filters/simple-authentication.lua

   1 -- This script may be used with the auth-filter. Be sure to configure it as you wish.
   2 --
   3 -- Requirements:
   4 --      luacrypto >= 0.3
   5 --      <http://mkottman.github.io/luacrypto/>
   6 --
   7
   8
   9 --
  10 --
  11 -- Configure these variables for your settings.
  12 --
  13 --
  14
  15 -- A list of password protected repositories along with the users who can access them.
  16 local protected_repos = {
  17         glouglou        = { laurent = true, jason = true },
  18         qt              = { jason = true, bob = true }
  19 }
  20
  21 -- Please note that, in production, you'll want to replace this simple lookup
  22 -- table with either a table of salted and hashed passwords (using something
  23 -- smart like scrypt), or replace this table lookup with an external support,
  24 -- such as consulting your system's pam / shadow system, or an external
  25 -- database, or an external validating web service. For testing, or for
  26 -- extremely low-security usage, you may be able, however, to get away with
  27 -- compromising on hardcoding the passwords in cleartext, as we have done here.
  28 local users = {
  29         jason           = "secretpassword",
  30         laurent         = "s3cr3t",
  31         bob             = "ilikelua"
  32 }
  33
  34 -- All cookies will be authenticated based on this secret. Make it something
  35 -- totally random and impossible to guess. It should be large.
  36 local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM"
  37
  38
  39
  40 --
  41 --
  42 -- Authentication functions follow below. Swap these out if you want different authentication semantics.
  43 --
  44 --
  45
  46 -- Sets HTTP cookie headers based on post and sets up redirection.
  47 function authenticate_post()
  48         local password = users[post["username"]]
  49         local redirect = validate_value("redirect", post["redirect"])
  50
  51         if redirect == nil then
  52                 not_found()
  53                 return 0
  54         end
  55
  56         redirect_to(redirect)
  57
  58         -- Lua hashes strings, so these comparisons are time invariant.
  59         if password == nil or password ~= post["password"] then
  60                 set_cookie("cgitauth", "")
  61         else
  62                 -- One week expiration time
  63                 local username = secure_value("username", post["username"], os.time() + 604800)
  64                 set_cookie("cgitauth", username)
  65         end
  66
  67         html("\n")
  68         return 0
  69 end
  70
  71
  72 -- Returns 1 if the cookie is valid and 0 if it is not.
  73 function authenticate_cookie()
  74         accepted_users = protected_repos[cgit["repo"]]
  75         if accepted_users == nil then
  76                 -- We return as valid if the repo is not protected.
  77                 return 1
  78         end
  79
  80         local username = validate_value("username", get_cookie(http["cookie"], "cgitauth"))
  81         if username == nil or not accepted_users[username:lower()] then
  82                 return 0
  83         else
  84                 return 1
  85         end
  86 end
  87
  88 -- Prints the html for the login form.
  89 function body()
  90         html("<h2>Authentication Required</h2>")
  91         html("<form method='post' action='")
  92         html_attr(cgit["login"])
  93         html("'>")
  94         html("<input type='hidden' name='redirect' value='")
  95         html_attr(secure_value("redirect", cgit["url"], 0))
  96         html("' />")
  97         html("<table>")
  98         html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
  99         html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
 100         html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
 101         html("</table></form>")
 102
 103         return 0
 104 end
 105
 106
 107
 108 --
 109 --
 110 -- Wrapper around filter API, exposing the http table, the cgit table, and the post table to the above functions.
 111 --
 112 --
 113
 114 local actions = {}
 115 actions["authenticate-post"] = authenticate_post
 116 actions["authenticate-cookie"] = authenticate_cookie
 117 actions["body"] = body
 118
 119 function filter_open(...)
 120         action = actions[select(1, ...)]
 121
 122         http = {}
 123         http["cookie"] = select(2, ...)
 124         http["method"] = select(3, ...)
 125         http["query"] = select(4, ...)
 126         http["referer"] = select(5, ...)
 127         http["path"] = select(6, ...)
 128         http["host"] = select(7, ...)
 129         http["https"] = select(8, ...)
