oracledb 5.5.0 → 6.0.0

package/lib/thin/protocol/encryptDecrypt.js

@@ -0,0 +1,185 @@
+// Copyright (c) 2022, Oracle and/or its affiliates.
+
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//-----------------------------------------------------------------------------
+
+'use strict';
+
+const Buffer = require('buffer').Buffer;
+const crypto = require('crypto');
+
+let algorithm = 'aes-256-cbc';
+const _appendBuffer = Buffer.from([0x00, 0x01]);
+
+/**
+ * A single Instance which handles all Encrypt, Decrypt,
+ * hash related to password verifiers.
+ */
+class EncryptDecrypt {
+
+  // Key length is dependent on the algorithm. In this case for aes192, it is
+  // 24 bytes (192 bits).
+  _decrypt(key, val) {
+    const iv = Buffer.alloc(16, 0); // Initialization vector, same is used in server
+    const decipher = crypto.createDecipheriv(algorithm, key, iv);
+    decipher.setAutoPadding(false);
+    let decrypted = decipher.update(val);
+    decrypted = Buffer.concat([decrypted, decipher.final()]);
+    return decrypted;
+  }
+
+  _encrypt(key, val, padding) {
+    let block_size = 16;
+    const iv = Buffer.alloc(block_size, 0);
+    let n = block_size - (val.length % block_size);
+    const nv = Buffer.alloc(n, n);
+    if (n > 0) {
+      if (padding) {
+        val += Buffer.alloc(n);
+      } else {
+        val = Buffer.concat([val, nv]);
+      }
+    }
+    const cipher = crypto.createCipheriv(algorithm, key, iv);
+    let encrypted = cipher.update(val);
+    encrypted = Buffer.concat([encrypted, cipher.final()]);
+    if (!padding) {
+      encrypted = encrypted.slice(0, val.length);
+    }
+    val.fill(0);
+    return encrypted;
+  }
+
+  // Encrypt password and newPassword using comboKey
+  _setEncryptedPasswordBuffers(passwordBytes, newPasswordBytes, comboKey, authObj) {
+    let salt = Buffer.alloc(16);
+    crypto.randomFillSync(salt, 0, 16);
+    let temp = Buffer.concat([salt, passwordBytes]);
+    authObj.encodedPassword = this._encrypt(comboKey, temp);
+    temp.fill(0);
+    authObj.encodedPassword = authObj.encodedPassword.slice().toString('hex').toUpperCase();
+
+    if (newPasswordBytes) {
+      let newPasswordWithSalt = Buffer.concat([salt, newPasswordBytes]);
+      authObj.encodedNewPassword = this._encrypt(comboKey, newPasswordWithSalt);
+      newPasswordWithSalt.fill(0);
+      authObj.encodedNewPassword = authObj.encodedNewPassword.slice().toString('hex').toUpperCase();
+    }
+
+    // reset Buffers
+    passwordBytes.fill(0);
+    if (newPasswordBytes) {
+      newPasswordBytes.fill(0);
+    }
+  }
+
+  /**
+   * updates authObject with required data.
+   *
+   * @param {object} sessionData The key/value pairs returned from OSESS key rpc
+   * @param {string} password    Current Password of user
+   * @param {string} newPassword New password to be updated
+   * @param {boolean} verifier11G Verifier type 11g or not(12c)
+   */
+  updateVerifierData(sessionData, password, newPassword, verifier11G, authObj) {
+    let keyLen = 32;
+    let hashAlg = 'sha512';
+
+    let verifierData = Buffer.from(sessionData['AUTH_VFR_DATA'], 'hex');
+    let encodedServerKey = Buffer.from(sessionData['AUTH_SESSKEY'], 'hex');
+    let iterations = Number(sessionData['AUTH_PBKDF2_VGEN_COUNT']);
+    let passwordBytes = Buffer.from(password, 'utf8');
+    let passwordHash;
+    let passwordKey;
+
+    if (verifier11G) {
+      algorithm = 'aes-192-cbc';
+      keyLen = 24;
+      hashAlg = 'sha1';
+      let h = crypto.createHash(hashAlg);
+      h.update(passwordBytes);
+      h.update(verifierData);
+      let ph = h.digest();
+      passwordHash = Buffer.alloc(ph.length + 4);
+      ph.copy(passwordHash, 0, 0, ph.length);
+    } else {
+      algorithm = 'aes-256-cbc';
+      let temp = Buffer.from('AUTH_PBKDF2_SPEEDY_KEY', 'utf8');
+      let salt = Buffer.concat([verifierData, temp]);
+      passwordKey = crypto.pbkdf2Sync(passwordBytes, salt, iterations, 64, 'sha512');
+      let h = crypto.createHash(hashAlg);
+      h.update(passwordKey);
+      h.update(verifierData);
+      passwordHash = h.digest().slice(0, keyLen);
+    }
+
+    let newPasswordBytes;
+    if (newPassword) {
+      newPasswordBytes = Buffer.from(newPassword, 'utf8');
+    }
+    let sessionKeyParta = this._decrypt(passwordHash, encodedServerKey);
+    let sessionKeyPartb = Buffer.alloc(32);
+    crypto.randomFillSync(sessionKeyPartb, 0, 32);
+    let encodedClientKey = this._encrypt(passwordHash, sessionKeyPartb);
