git.sip-router.org Git - sip-router/blob - src/modules/auth_ephemeral/authorize.c

   1 /*
   2  * $Id$
   3  *
   4  * Copyright (C) 2013 Crocodile RCS Ltd
   5  * Copyright (C) 2017 ng-voice GmbH
   6  *
   7  * This file is part of Kamailio, a free SIP server.
   8  *
   9  * Kamailio is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version
  13  *
  14  * Kamailio is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  22  *
  23  * Exception: permission to copy, modify, propagate, and distribute a work
  24  * formed by combining OpenSSL toolkit software and the code in this file,
  25  * such as linking with software components and libraries released under
  26  * OpenSSL project license.
  27  *
  28  */
  29 #include <openssl/hmac.h>
  30 #include <openssl/sha.h>
  31
  32 #include "../../core/basex.h"
  33 #include "../../core/dprint.h"
  34 #include "../../core/mod_fix.h"
  35 #include "../../core/str.h"
  36 #include "../../core/ut.h"
  37 #include "../../core/parser/digest/digest.h"
  38 #include "../../core/parser/hf.h"
  39 #include "../../core/mod_fix.h"
  40
  41 #include "auth_ephemeral_mod.h"
  42 #include "authorize.h"
  43
  44 static inline int get_pass(str *_username, str *_secret, str *_password)
  45 {
  46         unsigned int hmac_len = SHA_DIGEST_LENGTH;
  47         unsigned char hmac_sha1[512];
  48
  49         switch(autheph_sha_alg) {
  50                 case AUTHEPH_SHA1:
  51                         hmac_len = SHA_DIGEST_LENGTH;
  52                         if (HMAC(EVP_sha1(), _secret->s, _secret->len,
  53                                         (unsigned char *) _username->s,
  54                                         _username->len, hmac_sha1, &hmac_len) == NULL)
  55                         {
  56                                 LM_ERR("HMAC-SHA1 failed\n");
  57                                 return -1;
  58                         }
  59                         break;
  60                 case AUTHEPH_SHA256:
  61                         hmac_len = SHA256_DIGEST_LENGTH;
  62                         if (HMAC(EVP_sha256(), _secret->s, _secret->len,
  63                                         (unsigned char *) _username->s,
  64                                         _username->len, hmac_sha1, &hmac_len) == NULL)
  65                         {
  66                                 LM_ERR("HMAC-SHA256 failed\n");
  67                                 return -1;
  68                         }
  69                         break;
  70                 case AUTHEPH_SHA384:
  71                         hmac_len = SHA384_DIGEST_LENGTH;
  72                         if (HMAC(EVP_sha256(), _secret->s, _secret->len,
  73                                         (unsigned char *) _username->s,
  74                                         _username->len, hmac_sha1, &hmac_len) == NULL)
  75                         {
  76                                 LM_ERR("HMAC-SHA256 failed\n");
  77                                 return -1;
  78                         }
  79                         break;
  80                 case AUTHEPH_SHA512:
  81                         hmac_len = SHA512_DIGEST_LENGTH;
  82                         if (HMAC(EVP_sha512(), _secret->s, _secret->len,
  83                                         (unsigned char *) _username->s,
  84                                         _username->len, hmac_sha1, &hmac_len) == NULL)
  85                         {
  86                                 LM_ERR("HMAC-SHA512 failed\n");
  87                                 return -1;
  88                         }
  89                         break;
  90                 default:
  91                         LM_ERR("Inavlid SHA Algorithm\n");
  92                         return -1;
  93
  94         }
  95
  96         LM_DBG("HMAC-Len (%i)\n", hmac_len);
  97
  98
  99         _password->len = base64_enc(hmac_sha1, hmac_len,
 100                                         (unsigned char *) _password->s,
 101                                         base64_enc_len(hmac_len));
 102         LM_DBG("calculated password: %.*s (%i)\n", _password->len, _password->s, _password->len);
 103
 104         return 0;
 105 }
 106
 107 static inline int get_ha1(struct username *_username, str *_domain,
 108                                 str *_secret, char *_ha1)
 109 {
 110         char password[base64_enc_len(SHA512_DIGEST_LENGTH)];
 111         str spassword;
 112
 113         spassword.s = (char *) password;
 114         spassword.len = 0;
 115
 116         if (get_pass(&_username->whole, _secret, &spassword) < 0)
 117         {
 118                 LM_ERR("calculating password\n");
