couchbase 4.1.1 → 4.1.3

package/deps/couchbase-cxx-client/core/sasl/scram-sha/scram-sha.cc

@@ -0,0 +1,372 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "scram-sha.h"
+
+#include "core/crypto/cbcrypto.h"
+#include "core/logger/logger.hxx"
+#include "core/platform/base64.h"
+#include "core/platform/random.h"
+#include "core/platform/string_hex.h"
+#include "stringutils.h"
+
+#include <cstring>
+#include <iostream>
+#include <map>
+#include <set>
+#include <sstream>
+#include <string>
+
+namespace couchbase::core::sasl::mechanism::scram
+{
+
+using AttributeMap = std::map<char, std::string>;
+
+/**
+ * Decode the attribute list into a set. The attribute list looks like:
+ * "k=value,y=value" etc
+ *
+ * @param list the list to parse
+ * @param attributes where to store the attributes
+ * @return true if success, false otherwise
+ */
+static bool
+decodeAttributeList(const std::string& list, AttributeMap& attributes)
+{
+    size_t pos = 0;
+
+    LOG_TRACE("decoding attribute list [{}]", list);
+
+    while (pos < list.length()) {
+        auto equal = list.find('=', pos);
+        if (equal == std::string::npos) {
+            // syntax error!!
+            LOG_ERROR("decode attribute list [{}] failed: no '='", list);
+            return false;
+        }
+
+        if ((equal - pos) != 1) {
+            LOG_ERROR("decode attribute list [{}] failed: no key is multichar", list);
+            return false;
+        }
+
+        char key = list.at(pos);
+        pos = equal + 1;
+
+        // Make sure we haven't seen this key before..
+        if (attributes.find(key) != attributes.end()) {
+            LOG_ERROR("decode attribute list [{}] failed: key [{}] is multichar", list, key);
+            return false;
+        }
+
+        auto comma = list.find(',', pos);
+        if (comma == std::string::npos) {
+            attributes.try_emplace(key, list.substr(pos));
+            pos = list.length();
+        } else {
+            attributes.try_emplace(key, list.substr(pos, comma - pos));
+            pos = comma + 1;
+        }
+    }
+
+    return true;
+}
+
+/********************************************************************
+ * Common API
+ *******************************************************************/
+std::string
+ScramShaBackend::getAuthMessage()
+{
+    if (client_first_message_bare.empty()) {
+        throw std::logic_error("can't call getAuthMessage without client_first_message_bare is set");
+    }
+    if (server_first_message.empty()) {
+        throw std::logic_error("can't call getAuthMessage without server_first_message is set");
+    }
+    if (client_final_message_without_proof.empty()) {
+        throw std::logic_error("can't call getAuthMessage without client_final_message_without_proof is set");
+    }
+    return client_first_message_bare + "," + server_first_message + "," + client_final_message_without_proof;
+}
+
+void
+ScramShaBackend::addAttribute(std::ostream& out, char key, const std::string& value, bool more)
+{
+    out << key << '=';
+
+    switch (key) {
+        case 'n': // username ..
+            out << encode_username(sasl_prep(value));
+            break;
+
+        case 'r': // client nonce.. printable characters
+            for (const auto& c : value) {
+                if (c == ',' || (isprint(c) == 0)) {
+                    throw std::invalid_argument("ScramShaBackend::addAttribute: Invalid character in client nonce");
+                }
+            }
+            out << value;
+            break;
+
+        case 'c': // base64 encoded GS2 header and channel binding data
+        case 's': // base64 encoded salt
+        case 'p': // base64 encoded client proof
+        case 'v': // base64 encoded server signature
+            out << couchbase::core::base64::encode(value);
+            break;
+
+        case 'i': // iterator count
+            // validate that it is an integer value
+            try {
+                (void)std::stoi(value);
+            } catch (...) {
+                throw std::invalid_argument("ScramShaBackend::addAttribute: Iteration count must be a numeric value");
+            }
+            out << value;
+            break;
+
+        case 'e':
+            for (const auto& c : value) {
+                if (c == ',' || (isprint(c) == 0)) {
+                    throw std::invalid_argument("ScramShaBackend::addAttribute: Invalid character in error message");
+                }
+            }
+            out << value;
+            break;
+
+        default:
+            throw std::invalid_argument("ScramShaBackend::addAttribute: Invalid key");
+    }
+
+    if (more) {
+        out << ',';
+    }
+}
+
+void
+ScramShaBackend::addAttribute(std::ostream& out, char key, int value, bool more)
+{
+    out << key << '=';
+
+    std::string base64_encoded;
+
+    switch (key) {
+        case 'n': // username ..