+    authObj.sessionKey = encodedClientKey.slice().toString('hex').toUpperCase().slice(0, 64);
+
+    iterations = Number(sessionData['AUTH_PBKDF2_SDER_COUNT']);
+    let mixingSalt = Buffer.from(sessionData['AUTH_PBKDF2_CSK_SALT'], 'hex');
+    let partABKey = Buffer.concat([sessionKeyPartb.slice(0, keyLen), sessionKeyParta.slice(0, keyLen)]);
+    let partABKeyStr = partABKey.toString('hex').toUpperCase();
+    let partABKeyBuffer = Buffer.from(partABKeyStr, 'utf8');
+    authObj.comboKey = crypto.pbkdf2Sync(partABKeyBuffer, mixingSalt, iterations, keyLen, 'sha512');
+
+    let salt = Buffer.alloc(16);
+    if (!verifier11G) {
+      crypto.randomFillSync(salt, 0, 16);
+      let temp = Buffer.concat([salt, passwordKey]);
+      authObj.speedyKey = this._encrypt(authObj.comboKey, temp);
+      authObj.speedyKey = authObj.speedyKey.slice(0, 80).toString('hex').toUpperCase();
+    }
+    this._setEncryptedPasswordBuffers(passwordBytes, newPasswordBytes, authObj.comboKey, authObj);
+  }
+
+  getEncryptedJSWPData(sessionKey, jdwpData) {
+    let buf = this._encrypt(sessionKey, jdwpData, true);
+
+    // Add a "01" at the end of the hex encrypted data to indicate the
+    // use of AES encryption
+    buf = buf.slice().toString('hex').toUpperCase();
+    buf = Buffer.concat([buf, _appendBuffer]);
+    return buf;
+  }
+
+  updatePasswordsWithComboKey(password, newPassword, comboKey, authObj) {
+    let passwordBytes = Buffer.from(password, 'utf8');
+    let newPasswordBytes;
+    if (newPassword) {
+      newPasswordBytes = Buffer.from(newPassword, 'utf8');
+    }
+    this._setEncryptedPasswordBuffers(passwordBytes, newPasswordBytes, comboKey, authObj);
+  }
+}
+
+let encryptDecryptInst = new EncryptDecrypt();
+module.exports = encryptDecryptInst;

package/lib/thin/protocol/messages/auth.js

@@ -0,0 +1,348 @@
+// Copyright (c) 2022, 2023, Oracle and/or its affiliates.
+
+//-----------------------------------------------------------------------------
+//
+// This software is dual-licensed to you under the Universal Permissive License
+// (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl and Apache License
+// 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose
+// either license.
+//
+// If you elect to accept the software under the Apache License, Version 2.0,
+// the following applies:
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//-----------------------------------------------------------------------------
+
+'use strict';
+
+const constants = require("../constants.js");
+const errors = require("../../../errors.js");
+const os = require("os");
+const process = require("process");
+const ED = require("../encryptDecrypt.js");
+const Message = require("./base.js");
+const util = require("../../util.js");
+
+const crypto = require('crypto');
+
+/**
+ * Executes OSESSKEY and OAUTH RPC functions
+ *
+ * @class AuthMessage
+ * @extends {Message}
+ */
+class AuthMessage extends Message {
+  /**
+   * Represents the data required for OAUTH and OSESSKEY rpc.
+   *
+   * @param {object} conn Connection object
+   * @param {object} config Dynamic Configuration like change password config after connection is established
+   */
+  constructor(conn, config) {
+    super(conn);
+    this.functionCode = constants.TNS_FUNC_AUTH_PHASE_ONE;
+    this.messageType = constants.TNS_MSG_TYPE_FUNCTION;
+    this.sessionData = {};
+    this.conn = conn;
+    this.sessionKey = "";
+    this.encodedPassword = "";
+    this.changePassword = false;
+    Object.defineProperty(this, 'password', {
+      enumerable: false,
+      value: config.password,
+    });
+    this.username = config.user;
+    if (this.username === undefined) {
+      this.username = "";
+    } else {
+      // trim leading and trailing spaces
+      this.username = this.username.trim();
+    }
+    this.schemaUser = '';
+    this.proxyUser = '';
+    this.proxyStatus = -1;
+    if (this.username.length !== 0) {
+      this.proxyStatusObj = util.checkProxyUserValidity(this.username);
+      if (this.proxyStatusObj.status === 0) {
+        this.proxyStatus = 0;
+        this.proxyUser = this.proxyStatusObj.proxyUser;
+        this.schemaUser = this.proxyStatusObj.schemaUser;
+        this.username = this.proxyUser;
+      }
+    }
+    this.newPassword = config.newPassword;
+    if (config.changePassword) {
+      // ChangePassword issued after login would use the same comboKey
+      // used in initial Login. We issue only OAUTH.