 130
 131         cgit = {}
 132         cgit["repo"] = select(9, ...)
 133         cgit["page"] = select(10, ...)
 134         cgit["url"] = select(11, ...)
 135         cgit["login"] = select(12, ...)
 136
 137 end
 138
 139 function filter_close()
 140         return action()
 141 end
 142
 143 function filter_write(str)
 144         post = parse_qs(str)
 145 end
 146
 147
 148 --
 149 --
 150 -- Utility functions based on keplerproject/wsapi.
 151 --
 152 --
 153
 154 function url_decode(str)
 155         if not str then
 156                 return ""
 157         end
 158         str = string.gsub(str, "+", " ")
 159         str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
 160         str = string.gsub(str, "\r\n", "\n")
 161         return str
 162 end
 163
 164 function url_encode(str)
 165         if not str then
 166                 return ""
 167         end
 168         str = string.gsub(str, "\n", "\r\n")
 169         str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
 170         str = string.gsub(str, " ", "+")
 171         return str
 172 end
 173
 174 function parse_qs(qs)
 175         local tab = {}
 176         for key, val in string.gmatch(qs, "([^&=]+)=([^&=]*)&?") do
 177                 tab[url_decode(key)] = url_decode(val)
 178         end
 179         return tab
 180 end
 181
 182 function get_cookie(cookies, name)
 183         cookies = string.gsub(";" .. cookies .. ";", "%s*;%s*", ";")
 184         return url_decode(string.match(cookies, ";" .. name .. "=(.-);"))
 185 end
 186
 187
 188 --
 189 --
 190 -- Cookie construction and validation helpers.
 191 --
 192 --
 193
 194 local crypto = require("crypto")
 195
 196 -- Returns value of cookie if cookie is valid. Otherwise returns nil.
 197 function validate_value(expected_field, cookie)
 198         local i = 0
 199         local value = ""
 200         local field = ""
 201         local expiration = 0
 202         local salt = ""
 203         local hmac = ""
 204
 205         if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
 206                 return nil
 207         end
 208
 209         for component in string.gmatch(cookie, "[^|]+") do
 210                 if i == 0 then
 211                         field = component
 212                 elseif i == 1 then
 213                         value = component
 214                 elseif i == 2 then
 215                         expiration = tonumber(component)
 216                         if expiration == nil then
 217                                 expiration = -1
 218                         end
 219                 elseif i == 3 then
 220                         salt = component
 221                 elseif i == 4 then
 222                         hmac = component
 223                 else
 224                         break
 225                 end
 226                 i = i + 1
 227         end
 228
 229         if hmac == nil or hmac:len() == 0 then
 230                 return nil
 231         end
 232
 233         -- Lua hashes strings, so these comparisons are time invariant.
 234         if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
 235                 return nil
 236         end
 237
 238         if expiration == -1 or (expiration ~= 0 and expiration <= os.time()) then
 239                 return nil
 240         end
 241
 242         if url_decode(field) ~= expected_field then
 243                 return nil
 244         end
 245
 246         return url_decode(value)
 247 end
 248
 249 function secure_value(field, value, expiration)
 250         if value == nil or value:len() <= 0 then
 251                 return ""
 252         end
 253
 254         local authstr = ""
 255         local salt = crypto.hex(crypto.rand.bytes(16))
 256         value = url_encode(value)
 257         field = url_encode(field)
 258         authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
 259         authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
 260         return authstr
 261 end
 262
 263 function set_cookie(cookie, value)
 264         html("Set-Cookie: " .. cookie .. "=" .. value .. "; HttpOnly")
 265         if http["https"] == "yes" or http["https"] == "on" or http["https"] == "1" then
 266                 html("; secure")
 267         end
 268         html("\n")
 269 end
 270
 271 function redirect_to(url)
 272         html("Status: 302 Redirect\n")
 273         html("Cache-Control: no-cache, no-store\n")
 274         html("Location: " .. url .. "\n")
 275 end
 276
 277 function not_found()
 278         html("Status: 404 Not Found\n")
 279         html("Cache-Control: no-cache, no-store\n\n")
 280 end