 119                 return -1;
 120         }
 121
 122         eph_auth_api.calc_HA1(HA_MD5, &_username->whole, _domain, &spassword,
 123                                 0, 0, _ha1);
 124         LM_DBG("calculated HA1: %s\n", _ha1);
 125
 126         return 0;
 127 }
 128
 129 static inline int do_auth(struct sip_msg *_m, struct hdr_field *_h, str *_realm,
 130                         str *_method, str *_secret)
 131 {
 132         auth_result_t ret;
 133         char ha1[512];
 134         auth_body_t *cred = (auth_body_t*) _h->parsed;
 135
 136         LM_DBG("secret: %.*s (%i)\n", _secret->len, _secret->s, _secret->len);
 137
 138         if (get_ha1(&cred->digest.username, _realm, _secret, ha1) < 0)
 139         {
 140                 LM_ERR("calculating HA1\n");
 141                 return AUTH_ERROR;
 142         }
 143
 144         LM_DBG("HA1: %i\n", (int)strlen(ha1));
 145
 146         ret = eph_auth_api.check_response(&cred->digest, _method, ha1);
 147         if (ret == AUTHENTICATED)
 148         {
 149                 if (eph_auth_api.post_auth(_m, _h, ha1) != AUTHENTICATED) {
 150                         return AUTH_ERROR;
 151                 }
 152                 return AUTH_OK;
 153         } else if (ret == NOT_AUTHENTICATED) {
 154                 return AUTH_INVALID_PASSWORD;
 155         } else {
 156                 return AUTH_ERROR;
 157         }
 158 }
 159
 160 int autheph_verify_timestamp(str *_username)
 161 {
 162         int pos = 0, cur_time = (int) time(NULL);
 163         unsigned int expires;
 164         str time_str = {0, 0};
 165
 166         while (pos < _username->len && _username->s[pos] != ':')
 167                 pos++;
 168
 169         if (autheph_username_format == AUTHEPH_USERNAME_NON_IETF)
 170         {
 171                 if (pos < _username->len - 1)
 172                 {
 173                         time_str.s = _username->s + pos + 1;
 174                         time_str.len = _username->len - pos - 1;
 175                 }
 176                 else
 177                 {
 178                         time_str.s = _username->s;
 179                         time_str.len = _username->len;
 180                 }
 181         }
 182         else
 183         {
 184                 time_str.s = _username->s;
 185                 if (pos < _username->len - 1)
 186                 {
 187                         time_str.len = pos;
 188                 }
 189                 else
 190                 {
 191                         time_str.len = _username->len;
 192                 }
 193         }
 194
 195         LM_DBG("username timestamp: %.*s\n", time_str.len, time_str.s);
 196         if (str2int(&time_str, &expires) < 0)
 197         {
 198                 LM_ERR("unable to convert timestamp to int\n");
 199                 return -1;
 200         }
 201
 202         LM_DBG("current time: %d\n", cur_time);
 203         if (cur_time > expires)
 204         {
 205                 LM_WARN("username has expired\n");
 206                 return -1;
 207         }
 208
 209         return 0;
 210 }
 211
 212 static inline int digest_authenticate(struct sip_msg *_m, str *_realm,
 213                                 hdr_types_t _hftype, str *_method)
 214 {
 215         struct hdr_field* h;
 216         auth_cfg_result_t ret;
 217         auth_result_t rauth;
 218         struct secret *secret_struct;
 219         str username;
 220
 221         LM_DBG("realm: %.*s\n", _realm->len, _realm->s);
 222         LM_DBG("method: %.*s\n", _method->len, _method->s);
 223
 224         rauth = eph_auth_api.pre_auth(_m, _realm, _hftype, &h, NULL);
 225         switch(rauth)
 226         {
 227         case NONCE_REUSED:
 228                 LM_DBG("nonce reused\n");
 229                 return AUTH_NONCE_REUSED;
 230         case STALE_NONCE:
 231                 LM_DBG("stale nonce\n");
 232                 return AUTH_STALE_NONCE;
 233         case NO_CREDENTIALS:
 234                 LM_DBG("no credentials\n");
 235                 return AUTH_NO_CREDENTIALS;
 236         case ERROR:
 237         case BAD_CREDENTIALS:
 238                 LM_DBG("error or bad credentials\n");
 239                 return AUTH_ERROR;
 240         case CREATE_CHALLENGE:
 241                 LM_ERR("CREATE_CHALLENGE is not a valid state\n");
 242                 return AUTH_ERROR;
 243         case DO_RESYNCHRONIZATION:
 244                 LM_ERR("DO_RESYNCHRONIZATION is not a valid state\n");
 245                 return AUTH_ERROR;
 246         case NOT_AUTHENTICATED:
 247                 LM_DBG("not authenticated\n");
