mongo 2.12.4 → 2.13.0.beta1

data/lib/mongo/auth/sasl_conversation_base.rb

@@ -0,0 +1,111 @@
+# Copyright (C) 2020 MongoDB Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Mongo
+  module Auth
+
+    # Defines common behavior around SASL conversations between
+    # the client and the server.
+    #
+    # @api private
+    class SaslConversationBase < ConversationBase
+
+      # The base client first message.
+      CLIENT_FIRST_MESSAGE = { saslStart: 1, autoAuthorize: 1 }.freeze
+
+      # The base client continue message.
+      CLIENT_CONTINUE_MESSAGE = { saslContinue: 1 }.freeze
+
+      # Start the SASL conversation. This returns the first message that
+      # needs to be sent to the server.
+      #
+      # @param [ Server::Connection ] connection The connection being authenticated.
+      #
+      # @return [ Protocol::Message ] The first SASL conversation message.
+      def start(connection)
+        selector = client_first_document
+        if connection && connection.features.op_msg_enabled?
+          selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
+          cluster_time = connection.mongos? && connection.cluster_time
+          selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
+          Protocol::Msg.new([], {}, selector)
+        else
+          Protocol::Query.new(
+            user.auth_source,
+            Database::COMMAND,
+            selector,
+            limit: -1,
+          )
+        end
+      end
+
+      private
+
+      # Gets the auth mechanism name for the conversation class.
+      #
+      # Example return: SCRAM-SHA-1.
+      #
+      # @return [ String ] Auth mechanism name.
+      def auth_mechanism_name
+        # self.class.name is e.g. Mongo::Auth::Scram256::Mechanism.
+        # We need Mongo::Auth::Scram::MECHANISM.
+        # Pull out the Scram256 part, get that class off of Auth,
+        # then get the value of MECHANISM constant in Scram256.
+        # With ActiveSupport, this method would be:
+        # self.class.module_parent.const_get(:MECHANISM)
+        parts = self.class.name.split('::')
+        parts.pop
+        Auth.const_get(parts.last).const_get(:MECHANISM)
+      end
+
+      def client_first_message_options
+        nil
+      end
+
+      def client_first_document
+        payload = client_first_payload
+        if Lint.enabled?
+          unless payload.is_a?(String)
+            raise Error::LintError, "Payload must be a string but is a #{payload.class}: #{payload}"
+          end
+        end
+        doc = CLIENT_FIRST_MESSAGE.merge(
+          mechanism: auth_mechanism_name,
+          payload: BSON::Binary.new(payload),
+        )
+        if options = client_first_message_options
+          # Short SCRAM conversation,
+          # https://jira.mongodb.org/browse/DRIVERS-707
+          doc[:options] = options
+        end
+        doc
+      end
+
+      # Helper method to validate that server nonce starts with the client
+      # nonce.
+      #
+      # Note that this class does not define the client_nonce or server_nonce
+      # attributes - derived classes must do so.
+      def validate_server_nonce!
+        if client_nonce.nil? || client_nonce.empty?
+          raise ArgumentError, 'Cannot validate server nonce when client nonce is nil or empty'
+        end
+
+        unless server_nonce.start_with?(client_nonce)
+          raise Error::InvalidNonce.new(client_nonce, server_nonce)
+        end
+      end
+    end
+  end
+end

data/lib/mongo/auth/scram.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -12,73 +12,61 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-require 'mongo/auth/scram/conversation'
-
 module Mongo
   module Auth
 
     # Defines behavior for SCRAM authentication.
     #
-    # @since 2.0.0
     # @api private
-    class SCRAM
+    class Scram < Base
 
-      # The authentication mechanism string for SCRAM-SHA-1.
-      #
-      # @since 2.6.0
-      SCRAM_SHA_1_MECHANISM = 'SCRAM-SHA-1'.freeze
+      # The authentication mechanism string.
+      MECHANISM = 'SCRAM-SHA-1'.freeze
 
