owen/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Various fixes + refacto

Browse Source
This commit is contained in:
emeric
2020-07-05 15:15:51 +02:00
parent c67e54aead
commit 50b0fd1cb8
21 changed files with 390 additions and 196 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libs/auth/CMakeLists.txt
+5
View File
@@ -25,5 +25,10 @@ target_link_libraries(lmsauth PUBLIC
${PAM_LIBRARIES}
)
if (PAM_FOUND)
target_compile_options(lmsauth PRIVATE "-DLMS_SUPPORT_PAM")
target_sources(lmsauth PRIVATE impl/pam/PAM.cpp)
endif(PAM_FOUND)
install(TARGETS lmsauth DESTINATION lib)
src/libs/auth/impl/LoginThrottler.hpp
-2
View File
@@ -17,8 +17,6 @@
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#pragma once
#include <shared_mutex>
src/libs/auth/impl/PasswordService.cpp
+32 -96
View File
@@ -26,8 +26,9 @@
#include "database/Session.hpp"
#include "utils/Exception.hpp"
#include "utils/Logger.hpp"
#include <security/pam_appl.h>
#ifdef LMS_SUPPORT_PAM
#include "pam/PAM.hpp"
#endif
namespace Auth {
@@ -41,101 +42,29 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
{
}
#ifdef USEPAM
static void
delete_resp(int num_msg, pam_response *response)
bool
PasswordService::isAuthModeSupported(Database::User::AuthMode authMode) const
{
if (response == nullptr)
return;
for (int i = 0; i < num_msg; i++) {
if (response[i].resp) {
/* clear before freeing -- might be a password */
bzero(response[i].resp, strlen(response[i].resp));
free(response[i].resp);
response[i].resp = nullptr;
}
}
}
struct pam_conv_data
{
const char *username;
const char *password;
};
static
int lms_conv(int num_msg, const pam_message** msgs, pam_response** resps, void* appdata_ptr)
{
if(num_msg < 1)
return PAM_CONV_ERR;
if (!resps || !msgs || !appdata_ptr)
return PAM_CONV_ERR;
pam_conv_data *data = static_cast<pam_conv_data*>( appdata_ptr );
pam_response *response = new (std::nothrow) pam_response[num_msg];
if(!response)
return PAM_CONV_ERR;
for(int i = 0; i < num_msg; ++i)
switch (authMode)
{
response[i].resp_retcode = 0;
response[i].resp = 0;
switch (msgs[i]->msg_style) {
case PAM_PROMPT_ECHO_ON:
/* on memory allocation failure, auth fails */
response[i].resp = strdup(data->username);
break;
case PAM_PROMPT_ECHO_OFF:
response[i].resp = strdup(data->password);
break;
case PAM_ERROR_MSG:
case PAM_TEXT_INFO:
default:
delete_resp(i, response);
return PAM_CONV_ERR;
}
}
*resps = response;
return PAM_SUCCESS;
}
#endif
case Database::User::AuthMode::Internal:
return true;
static bool
pamCheckUserPassword(const std::string& loginName, const std::string& password)
{
#ifdef USEPAM
pam_conv_data authdata{loginName.c_str(), password.c_str()};
pam_conv conv = { lms_conv, &authdata };
pam_handle_t *pamh;
bool authenticated{false};
/* Initialize PAM framework */
int err = pam_start("lms", loginName.c_str(), &conv, &pamh);
if (err != PAM_SUCCESS) {
return false;
}
err = pam_authenticate(pamh, 0);
if(err == PAM_SUCCESS)
{
/* Make sure account and password are still valid */
err = pam_acct_mgmt(pamh, PAM_SILENT);
authenticated = err == PAM_SUCCESS;
}
(void) pam_end(pamh, 0);
return authenticated;
case Database::User::AuthMode::PAM:
#ifdef LMS_SUPPORT_PAM
return true;
#else
return false;
return false;
#endif
}
return false;
}
static
bool
checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
{
bool hasExternalAuth;
Database::User::AuthMode authMode;
Database::User::PasswordHash passwordHash;
{
auto transaction {session.createSharedTransaction()};
@@ -144,21 +73,28 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