 248                 return AUTH_ERROR;
 249         case DO_AUTHENTICATION:
 250                 break;
 251         case AUTHENTICATED:
 252                 return AUTH_OK;
 253         }
 254
 255         username = ((auth_body_t *) h->parsed)->digest.username.whole;
 256         LM_DBG("username: %.*s\n", username.len, username.s);
 257
 258         if (autheph_verify_timestamp(&username) < 0)
 259         {
 260                 LM_ERR("invalid timestamp in username\n");
 261                 return AUTH_ERROR;
 262         }
 263
 264         SECRET_LOCK;
 265         secret_struct = secret_list;
 266         while (secret_struct != NULL)
 267         {
 268                 ret = do_auth(_m, h, _realm, _method,
 269                                 &secret_struct->secret_key);
 270                 if (ret == AUTH_OK)
 271                 {
 272                         break;
 273                 }
 274                 secret_struct = secret_struct->next;
 275         }
 276         SECRET_UNLOCK;
 277
 278         return ret;
 279 }
 280
 281 int autheph_check(struct sip_msg *_m, char *_realm)
 282 {
 283         str srealm;
 284
 285         if (eph_auth_api.pre_auth == NULL)
 286         {
 287                 LM_ERR("autheph_check() cannot be used without the auth "
 288                         "module\n");
 289                 return AUTH_ERROR;
 290         }
 291
 292         if(_m == NULL || _realm == NULL)
 293         {
 294                 LM_ERR("invalid parameters\n");
 295                 return AUTH_ERROR;
 296         }
 297
 298         if (_m->REQ_METHOD == METHOD_ACK || _m->REQ_METHOD == METHOD_CANCEL)
 299         {
 300                 return AUTH_OK;
 301         }
 302
 303         if (get_str_fparam(&srealm, _m, (fparam_t*)_realm) < 0)
 304         {
 305                 LM_ERR("failed to get realm value\n");
 306                 return AUTH_ERROR;
 307         }
 308
 309         if (srealm.len == 0)
 310         {
 311                 LM_ERR("invalid realm parameter - empty value\n");
 312                 return AUTH_ERROR;
 313         }
 314
 315         if (_m->REQ_METHOD == METHOD_REGISTER)
 316         {
 317                 return digest_authenticate(_m, &srealm, HDR_AUTHORIZATION_T,
 318                                         &_m->first_line.u.request.method);
 319         }
 320         else
 321         {
 322                 return digest_authenticate(_m, &srealm, HDR_PROXYAUTH_T,
 323                                         &_m->first_line.u.request.method);
 324         }
 325 }
 326
 327 int autheph_www(struct sip_msg *_m, char *_realm)
 328 {
 329         str srealm;
 330
 331         if (eph_auth_api.pre_auth == NULL)
 332         {
 333                 LM_ERR("autheph_www() cannot be used without the auth "
 334                         "module\n");
 335                 return AUTH_ERROR;
 336         }
 337
 338         if(_m == NULL || _realm == NULL)
 339         {
 340                 LM_ERR("invalid parameters\n");
 341                 return AUTH_ERROR;
 342         }
 343
 344         if (_m->REQ_METHOD == METHOD_ACK || _m->REQ_METHOD == METHOD_CANCEL)
 345         {
 346                 return AUTH_OK;
 347         }
 348
 349         if (get_str_fparam(&srealm, _m, (fparam_t*)_realm) < 0)
 350         {
 351                 LM_ERR("failed to get realm value\n");
 352                 return AUTH_ERROR;
 353         }
 354
 355         if (srealm.len == 0)
 356         {
 357                 LM_ERR("invalid realm parameter - empty value\n");
 358                 return AUTH_ERROR;
 359         }
 360
 361         return digest_authenticate(_m, &srealm, HDR_AUTHORIZATION_T,
 362                                         &_m->first_line.u.request.method);
 363 }
 364
 365 int autheph_www2(struct sip_msg *_m, char *_realm, char *_method)
 366 {
 367         str srealm;
 368         str smethod;
 369
 370         if (eph_auth_api.pre_auth == NULL)
 371         {
 372                 LM_ERR("autheph_www() cannot be used without the auth "
 373                         "module\n");
 374                 return AUTH_ERROR;
 375         }
 376
 377         if(_m == NULL || _realm == NULL)
 378         {
 379                 LM_ERR("invalid parameters\n");
 380                 return AUTH_ERROR;
 381         }
 382
 383         if (_m->REQ_METHOD == METHOD_ACK || _m->REQ_METHOD == METHOD_CANCEL)
 384         {
 385                 return AUTH_OK;
 386         }
 387
 388         if (get_str_fparam(&srealm, _m, (fparam_t*)_realm) < 0)
 389         {
 390                 LM_ERR("failed to get realm value\n");
 391                 return AUTH_ERROR;