-      # The authentication mechanism string for SCRAM-SHA-256.
+      # Initializes the Scram authenticator.
       #
-      # @since 2.6.0
-      SCRAM_SHA_256_MECHANISM = 'SCRAM-SHA-256'.freeze
-
-      # Map the user-specified authentication mechanism to the proper names of the mechanisms.
+      # @param [ Auth::User ] user The user to authenticate.
+      # @param [ Mongo::Connection ] connection The connection to authenticate over.
       #
-      # @since 2.6.0
-      MECHANISMS = {
-        scram: SCRAM_SHA_1_MECHANISM,
-        scram256: SCRAM_SHA_256_MECHANISM
-      }.freeze
+      # @option opts [ String | nil ] speculative_auth_client_nonce The client
+      #   nonce used in speculative auth on the specified connection that
+      #   produced the specified speculative auth result.
+      # @option opts [ BSON::Document | nil ] speculative_auth_result The
+      #   value of speculativeAuthenticate field of ismaster response of
+      #   the handshake on the specified connection.
+      def initialize(user, connection, **opts)
+        super
+        @speculative_auth_client_nonce = opts[:speculative_auth_client_nonce]
+        @speculative_auth_result = opts[:speculative_auth_result]
+      end
 
-      # @return [ Mongo::Auth::User ] The user to authenticate.
-      attr_reader :user
+      # @return [ String | nil ] The client nonce used in speculative auth on
+      #   the current connection.
+      attr_reader :speculative_auth_client_nonce
 
-      # Instantiate a new authenticator.
-      #
-      # @example Create the authenticator.
-      #   Mongo::Auth::SCRAM.new(user)
-      #
-      # @param [ Mongo::Auth::User ] user The user to authenticate.
-      #
-      # @since 2.0.0
-      def initialize(user)
-        @user = user
+      # @return [ BSON::Document | nil ] The value of speculativeAuthenticate
+      #   field of ismaster response of the handshake on the current connection.
+      attr_reader :speculative_auth_result
+
+      def conversation
+        @conversation ||= self.class.const_get(:Conversation).new(
+          user, connection, client_nonce: speculative_auth_client_nonce)
       end
 
-      # Log the user in on the given connection.
-      #
-      # @example Log the user in.
-      #   user.login(connection)
-      #
-      # @param [ Mongo::Connection ] connection The connection to log into.
+      # Log the user in on the current connection.
       #
-      # @return [ Protocol::Message ] The authentication response.
-      #
-      # @since 2.0.0
-      def login(connection)
-        mechanism = user.mechanism || :scram
-        conversation = Conversation.new(user, mechanism)
-        reply = connection.dispatch([ conversation.start(connection) ])
-        connection.update_cluster_time(Operation::Result.new(reply))
-        reply = connection.dispatch([ conversation.continue(reply, connection) ])
-        connection.update_cluster_time(Operation::Result.new(reply))
-        until reply.documents[0][Conversation::DONE]
-          reply = connection.dispatch([ conversation.finalize(reply, connection) ])
-          connection.update_cluster_time(Operation::Result.new(reply))
+      # @return [ BSON::Document ] The document of the authentication response.
+      def login
+        converse_multi_step(connection, conversation,
+          speculative_auth_result: speculative_auth_result,
+        ).tap do
+          unless conversation.server_verified?
+            raise Error::MissingScramServerSignature
+          end
         end
-        reply
       end
     end
   end
 end
+
+require 'mongo/auth/scram/conversation'

data/lib/mongo/auth/scram/conversation.rb

@@ -1,4 +1,4 @@
-# Copyright (C) 2014-2019 MongoDB Inc.
+# Copyright (C) 2014-2020 MongoDB Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,337 +14,16 @@
 