if (!user)
return false;
hasExternalAuth = user->hasExternalAuth();
authMode = user->getAuthMode();
passwordHash = user->getPasswordHash();
}
if (hasExternalAuth)
switch (authMode)
{
return pamCheckUserPassword(loginName, password);
}
else
{
const Wt::Auth::BCryptHashFunction hashFunc {6};
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
}
case Database::User::AuthMode::Internal:
{
const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
case Database::User::AuthMode::PAM:
#ifdef LMS_SUPPORT_PAM
return PAM::checkUserPassword(loginName, password);
#else
return false;
#endif
}
return false;
}
PasswordService::PasswordCheckResult
PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
src/libs/auth/impl/PasswordService.hpp
+2 -3
View File
@@ -46,14 +46,13 @@ namespace Auth {
PasswordService(PasswordService&&) = delete;
PasswordService& operator=(PasswordService&&) = delete;
private:
// Password services
bool isAuthModeSupported(Database::User::AuthMode authMode) const;
PasswordCheckResult checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) override;
Database::User::PasswordHash hashPassword(const std::string& password) const override;
bool evaluatePasswordStrength(const std::string& loginName, const std::string& password) const override;
private:
std::shared_timed_mutex _mutex;
LoginThrottler _loginThrottler;
};
src/libs/auth/impl/pam/PAM.cpp
+177
View File
@@ -0,0 +1,177 @@
/*
* Copyright (C) 2019 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
#include "PAM.hpp"
#include <cstring>
#include "utils/Exception.hpp"
#include "utils/Logger.hpp"
#include <security/pam_appl.h>
namespace Auth::PAM
{
static
void
freeResp(int num_msg, pam_response *response)
{
if (response == nullptr)
return;
for (int i = 0; i < num_msg; i++)
{
if (response[i].resp)
{
memset(response[i].resp, 0, strlen(response[i].resp));
free(response[i].resp);
response[i].resp = nullptr;
}
}
free(response);
}
struct PAMConvData
{
std::string loginName;
std::string password;
};
static
int
lms_conv(int msgCount, const pam_message** msgs, pam_response** resps, void* userData)
{
if (msgCount < 1)
return PAM_CONV_ERR;
if (!resps || !msgs || !userData)
return PAM_CONV_ERR;
const PAMConvData& convData {*static_cast<const PAMConvData*>(userData)};
pam_response* response {static_cast<pam_response*>(malloc(sizeof(pam_response) * msgCount))};
if (!response)
return PAM_CONV_ERR;
for (int i {}; i < msgCount; ++i)
{
response[i].resp_retcode = 0;
response[i].resp = nullptr;
switch (msgs[i]->msg_style)
{
case PAM_PROMPT_ECHO_ON:
// on memory allocation failure, auth fails
response[i].resp = strdup(convData.loginName.c_str());
break;
case PAM_PROMPT_ECHO_OFF:
response[i].resp = strdup(convData.password.c_str());
break;
case PAM_ERROR_MSG:
case PAM_TEXT_INFO:
default:
freeResp(i, response);
return PAM_CONV_ERR;
}
}
*resps = response;
return PAM_SUCCESS;
}
class PAMError
{
public:
PAMError(std::string_view msg, pam_handle_t *pamh, int err)
{
_errorMsg = std::string {msg} + ": " + pam_strerror(pamh, err);
}
std::string_view message() const { return _errorMsg; }
private:
std::string _errorMsg;
};
class PAMContext
{
public:
PAMContext(std::string_view loginName)
: _convData {std::string {loginName}, {}}
{
int err {pam_start("lms", _convData.loginName.c_str(), &_conv, &_pamh)};
if (err != PAM_SUCCESS)
throw PAMError {"start failed", _pamh, err};
}
~PAMContext()
{
int err {pam_end(_pamh, 0)};
if (err != PAM_SUCCESS)
LMS_LOG(AUTH, ERROR) << "end failed: " << pam_strerror(_pamh, err);
}