+        case 'r': // client nonce.. printable characters
+        case 'c': // base64 encoded GS2 header and channel binding data
+        case 's': // base64 encoded salt
+        case 'p': // base64 encoded client proof
+        case 'v': // base64 encoded server signature
+        case 'e': // error message
+            throw std::invalid_argument("ScramShaBackend::addAttribute: Invalid value (should not be int)");
+
+        case 'i': // iterator count
+            out << value;
+            break;
+
+        default:
+            throw std::invalid_argument("ScramShaBackend::addAttribute: Invalid key");
+    }
+
+    if (more) {
+        out << ',';
+    }
+}
+
+/**
+ * Generate the Server Signature. It is computed as:
+ *
+ * SaltedPassword  := Hi(Normalize(password), salt, i)
+ * ServerKey       := HMAC(SaltedPassword, "Server Key")
+ * ServerSignature := HMAC(ServerKey, AuthMessage)
+ */
+std::string
+ScramShaBackend::getServerSignature()
+{
+    auto serverKey = couchbase::core::crypto::HMAC(algorithm, getSaltedPassword(), "Server Key");
+
+    return couchbase::core::crypto::HMAC(algorithm, serverKey, getAuthMessage());
+}
+
+/**
+ * Generate the Client Proof. It is computed as:
+ *
+ * SaltedPassword  := Hi(Normalize(password), salt, i)
+ * ClientKey       := HMAC(SaltedPassword, "Client Key")
+ * StoredKey       := H(ClientKey)
+ * AuthMessage     := client-first-message-bare + "," +
+ *                    server-first-message + "," +
+ *                    client-final-message-without-proof
+ * ClientSignature := HMAC(StoredKey, AuthMessage)
+ * ClientProof     := ClientKey XOR ClientSignature
+ */
+std::string
+ScramShaBackend::getClientProof()
+{
+    auto clientKey = couchbase::core::crypto::HMAC(algorithm, getSaltedPassword(), "Client Key");
+    auto storedKey = couchbase::core::crypto::digest(algorithm, clientKey);
+    std::string authMessage = getAuthMessage();
+    auto clientSignature = couchbase::core::crypto::HMAC(algorithm, storedKey, authMessage);
+
+    // Client Proof is ClientKey XOR ClientSignature
+    const auto* ck = clientKey.data();
+    const auto* cs = clientSignature.data();
+
+    std::string proof;
+    proof.resize(clientKey.size());
+
+    auto total = proof.size();
+    for (std::size_t ii = 0; ii < total; ++ii) {
+        proof[ii] = ck[ii] ^ cs[ii];
+    }
+
+    return proof;
+}
+
+ClientBackend::ClientBackend(GetUsernameCallback& user_cb,
+                             GetPasswordCallback& password_cb,
+                             ClientContext& ctx,
+                             Mechanism mech,
+                             couchbase::core::crypto::Algorithm algo)
+  : MechanismBackend(user_cb, password_cb, ctx)
+  , ScramShaBackend(mech, algo)
+{
+    couchbase::core::RandomGenerator randomGenerator;
+
+    std::array<char, 8> nonce{};
+    if (!randomGenerator.getBytes(nonce.data(), nonce.size())) {
+        LOG_ERROR_RAW("failed to generate server nonce");
+        throw std::bad_alloc();
+    }
+
+    clientNonce = couchbase::core::to_hex({ nonce.data(), nonce.size() });
+}
+
+std::pair<error, std::string_view>
+ClientBackend::start()
+{
+    std::stringstream out;
+    out << "n,,";
+    addAttribute(out, 'n', usernameCallback(), true);
+    addAttribute(out, 'r', clientNonce, false);
+
+    client_first_message = out.str();
+    client_first_message_bare = client_first_message.substr(3); // skip n,,
+
+    return { error::OK, client_first_message };
+}
+
+std::pair<error, std::string_view>
+ClientBackend::step(std::string_view input)
