Headers, conn: DbConn) -> EmptyResult {
use oath::{totp_raw_now, HashType};
let data: SendEmailData = data.into_inner().data;
let user = headers.user;
@ -104,16 +120,12 @@ fn send_email(data: JsonUpcase<SendEmailData>, headers: Headers, conn: DbConn) -
let type_ = TwoFactorType::Email as i32;
// TODO: Delete previous email thing.
match TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn) {
Some(tf) => tf.delete(&conn),
_ => Ok(()),
};
if let Some(tf) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn) {
tf.delete(&conn)?;
}
let secret = crypto::get_random(vec![0u8; 20]);
let base32_secret = BASE32.encode(&secret);
let twofactor_data = EmailTokenData::new(data.Email, base32_secret);
let generated_token = generate_token();
let twofactor_data = EmailTokenData::new(data.Email, generated_token);
// Uses EmailVerificationChallenge as type to show that it's not verified yet.
let twofactor = TwoFactor::new(
@ -123,10 +135,7 @@ fn send_email(data: JsonUpcase<SendEmailData>, headers: Headers, conn: DbConn) -
);
twofactor.save(&conn)?;
let generated_token = totp_raw_now(&secret, 6, 0, TOTP_TIME_STEP, &HashType::SHA1);
let token_string = generated_token.to_string();
mail::send_token(&twofactor_data.email, &token_string)?;
mail::send_token(&twofactor_data.email, &twofactor_data.last_token?)?;
Ok(())
}
@ -139,7 +148,7 @@ struct EmailData {
Token: String,
}
// Verify email used for 2FA email codes.
/// Verify email belongs to user and can be used for 2FA email codes.
#[put("/two-factor/email", data = "<data>")]
fn email(data: JsonUpcase<EmailData>, headers: Headers, conn: DbConn) -> JsonResult {
let data: EmailData = data.into_inner().data;
@ -149,19 +158,23 @@ fn email(data: JsonUpcase<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
err!("Invalid password");
}
let token_u64 = match data.Token.parse::<u64>() {
Ok(token) => token,
_ => err!("Could not parse token"),
};
let type_ = TwoFactorType::EmailVerificationChallenge as i32;
let mut twofactor = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn)?;
let email_data = EmailTokenData::from_json(&twofactor.data)?;
let mut email_data = EmailTokenData::from_json(&twofactor.data)?;
totp::validate_totp_code_with_time_step(token_u64, &email_data.totp_secret, TOTP_TIME_STEP)?;
let issued_token = match &email_data.last_token {
Some(t) => t,
_ => err!("No token available"),
};
if issued_token != &data.Token {
err!("Email token does not match")
}
email_data.reset_token();
twofactor.atype = TwoFactorType::Email as i32;
twofactor.data = email_data.to_json();
twofactor.save(&conn)?;
Ok(Json(json!({
@ -171,26 +184,26 @@ fn email(data: JsonUpcase<EmailData>, headers: Headers, conn: DbConn) -> JsonRes
})))
}
pub fn validate_email_code_str(code: &str, data: &str) -> EmptyResult {
let totp_code: u64 = match code.parse() {
Ok(code) => code,
_ => err!("Email code is not a number"),
/// Validate the email code when used as TwoFactor token mechanism
pub fn validate_email_code_str(user_uuid: &str, token: &str, data: &str, conn: &DbConn) -> EmptyResult {
let mut email_data = EmailTokenData::from_json(&data)?;
let mut twofactor = TwoFactor::find_by_user_and_type(&user_uuid, TwoFactorType::Email as i32, &conn)?;
let issued_token = match &email_data.last_token {
Some(t) => t,
_ => err!("No token available"),
};
validate_email_code(totp_code, data)
}
if issued_token != &*token {
err!("Email token does not match")
}
pub fn validate_email_code(code: u64, data: &str) -> EmptyResult {
let email_data = EmailTokenData::from_json(&data)?;
email_data.reset_token();
twofactor.data = email_data.to_json();
twofactor.save(&conn)?;
let decoded_secret = match BASE32.decode(email_data.totp_secret.as_bytes()) {
Ok(s) => s,
Err(_) => err!("Invalid email secret"),
};
let generated = totp_raw_now(&decoded_secret, 6, 0, TOTP_TIME_STEP, &HashType::SHA1);
if generated != code {
err!("Invalid email code");
let date = NaiveDateTime::from_timestamp(email_data.token_sent, 0);
if date.add(Duration::seconds(MAX_TIME_DIFFERENCE)) < Utc::now().naive_utc() {
err!("Email token too old")
}
Ok(())
@ -199,17 +212,28 @@ pub fn validate_email_code(code: u64, data: &str) -> EmptyResult {
#[derive(Serialize, Deserialize)]
pub struct EmailTokenData {
pub email: String,
pub totp_secret: String,
pub last_token: Option<String>,
pub token_sent: i64,
}
impl EmailTokenData {
pub fn new(email: String, totp_secret: String) -> EmailTokenData {
pub fn new(email: String, token: String) -> EmailTokenData {
EmailTokenData {
email,
totp_secret,
last_token: Some(token),
token_sent: Utc::now().naive_utc().timestamp(),
}
}
pub fn set_token(&mut self, token: String) {
self.last_token = Some(token);
self.token_sent = Utc::now().naive_utc().timestamp();
}
pub fn reset_token(&mut self) {
self.last_token = None;
}
pub fn to_json(&self) -> String {
serde_json::to_string(&self).unwrap()
}
@ -235,7 +259,7 @@ pub fn obscure_email(email: &str) -> String {
let new_name = match name_size {
1..=3 => "*".repeat(name_size),
_ => {
let stars = "*".repeat(name_size-2);
let stars = "*".repeat(name_size - 2);
name.truncate(2);
format!("{}{}", name, stars)
}