 module Mongo
   module Auth
-    class SCRAM
+    class Scram
 
-      # Defines behavior around a single SCRAM-SHA-1/256 conversation between
+      # Defines behavior around a single SCRAM-SHA-1 conversation between
       # the client and server.
       #
-      # @since 2.0.0
       # @api private
-      class Conversation
-
-        # The base client continue message.
-        #
-        # @since 2.0.0
-        CLIENT_CONTINUE_MESSAGE = { saslContinue: 1 }.freeze
-
-        # The base client first message.
-        #
-        # @since 2.0.0
-        CLIENT_FIRST_MESSAGE = { saslStart: 1, autoAuthorize: 1 }.freeze
-
-        # The client key string.
-        #
-        # @since 2.0.0
-        # @deprecated
-        CLIENT_KEY = 'Client Key'.freeze
-
-        # The key for the done field in the responses.
-        #
-        # @since 2.0.0
-        DONE = 'done'.freeze
-
-        # The conversation id field.
-        #
-        # @since 2.0.0
-        ID = 'conversationId'.freeze
-
-        # The iterations key in the responses.
-        #
-        # @since 2.0.0
-        ITERATIONS = /i=(\d+)/.freeze
-
-        # The minimum iteration count for SCRAM-SHA-256.
-        #
-        # @api private
-        #
-        # @since 2.6.0
-        MIN_ITER_COUNT = 4096
-
-        # The payload field.
-        #
-        # @since 2.0.0
-        PAYLOAD = 'payload'.freeze
-
-        # The rnonce key in the responses.
-        #
-        # @since 2.0.0
-        RNONCE = /r=([^,]*)/.freeze
-
-        # The salt key in the responses.
-        #
-        # @since 2.0.0
-        SALT = /s=([^,]*)/.freeze
-
-        # The server key string.
-        #
-        # @since 2.0.0
-        # @deprecated
-        SERVER_KEY = 'Server Key'.freeze
-
-        # The server signature verifier in the response.
-        #
-        # @since 2.0.0
-        VERIFIER = /v=([^,]*)/.freeze
-
-        # @return [ String ] nonce The initial user nonce.
-        attr_reader :nonce
-
-        # @return [ Protocol::Message ] reply The current reply in the
-        #   conversation.
-        attr_reader :reply
-
-        # @return [ User ] user The user for the conversation.
-        attr_reader :user
-
-        # Continue the SCRAM conversation. This sends the client final message
-        # to the server after setting the reply from the previous server
-        # communication.
-        #
-        # @example Continue the conversation.
-        #   conversation.continue(reply)
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Server::Connection ] connection The connection being
-        #   authenticated.
-        #
-        # @return [ Protocol::Message ] The next message to send.
-        #
-        # @since 2.0.0
-        def continue(reply, connection)
-          validate_first_message!(reply, connection.server)
-
-          if connection && connection.features.op_msg_enabled?
-            selector = CLIENT_CONTINUE_MESSAGE.merge(
-              payload: client_final_message,
-              conversationId: id,
-            )
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              user.auth_source,
-              Database::COMMAND,
-              CLIENT_CONTINUE_MESSAGE.merge(
-                payload: client_final_message,
-                conversationId: id,
-              ),
-              limit: -1,
-            )
-          end
-        end
-
-        # Finalize the SCRAM conversation. This is meant to be iterated until
-        # the provided reply indicates the conversation is finished.
-        #
-        # @param [ Protocol::Message ] reply The reply of the previous
-        #   message.
-        # @param [ Server::Connection ] connection The connection being authenticated.
-        #
-        # @return [ Protocol::Query ] The next message to send.
-        #
-        # @since 2.0.0
-        def finalize(reply, connection)
-          validate_final_message!(reply, connection.server)
-          if connection && connection.features.op_msg_enabled?
-            selector = CLIENT_CONTINUE_MESSAGE.merge(
-              payload: client_empty_message,
-              conversationId: id,
-            )
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              user.auth_source,
-              Database::COMMAND,
-              CLIENT_CONTINUE_MESSAGE.merge(
-                payload: client_empty_message,
-                conversationId: id,
-              ),
-              limit: -1,
-            )
-          end
-        end
-
-        # Start the SCRAM conversation. This returns the first message that
-        # needs to be sent to the server.
-        #
-        # @param [ Server::Connection ] connection The connection being authenticated.
-        #
-        # @return [ Protocol::Query ] The first SCRAM conversation message.
-        #
-        # @since 2.0.0
-        def start(connection)
-          if connection && connection.features.op_msg_enabled?
-            selector = CLIENT_FIRST_MESSAGE.merge(
-              payload: client_first_message, mechanism: full_mechanism)
-            selector[Protocol::Msg::DATABASE_IDENTIFIER] = user.auth_source
-            cluster_time = connection.mongos? && connection.cluster_time
-            selector[Operation::CLUSTER_TIME] = cluster_time if cluster_time
-            Protocol::Msg.new([], {}, selector)
-          else
-            Protocol::Query.new(
-              user.auth_source,
-              Database::COMMAND,
-              CLIENT_FIRST_MESSAGE.merge(
-                payload: client_first_message, mechanism: full_mechanism),
-              limit: -1,
-            )
-          end
-        end
-
-        def full_mechanism
-          MECHANISMS[@mechanism]
-        end
-
-        # Get the id of the conversation.
-        #
-        # @example Get the id of the conversation.
-        #   conversation.id
-        #
-        # @return [ Integer ] The conversation id.
-        #
-        # @since 2.0.0
-        def id
-          reply.documents[0][ID]
-        end
-
-        # Create the new conversation.
-        #
-        # @example Create the new conversation.
-        #   Conversation.new(user, mechanism)
-        #
-        # @param [ Auth::User ] user The user to converse about.
-        # @param [ Symbol ] mechanism Authentication mechanism.
-        #
-        # @since 2.0.0
-        def initialize(user, mechanism)
-          unless [:scram, :scram256].include?(mechanism)
-            raise InvalidMechanism.new(mechanism)
-          end
-
-          @user = user
-          @nonce = SecureRandom.base64
-          @mechanism = mechanism
-        end
+      class Conversation < ScramConversationBase
 