+{
+    if (input.empty()) {
+        return { error::BAD_PARAM, {} };
+    }
+
+    if (server_first_message.empty()) {
+        server_first_message.assign(input.data(), input.size());
+
+        AttributeMap attributes;
+        if (!decodeAttributeList(server_first_message, attributes)) {
+            return { error::BAD_PARAM, {} };
+        }
+
+        for (const auto& attribute : attributes) {
+            switch (attribute.first) {
+                case 'r': // combined nonce
+                    nonce_ = attribute.second;
+                    break;
+                case 's':
+                    salt = couchbase::core::base64::decode(attribute.second);
+                    break;
+                case 'i':
+                    try {
+                        iterationCount = static_cast<unsigned int>(std::stoul(attribute.second));
+                    } catch (...) {
+                        return { error::BAD_PARAM, {} };
+                    }
+                    break;
+                default:
+                    return { error::BAD_PARAM, {} };
+            }
+        }
+
+        if (attributes.find('r') == attributes.end() || attributes.find('s') == attributes.end() ||
+            attributes.find('i') == attributes.end()) {
+            LOG_ERROR_RAW("missing r/s/i in server message");
+            return { error::BAD_PARAM, {} };
+        }
+
+        // I've got the SALT, lets generate the salted password
+        if (!generateSaltedPassword(passwordCallback())) {
+            LOG_ERROR_RAW("failed to generated salted password");
+            return { error::FAIL, {} };
+        }
+
+        // Ok so we have salted hased password :D
+
+        std::stringstream out;
+        addAttribute(out, 'c', "n,,", true);
+        addAttribute(out, 'r', nonce_, false);
+        client_final_message_without_proof = out.str();
+        out << ",";
+
+        addAttribute(out, 'p', getClientProof(), false);
+
+        client_final_message = out.str();
+
+        return { error::CONTINUE, client_final_message };
+    }
+    server_final_message.assign(input.data(), input.size());
+
+    AttributeMap attributes;
+    if (!decodeAttributeList(server_final_message, attributes)) {
+        LOG_ERROR_RAW("SCRAM: failed to decode server-final-message");
+        return { error::BAD_PARAM, {} };
+    }
+
+    if (attributes.find('e') != attributes.end()) {
+        LOG_ERROR("failed to authenticate: {}", attributes['e']);
+        return { error::FAIL, {} };
+    }
+
+    if (attributes.find('v') == attributes.end()) {
+        LOG_ERROR_RAW("syntax error server final message is missing 'v'");
+        return { error::BAD_PARAM, {} };
+    }
+
+    if (auto encoded = couchbase::core::base64::encode(getServerSignature()); encoded != attributes['v']) {
+        LOG_ERROR_RAW("incorrect ServerKey received");
+        return { error::FAIL, {} };
+    }
+
+    return { error::OK, {} };
+}
+
+bool
+ClientBackend::generateSaltedPassword(const std::string& secret)
+{
+    try {
+        saltedPassword = couchbase::core::crypto::PBKDF2_HMAC(algorithm, secret, salt, iterationCount);
+        return true;
+    } catch (...) {
+        return false;
+    }
+}
+
+} // namespace couchbase::core::sasl::mechanism::scram

package/deps/couchbase-cxx-client/core/sasl/scram-sha/scram-sha.h

@@ -0,0 +1,184 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#pragma once
+
+/**
+ * This file contains the interface to the SCRAM-SHA1, SCRAM-SHA256 and
+ * SCRAM-512 support.