Datei anzeigen

@ -1,4 +1,4 @@
use data_encoding::{BASE32};
use data_encoding::BASE32;
use rocket::Route;
use rocket_contrib::json::Json;
use serde_json;
@ -8,8 +8,8 @@ use crate::api::{JsonResult, JsonUpcase, NumberOrString, PasswordData};
use crate::auth::Headers;
use crate::crypto;
use crate::db::{
DbConn,
models::{TwoFactor, User},
DbConn,
};
pub(crate) mod authenticator;
@ -17,7 +17,6 @@ pub(crate) mod duo;
pub(crate) mod email;
pub(crate) mod u2f;
pub(crate) mod yubikey;
pub(crate) mod totp;
pub fn routes() -> Vec<Route> {
let mut routes = routes![

Datei anzeigen

@ -1,46 +0,0 @@
use data_encoding::BASE32;
use crate::api::EmptyResult;
pub fn validate_totp_code_str(totp_code: &str, secret: &str) -> EmptyResult {
let totp_code: u64 = match totp_code.parse() {
Ok(code) => code,
_ => err!("TOTP code is not a number"),
};
validate_totp_code(totp_code, secret)
}
pub fn validate_totp_code(totp_code: u64, secret: &str) -> EmptyResult {
validate_totp_code_with_time_step(totp_code, &secret, 30)
}
pub fn validate_totp_code_with_time_step(totp_code: u64, secret: &str, time_step: u64) -> EmptyResult {
use oath::{totp_raw_now, HashType};
let decoded_secret = match BASE32.decode(secret.as_bytes()) {
Ok(s) => s,
Err(_) => err!("Invalid TOTP secret"),
};
let generated = totp_raw_now(&decoded_secret, 6, 0, time_step, &HashType::SHA1);
if generated != totp_code {
err!("Invalid TOTP code");
}
Ok(())
}
pub fn validate_decode_key(key: &str) -> Result<Vec<u8>, crate::error::Error> {
// Validate key as base32 and 20 bytes length
let decoded_key: Vec<u8> = match BASE32.decode(key.as_bytes()) {
Ok(decoded) => decoded,
_ => err!("Invalid totp secret"),
};
if decoded_key.len() != 20 {
err!("Invalid key length")
}
Ok(decoded_key)
}