void authenticate(const std::string& password)
{
_convData.password = password;
int err {pam_authenticate(_pamh, 0)};
_convData.password.clear();
if(err != PAM_SUCCESS)
throw PAMError {"authenticate failed", _pamh, err};
}
void validateAccount()
{
int err {pam_acct_mgmt(_pamh, PAM_SILENT)};
if (err != PAM_SUCCESS)
throw PAMError {"acct_mgmt failed", _pamh, err};
}
private:
PAMConvData _convData;
pam_conv _conv {lms_conv, &_convData};
pam_handle_t *_pamh {};
};
bool
checkUserPassword(const std::string& loginName, const std::string& password)
{
try
{
PAMContext pamContext {loginName};
pamContext.authenticate(password);
pamContext.validateAccount();
return true;
}
catch (const PAMError& error)
{
LMS_LOG(AUTH, ERROR) << "PAM error: " << error.message();
return false;
}
}
} // namespace Auth::PAM
src/libs/auth/impl/pam/PAM.hpp
+32
View File
@@ -0,0 +1,32 @@
/*
* Copyright (C) 2020 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
#pragma once
#ifdef LMS_SUPPORT_PAM
#include <string>
namespace Auth::PAM
{
bool checkUserPassword(const std::string& loginName, const std::string& password);
}
#endif // LMS_SUPPORT_PAM
src/libs/auth/include/auth/IPasswordService.hpp
+3
View File
@@ -48,6 +48,9 @@ namespace Auth {
Mismatch,
Throttled,
};
virtual bool isAuthModeSupported(Database::User::AuthMode authMode) const = 0;
virtual PasswordCheckResult checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) = 0;
virtual Database::User::PasswordHash hashPassword(const std::string& password) const = 0;
virtual bool evaluatePasswordStrength(const std::string& loginName, const std::string& password) const = 0;
src/libs/database/impl/Session.cpp
+7 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2013 Emeric Poupon
auth_mode(C) 2013 Emeric Poupon
*
* This file is part of LMS.
*
@@ -40,7 +40,7 @@
namespace Database {
#define LMS_DATABASE_VERSION 24
#define LMS_DATABASE_VERSION 25
using Version = std::size_t;
@@ -267,6 +267,11 @@ CREATE TABLE "user_backup" (
// Just increment the scan version of the settings to make the next scheduled scan rescan everything
ScanSettings::get(*this).modify()->incScanVersion();
}
else if (version == 24)
{
// User's AuthMode
_session.execute("ALTER TABLE user ADD auth_mode INTEGER NOT NULL DEFAULT(" + std::to_string(static_cast<int>(User::defaultAuthMode)) + ")");
}
else
{
LMS_LOG(DB, ERROR) << "Database version " << version << " cannot be handled using migration";
src/libs/database/impl/User.cpp
+3 -5
View File
@@ -70,10 +70,8 @@ AuthToken::getByValue(Session& session, const std::string& value)
static const std::string playedListName {"__played_tracks__"};
static const std::string queuedListName {"__queued_tracks__"};
User::User(const std::string& loginName, const PasswordHash& passwordHash)
User::User(const std::string& loginName)
: _loginName {loginName}
, _passwordSalt {passwordHash.salt}
, _passwordHash {passwordHash.hash}
{
}
@@ -96,11 +94,11 @@ User::getDemo(Session& session)
}
User::pointer
User::create(Session& session, const std::string& loginName, const PasswordHash& passwordHash)
User::create(Session& session, const std::string& loginName)
{
session.checkUniqueLocked();
User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName, passwordHash))};
User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName))};
TrackList::create(session, playedListName, TrackList::Type::Internal, false, user);
TrackList::create(session, queuedListName, TrackList::Type::Internal, false, user);
src/libs/database/include/database/User.hpp
+13 -7
View File