+ *
+ * SCRAM is defined in https://www.ietf.org/rfc/rfc5802.txt
+ *
+ * The current implementation does not support channel binding (so we
+ * don't advertise the -PLUS)
+ */
+
+#include "core/crypto/cbcrypto.h"
+
+#include "core/sasl/client.h"
+#include "core/sasl/mechanism.h"
+
+#include <array>
+#include <iostream>
+#include <vector>
+
+namespace couchbase::core::sasl::mechanism::scram
+{
+
+class ScramShaBackend
+{
+  protected:
+    ScramShaBackend(const Mechanism& mech, const couchbase::core::crypto::Algorithm algo)
+      : mechanism(mech)
+      , algorithm(algo)
+    {
+    }
+    ~ScramShaBackend() = default;
+
+    /**
+     * Add a property to the message list according to
+     * https://www.ietf.org/rfc/rfc5802.txt section 5.1
+     *
+     * The purpose of these conversion functions is that we want to
+     * make sure that we enforce the right format on the various attributes
+     * and that we detect illegal keys.
+     *
+     * @param out the destination stream
+     * @param key the key to add
+     * @param value the string representation of the attribute to add
+     * @param more set to true if we should add a trailing comma (more data
+     *             follows)
+     */
+    static void addAttribute(std::ostream& out, char key, const std::string& value, bool more);
+
+    /**
+     * Add a property to the message list according to
+     * https://www.ietf.org/rfc/rfc5802.txt section 5.1
+     *
+     * The purpose of these conversion functions is that we want to
+     * make sure that we enforce the right format on the various attributes
+     * and that we detect illegal keys.
+     *
+     * @param out the destination stream
+     * @param key the key to add
+     * @param value the integer value of the attribute to add
+     * @param more set to true if we should add a trailing comma (more data
+     *             follows)
+     */
+    static void addAttribute(std::ostream& out, char key, int value, bool more);
+
+    std::string getServerSignature();
+
+    std::string getClientProof();
+
+    virtual std::string getSaltedPassword() = 0;
+
+    /**
+     * Get the AUTH message (as specified in the RFC)
+     */
+    std::string getAuthMessage();
+
+    std::string client_first_message;
+    std::string client_first_message_bare;
+    std::string client_final_message;
+    std::string client_final_message_without_proof;
+    std::string server_first_message;
+    std::string server_final_message;
+
+    std::string clientNonce;
+    std::string nonce_;
+
+    Mechanism mechanism;
+    const couchbase::core::crypto::Algorithm algorithm;
+};
+
+/**
+ * Implementation of the class that provides the client side implementation
+ * of the SCRAM-SHA[1,256,512]
+ */
+class ClientBackend
+  : public MechanismBackend
+  , public ScramShaBackend
+{
+  public:
+    ClientBackend(GetUsernameCallback& user_cb,
+                  GetPasswordCallback& password_cb,
+                  ClientContext& ctx,
+                  Mechanism mech,
+                  couchbase::core::crypto::Algorithm algo);
+
+    std::pair<error, std::string_view> start() override;
+    std::pair<error, std::string_view> step(std::string_view input) override;
+
+  protected:
+    bool generateSaltedPassword(const std::string& secret);
+
+    std::string getSaltedPassword() override
+    {
+        if (saltedPassword.empty()) {
+            throw std::logic_error("getSaltedPassword called before salted password is initialized");
+        }
+        return saltedPassword;
+    }
+
+    std::string saltedPassword;
+    std::string salt;
+    unsigned int iterationCount = 4096;
+};
+
+class Sha512ClientBackend : public ClientBackend
+{
+  public:
+    Sha512ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA512, couchbase::core::crypto::Algorithm::SHA512)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA512";
+    }
+};
+
+class Sha256ClientBackend : public ClientBackend
+{
+  public:
+    Sha256ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA256, couchbase::core::crypto::Algorithm::SHA256)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA256";
+    }
+};
+