Datei anzeigen

@ -6,15 +6,15 @@ use u2f::messages::{RegisterResponse, SignResponse, U2fSignRequest};
use u2f::protocol::{Challenge, U2f};
use u2f::register::Registration;
use crate::api::{ApiResult, EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData};
use crate::api::core::two_factor::_generate_recover_code;
use crate::api::{ApiResult, EmptyResult, JsonResult, JsonUpcase, NumberOrString, PasswordData};
use crate::auth::Headers;
use crate::CONFIG;
use crate::db::{
DbConn,
models::{TwoFactor, TwoFactorType},
DbConn,
};
use crate::error::{Error};
use crate::error::Error;
use crate::CONFIG;
const U2F_VERSION: &str = "U2F_V2";

Datei anzeigen

@ -16,7 +16,11 @@ use crate::error::{Error, MapResult};
use crate::CONFIG;
pub fn routes() -> Vec<Route> {
routes![generate_yubikey, activate_yubikey, activate_yubikey_put,]
routes![
generate_yubikey,
activate_yubikey,
activate_yubikey_put,
]
}
#[derive(Deserialize, Debug)]

Datei anzeigen

@ -4,15 +4,15 @@ use rocket::Route;
use rocket_contrib::json::Json;
use serde_json::Value;
use crate::api::{ApiResult, EmptyResult, JsonResult};
use crate::api::core::two_factor::{duo, email, yubikey};
use crate::api::core::two_factor::email::EmailTokenData;
use crate::api::core::two_factor::{duo, email, yubikey};
use crate::api::{ApiResult, EmptyResult, JsonResult};
use crate::auth::ClientIp;
use crate::CONFIG;
use crate::db::DbConn;
use crate::db::models::*;
use crate::db::DbConn;
use crate::mail;
use crate::util;
use crate::CONFIG;
pub fn routes() -> Vec<Route> {
routes![login]
@ -179,7 +179,10 @@ fn twofactor_auth(
None => err_json!(_json_err_twofactor(&twofactor_ids, user_uuid, conn)?),
};
let selected_twofactor = twofactors.into_iter().filter(|tf| tf.atype == selected_id && tf.enabled).nth(0);
let selected_twofactor = twofactors
.into_iter()
.filter(|tf| tf.atype == selected_id && tf.enabled)
.nth(0);
use crate::api::core::two_factor as _tf;
use crate::crypto::ct_eq;
@ -188,11 +191,11 @@ fn twofactor_auth(
let mut remember = data.two_factor_remember.unwrap_or(0);
match TwoFactorType::from_i32(selected_id) {
Some(TwoFactorType::Authenticator) => _tf::totp::validate_totp_code_str(twofactor_code, &selected_data?)?,
Some(TwoFactorType::Authenticator) => _tf::authenticator::validate_totp_code_str(twofactor_code, &selected_data?)?,
Some(TwoFactorType::U2f) => _tf::u2f::validate_u2f_login(user_uuid, twofactor_code, conn)?,
Some(TwoFactorType::YubiKey) => _tf::yubikey::validate_yubikey_login(twofactor_code, &selected_data?)?,
Some(TwoFactorType::Duo) => _tf::duo::validate_duo_login(data.username.as_ref().unwrap(), twofactor_code, conn)?,
Some(TwoFactorType::Email) => _tf::email::validate_email_code_str(twofactor_code, &selected_data?)?,
Some(TwoFactorType::Email) => _tf::email::validate_email_code_str(user_uuid, twofactor_code, &selected_data?, conn)?,
Some(TwoFactorType::Remember) => {
match device.twofactor_remember {

Datei anzeigen

@ -3,8 +3,8 @@ use diesel::prelude::*;
use serde_json::Value;
use crate::api::EmptyResult;
use crate::db::DbConn;
use crate::db::schema::twofactor;
use crate::db::DbConn;
use crate::error::MapResult;
use super::User;
@ -36,7 +36,6 @@ pub enum TwoFactorType {
U2fRegisterChallenge = 1000,
U2fLoginChallenge = 1001,
EmailVerificationChallenge = 1002,
}
/// Local methods