 392         }
 393
 394         if (srealm.len == 0)
 395         {
 396                 LM_ERR("invalid realm parameter - empty value\n");
 397                 return AUTH_ERROR;
 398         }
 399
 400         if (get_str_fparam(&smethod, _m, (fparam_t*)_method) < 0)
 401         {
 402                 LM_ERR("failed to get method value\n");
 403                 return AUTH_ERROR;
 404         }
 405
 406         if (smethod.len == 0)
 407         {
 408                 LM_ERR("invalid method value - empty value\n");
 409                 return AUTH_ERROR;
 410         }
 411
 412         return digest_authenticate(_m, &srealm, HDR_AUTHORIZATION_T, &smethod);
 413 }
 414
 415 int autheph_proxy(struct sip_msg *_m, char *_realm)
 416 {
 417         str srealm;
 418
 419         if (eph_auth_api.pre_auth == NULL)
 420         {
 421                 LM_ERR("autheph_proxy() cannot be used without the auth "
 422                         "module\n");
 423                 return AUTH_ERROR;
 424         }
 425
 426         if(_m == NULL || _realm == NULL)
 427         {
 428                 LM_ERR("invalid parameters\n");
 429                 return AUTH_ERROR;
 430         }
 431
 432         if (_m->REQ_METHOD == METHOD_ACK || _m->REQ_METHOD == METHOD_CANCEL)
 433         {
 434                 return AUTH_OK;
 435         }
 436
 437         if (get_str_fparam(&srealm, _m, (fparam_t*)_realm) < 0)
 438         {
 439                 LM_ERR("failed to get realm value\n");
 440                 return AUTH_ERROR;
 441         }
 442
 443         if (srealm.len == 0)
 444         {
 445                 LM_ERR("invalid realm parameter - empty value\n");
 446                 return AUTH_ERROR;
 447         }
 448
 449         return digest_authenticate(_m, &srealm, HDR_PROXYAUTH_T,
 450                                         &_m->first_line.u.request.method);
 451 }
 452
 453 int autheph_authenticate(struct sip_msg *_m, char *_username, char *_password)
 454 {
 455         str susername, spassword;
 456         char generated_password[base64_enc_len(SHA_DIGEST_LENGTH)];
 457         str sgenerated_password;
 458         struct secret *secret_struct;
 459
 460         if (_m == NULL || _username == NULL || _password == NULL)
 461         {
 462                 LM_ERR("invalid parameters\n");
 463                 return AUTH_ERROR;
 464         }
 465
 466         if (get_str_fparam(&susername, _m, (fparam_t*)_username) < 0)
 467         {
 468                 LM_ERR("failed to get username value\n");
 469                 return AUTH_ERROR;
 470         }
 471
 472         if (susername.len == 0)
 473         {
 474                 LM_ERR("invalid username parameter - empty value\n");
 475                 return AUTH_ERROR;
 476         }
 477
 478         if (get_str_fparam(&spassword, _m, (fparam_t*)_password) < 0)
 479         {
 480                 LM_ERR("failed to get password value\n");
 481                 return AUTH_ERROR;
 482         }
 483
 484         if (spassword.len == 0)
 485         {
 486                 LM_ERR("invalid password parameter - empty value\n");
 487                 return AUTH_ERROR;
 488         }
 489
 490         if (autheph_verify_timestamp(&susername) < 0)
 491         {
 492                 LM_ERR("invalid timestamp in username\n");
 493                 return AUTH_ERROR;
 494         }
 495
 496         LM_DBG("username: %.*s\n", susername.len, susername.s);
 497         LM_DBG("password: %.*s\n", spassword.len, spassword.s);
 498
 499         sgenerated_password.s = generated_password;
 500         SECRET_LOCK;
 501         secret_struct = secret_list;
 502         while (secret_struct != NULL)
 503         {
 504                 LM_DBG("trying secret: %.*s\n",
 505                         secret_struct->secret_key.len,
 506                         secret_struct->secret_key.s);
 507                 if (get_pass(&susername, &secret_struct->secret_key,
 508                                 &sgenerated_password) == 0)
 509                 {
 510                         LM_DBG("generated password: %.*s\n",
 511                                 sgenerated_password.len, sgenerated_password.s);
 512                         if (strncmp(spassword.s, sgenerated_password.s,
 513                                         spassword.len) == 0)
 514                         {
 515                                 SECRET_UNLOCK;
 516                                 return AUTH_OK;
 517                         }
 518                 }
 519                 secret_struct = secret_struct->next;
 520         }
 521         SECRET_UNLOCK;
 522
 523         return AUTH_ERROR;
 524 }