+class Sha1ClientBackend : public ClientBackend
+{
+  public:
+    Sha1ClientBackend(GetUsernameCallback& user_cb, GetPasswordCallback& password_cb, ClientContext& ctx)
+      : ClientBackend(user_cb, password_cb, ctx, Mechanism::SCRAM_SHA1, couchbase::core::crypto::Algorithm::SHA1)
+    {
+    }
+
+    [[nodiscard]] std::string_view get_name() const override
+    {
+        return "SCRAM-SHA1";
+    }
+};
+
+} // namespace couchbase::core::sasl::mechanism::scram

package/deps/couchbase-cxx-client/core/sasl/scram-sha/stringutils.cc

@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+
+#include "stringutils.h"
+
+#include <cctype>
+#include <stdexcept>
+
+namespace couchbase::core::sasl::mechanism::scram
+{
+
+/**
+ * According to the RFC:
+ *
+ * 2.3.  Prohibited Output
+ *
+ *    This profile specifies the following characters as prohibited input:
+ *
+ *       - Non-ASCII space characters [StringPrep, C.1.2]
+ *       - ASCII control characters [StringPrep, C.2.1]
+ *       - Non-ASCII control characters [StringPrep, C.2.2]
+ *       - Private Use characters [StringPrep, C.3]
+ *       - Non-character code points [StringPrep, C.4]
+ *       - Surrogate code points [StringPrep, C.5]
+ *       - Inappropriate for plain text characters [StringPrep, C.6]
+ *       - Inappropriate for canonical representation characters
+ *         [StringPrep, C.7]
+ *       - Change display properties or deprecated characters
+ *         [StringPrep, C.8]
+ *       - Tagging characters [StringPrep, C.9]
+ */
+const std::string&
+sasl_prep(const std::string& string)
+{
+    for (const auto& c : string) {
+        if ((static_cast<unsigned int>(c) & 0x80U) != 0) {
+            throw std::runtime_error("sasl_prep: Multibyte UTF-8 is not"
+                                     " implemented yet");
+        }
+
+        if (iscntrl(c) != 0) {
+            throw std::runtime_error("sasl_prep: control characters is not"
+                                     " allowed");
+        }
+    }
+
+    return string;
+}
+
+std::string
+encode_username(const std::string& username)
+{
+    std::string ret(username);
+
+    std::string::size_type index = 0;
+    while ((index = ret.find_first_of(",=", index)) != std::string::npos) {
+        if (ret[index] == ',') {
+            ret.replace(index, 1, "=2C");
+        } else {
+            ret.replace(index, 1, "=3D");
+        }
+        ++index;
+    }
+
+    return ret;
+}
+
+} // namespace couchbase::core::sasl::mechanism::scram

package/deps/couchbase-cxx-client/core/sasl/scram-sha/stringutils.h

@@ -0,0 +1,48 @@
+/* -*- Mode: C++; tab-width: 4; c-basic-offset: 4; indent-tabs-mode: nil -*- */
+/*
+ *     Copyright 2016 Couchbase, Inc.
+ *
+ *   Licensed under the Apache License, Version 2.0 (the "License");
+ *   you may not use this file except in compliance with the License.
+ *   You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *   Unless required by applicable law or agreed to in writing, software
+ *   distributed under the License is distributed on an "AS IS" BASIS,
+ *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *   See the License for the specific language governing permissions and
+ *   limitations under the License.
+ */
+#pragma once
+
+#include <string>
+
+namespace couchbase::core::sasl::mechanism::scram
+{
+
+/**
+ * Apply https://www.ietf.org/rfc/rfc4013.txt to the input string
+ *
+ * The input string is supposed to be UTF-8 (but given that we don't
+ * support bucket names with multibyte characters, we only support
+ * single-byte UTF-8 characters ;-))
+ *
+ * @param string The string to run stringprep with the SASL profile on
+ * @return a sasl_prep'd string
+ * @throws std::runtime_error if we encounter a multibyte character
+ */
+const std::string&
+sasl_prep(const std::string& string);
+
+/**
+ * According to https://www.ietf.org/rfc/rfc5802.txt all occurrences
+ * of ',' and '=' needs to be transferred as =2C and =3D.
+ *
+ * @param username the username to encode
+ * @return the escaped string
+ */
+std::string
+encode_username(const std::string& username);
+
+} // namespace couchbase::core::sasl::mechanism::scram