@@ -100,6 +100,12 @@ class User : public Wt::Dbo::Dbo<User>
DEMO = 2,
};
enum class AuthMode
{
Internal = 0,
PAM = 1,
};
struct PasswordHash
{
std::string salt;
@@ -137,13 +143,14 @@ class User : public Wt::Dbo::Dbo<User>
static inline const Bitrate defaultSubsonicTranscodeBitrate {128000};
static inline const UITheme defaultUITheme {UITheme::Dark};
static inline const SubsonicArtistListMode defaultSubsonicArtistListMode {SubsonicArtistListMode::AllArtists};
static inline const AuthMode defaultAuthMode {AuthMode::Internal};
User() = default;
User(const std::string& loginName, const PasswordHash& passwordHash);
User(const std::string& loginName);
// utility
static pointer create(Session& session, const std::string& loginName, const PasswordHash& passwordHash);
static pointer create(Session& session, const std::string& loginName);
static pointer getById(Session& session, IdType id);
static pointer getByLoginName(Session& session, const std::string& loginName);
@@ -165,7 +172,7 @@ class User : public Wt::Dbo::Dbo<User>
void setSubsonicTranscodeBitrate(Bitrate bitrate);
void setCurPlayingTrackPos(std::size_t pos) { _curPlayingTrackPos = pos; }
void setRadio(bool val) { _radio = val; }
void setExternalAuth(bool val) { _externalAuth = val; }
void setAuthMode(AuthMode mode) { _authMode = mode;}
void setRepeatAll(bool val) { _repeatAll = val; }
void setUITheme(UITheme uiTheme) { _uiTheme = uiTheme; }
void clearAuthTokens();
@@ -180,7 +187,7 @@ class User : public Wt::Dbo::Dbo<User>
std::size_t getCurPlayingTrackPos() const { return _curPlayingTrackPos; }
bool isRepeatAllSet() const { return _repeatAll; }
bool isRadioSet() const { return _radio; }
bool hasExternalAuth() const { return _externalAuth; }
AuthMode getAuthMode() const { return _authMode; }
UITheme getUITheme() const { return _uiTheme; }
SubsonicArtistListMode getSubsonicArtistListMode() const { return _subsonicArtistListMode; }
@@ -220,7 +227,7 @@ class User : public Wt::Dbo::Dbo<User>
Wt::Dbo::field(a, _curPlayingTrackPos, "cur_playing_track_pos");
Wt::Dbo::field(a, _repeatAll, "repeat_all");
Wt::Dbo::field(a, _radio, "radio");
Wt::Dbo::field(a, _externalAuth, "external_auth");
Wt::Dbo::field(a, _authMode, "auth_mode");
Wt::Dbo::hasMany(a, _tracklists, Wt::Dbo::ManyToOne, "user");
Wt::Dbo::hasMany(a, _starredArtists, Wt::Dbo::ManyToMany, "user_artist_starred", "", Wt::Dbo::OnDeleteCascade);
Wt::Dbo::hasMany(a, _starredReleases, Wt::Dbo::ManyToMany, "user_release_starred", "", Wt::Dbo::OnDeleteCascade);
@@ -249,8 +256,7 @@ class User : public Wt::Dbo::Dbo<User>
int _curPlayingTrackPos {}; // Current track position in queue
bool _repeatAll {};
bool _radio {};
bool _externalAuth {false};
AuthMode _authMode {defaultAuthMode};
Wt::Dbo::collection<Wt::Dbo::ptr<TrackList>> _tracklists;
Wt::Dbo::collection<Wt::Dbo::ptr<Artist>> _starredArtists;
src/libs/subsonic/impl/SubsonicResource.cpp
+3 -1
View File
@@ -597,7 +597,9 @@ handleCreateUserRequest(RequestContext& context)
if (User::getByLoginName(context.dbSession, username) != User::pointer{})
throw UserAlreadyExistsGenericError {};
User::pointer user {User::create(context.dbSession, username, hash)};
User::pointer user {User::create(context.dbSession, username)};
user.modify()->setAuthMode(User::AuthMode::Internal);
user.modify()->setPasswordHash(hash);
return Response::createOkResponse(context);
}
src/libs/utils/impl/String.cpp
+1
View File
@@ -164,6 +164,7 @@ jsEscape(const std::string& str)
{ '\r', "\\r" },
{ '\t', "\\t" },
{ '"', "\\\"" },
{ '\'', "\\\'" },
};
std::string escaped;