         private
 
-        # Auth message algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def auth_message
-          @auth_message ||= "#{first_bare},#{reply.documents[0][PAYLOAD].data},#{without_proof}"
-        end
-
-        # Get the empty client message.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def client_empty_message
-          BSON::Binary.new('')
-        end
-
-        # Get the final client message.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def client_final_message
-          BSON::Binary.new("#{without_proof},p=#{client_final}")
-        end
-
-        # Get the client first message
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def client_first_message
-          BSON::Binary.new("n,,#{first_bare}")
-        end
-
-        # Client final implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-7
-        #
-        # @since 2.0.0
-        def client_final
-          @client_final ||= client_proof(client_key, client_signature(stored_key(client_key), auth_message))
-        end
-
-        # Client key algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def client_key
-          @client_key ||= CredentialCache.cache(cache_key(:client_key)) do
-            hmac(salted_password, 'Client Key')
-          end
-        end
-
-        # Client proof algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def client_proof(key, signature)
-          @client_proof ||= Base64.strict_encode64(xor(key, signature))
-        end
-
-        # Client signature algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def client_signature(key, message)
-          @client_signature ||= hmac(key, message)
-        end
-
-        # First bare implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-7
-        #
-        # @since 2.0.0
-        def first_bare
-          @first_bare ||= "n=#{user.encoded_name},r=#{nonce}"
-        end
-
-        # H algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-2.2
-        #
-        # @since 2.0.0
-        def h(string)
-          digest.digest(string)
-        end
-
         # HI algorithm implementation.
         #
         # @api private
@@ -353,80 +32,12 @@ module Mongo
         #
         # @since 2.0.0
         def hi(data)
-          case @mechanism
-          when :scram256
-            OpenSSL::PKCS5.pbkdf2_hmac(
-              data,
-              Base64.strict_decode64(salt),
-              iterations,
-              digest.size,
-              digest
-            )
-          else
-            OpenSSL::PKCS5.pbkdf2_hmac_sha1(
-              data,
-              Base64.strict_decode64(salt),
-              iterations,
-              digest.size
-            )
-          end
-        end
-
-        # HMAC algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-2.2
-        #
-        # @since 2.0.0
-        def hmac(data, key)
-          OpenSSL::HMAC.digest(digest, data, key)
-        end
-
-        # Get the iterations from the server response.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def iterations
-          @iterations ||= payload_data.match(ITERATIONS)[1].to_i.tap do |i|
-            if i < MIN_ITER_COUNT
-              raise Error::InsufficientIterationCount.new(
-                Error::InsufficientIterationCount.message(MIN_ITER_COUNT, i))
-            end
-          end
-        end
-
-        # Get the data from the returned payload.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def payload_data
-          reply.documents[0][PAYLOAD].data
-        end
-
-        # Get the server nonce from the payload.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def rnonce
-          @rnonce ||= payload_data.match(RNONCE)[1]
-        end
-
-        # Gets the salt from the server response.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def salt
-          @salt ||= payload_data.match(SALT)[1]
-        end
-
-        # @api private
-        def cache_key(*extra)
-          [user.password, salt, iterations, @mechanism] + extra
+          OpenSSL::PKCS5.pbkdf2_hmac_sha1(
+            data,
+            salt,
+            iterations,
+            digest.size,
+          )
         end
 
         # Salted password algorithm implementation.
@@ -438,117 +49,12 @@ module Mongo
         # @since 2.0.0
         def salted_password
           @salted_password ||= CredentialCache.cache(cache_key(:salted_password)) do
-            case @mechanism
-            when :scram256
-              hi(user.sasl_prepped_password)
-            else
-              hi(user.hashed_password)
-            end
-          end
-        end
-
-        # Server key algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def server_key
-          @server_key ||= CredentialCache.cache(cache_key(:server_key)) do
-            hmac(salted_password, 'Server Key')
-          end
-        end
-
-        # Server signature algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def server_signature
-          @server_signature ||= Base64.strict_encode64(hmac(server_key, auth_message))
-        end
-
-        # Stored key algorithm implementation.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-3
-        #
-        # @since 2.0.0
-        def stored_key(key)
-          h(key)
-        end
-
-        # Get the verifier token from the server response.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def verifier
-          @verifier ||= payload_data.match(VERIFIER)[1]
-        end
-
-        # Get the without proof message.
-        #
-        # @api private
-        #
-        # @see http://tools.ietf.org/html/rfc5802#section-7
-        #
-        # @since 2.0.0
-        def without_proof
-          @without_proof ||= "c=biws,r=#{rnonce}"
-        end
-
-        # XOR operation for two strings.
-        #
-        # @api private
-        #
-        # @since 2.0.0
-        def xor(first, second)
-          first.bytes.zip(second.bytes).map{ |(a,b)| (a ^ b).chr }.join('')
-        end
-
-        def compare_digest(a, b)
-          check = a.bytesize ^ b.bytesize
-          a.bytes.zip(b.bytes){ |x, y| check |= x ^ y.to_i }
-          check == 0
-        end
-
-        def validate_final_message!(reply, server)
-          validate!(reply, server)
-          unless compare_digest(verifier, server_signature)
-            raise Error::InvalidSignature.new(verifier, server_signature)
+            hi(user.hashed_password)
           end
         end
 
-        def validate_first_message!(reply, server)
-          validate!(reply, server)
-          raise Error::InvalidNonce.new(nonce, rnonce) unless rnonce.start_with?(nonce)
-        end
-
-        def validate!(reply, server)
-          if reply.documents[0][Operation::Result::OK] != 1
-            raise Unauthorized.new(user,
-              used_mechanism: full_mechanism,
-              message: reply.documents[0]['errmsg'],
-              server: server,
-            )
-          end
-          @reply = reply
-        end
-
-        private
-
         def digest
-          @digest ||= case @mechanism
-                      when :scram256
-                        OpenSSL::Digest::SHA256.new.freeze
-                      else
-                        OpenSSL::Digest::SHA1.new.freeze
-                      end
+          @digest ||= OpenSSL::Digest::SHA1.new.freeze
         end
       end
     end