+      this.changePassword = true;
+      this.functionCode = constants.TNS_FUNC_AUTH_PHASE_TWO;
+    }
+    if (this.username) {
+      this.userByteLen = Buffer.byteLength(this.username); // Get utf8 encoded number of bytes
+    } else {
+      this.userByteLen = 0;
+    }
+    this.token = config.token;
+    if (this.token)
+      this.functionCode = constants.TNS_FUNC_AUTH_PHASE_TWO;
+    this.privateKey = config.privateKey;
+    if (this.privateKey) {
+      this.privateKey = '-----BEGIN PRIVATE KEY-----\n' + this.privateKey;
+      this.privateKey = this.privateKey + '\n' + '-----END PRIVATE KEY-----';
+    }
+    this.serviceName = this.conn.serviceName;
+    this.remoteAddress = this.conn.remoteAddress;
+    this.setAuthMode();
+  }
+
+  setAuthMode() {
+    if (!this.newPassword) {
+      this.authMode = constants.TNS_AUTH_MODE_LOGON;
+    }
+    if (this.conn.privilege & constants.SYSDBA) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSDBA;
+    }
+    if (this.conn.privilege & constants.SYSOPER) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSOPER;
+    }
+    if (this.conn.privilege & constants.SYSASM) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSASM;
+    }
+    if (this.conn.privilege & constants.SYSBKP) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSBKP;
+    }
+    if (this.conn.privilege & constants.SYSDG) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSDGD;
+    }
+    if (this.conn.privilege & constants.SYSKM) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSKMT;
+    }
+    if (this.conn.privilege & constants.SYSRAC) {
+      this.authMode |= constants.TNS_AUTH_MODE_SYSRAC;
+    }
+    if (this.privateKey) {
+      this.authMode |= constants.TNS_AUTH_MODE_IAM_TOKEN;
+    }
+    if (this.newPassword) {
+      this.authMode |= constants.TNS_AUTH_MODE_CHANGE_PASSWORD;
+    }
+    if (!this.token) {
+      this.authMode |= constants.TNS_AUTH_MODE_WITH_PASSWORD;
+    }
+  }
+
+  getAlterTimezoneStatement() {
+    let sign, tzRepr;
+    if (process.env.ORA_SDTZ) {
+      tzRepr = process.env.ORA_SDTZ;
+    } else {
+      const date = new Date();
+      const timezoneMinutes = date.getTimezoneOffset();
+      let tzHour = Math.trunc(timezoneMinutes / 60);
+      const tzMinutes = Math.abs((timezoneMinutes - tzHour * 60) % 60);
+      if (tzHour < 0) {
+        sign = '+';  // getTimezoneOffset() = localtime - timeUTC
+        tzHour = -tzHour;
+      } else {
+        sign = '-';
+      }
+      tzHour = tzHour.toLocaleString('en-US', {minimumIntegerDigits: 2});
+      tzRepr = `${sign}${tzHour}:${tzMinutes}`;
+    }
+    return `ALTER SESSION SET TIME_ZONE ='${tzRepr}'\x00`;
+  }
+
+  encode(buf) {
+    let verifier11G = false;
+    this.writeFunctionHeader(buf);
+    if (this.userByteLen > 0) {
+      buf.writeUInt8(1);
+    } else {
+      buf.writeUInt8(0);
+    }
+    buf.writeUB4(this.userByteLen);
+    buf.writeUB4(this.authMode);
+
+    if (this.functionCode === constants.TNS_FUNC_AUTH_PHASE_ONE) {
+      buf.writeUInt8(1);
+      buf.writeUB4(5);
+      buf.writeUInt8(0);
+      buf.writeUInt8(1);
+      if (this.userByteLen > 0) {
+        buf.writeBytesWithLength(Buffer.from(this.username));
+      }
+      buf.writeKeyValue("AUTH_TERMINAL", "unknown");
+      buf.writeKeyValue("AUTH_PROGRAM_NM", process.argv0);
+      buf.writeKeyValue("AUTH_MACHINE", os.hostname());
+      buf.writeKeyValue("AUTH_PID", process.pid.toString());
+      buf.writeKeyValue("AUTH_SID", os.userInfo().username);
+
+    } else {
+      let numPairs = 0;
+
+      if (this.changePassword) {
+        ED.updatePasswordsWithComboKey(this.password, this.newPassword, this.conn.comboKey, this);
+        numPairs = 2;
+      } else {
+        numPairs = 4;
+        if (this.token) {
+          numPairs += 1;
+        } else {
+          numPairs += 2;
+          if (this.verifierType === constants.TNS_VERIFIER_TYPE_11G_1 ||
+          this.verifierType === constants.TNS_VERIFIER_TYPE_11G_2) {
+            verifier11G = true;
+          } else if (this.verifierType !== constants.TNS_VERIFIER_TYPE_12C) {
+            errors.throwErr(errors.ERR_UNSUPPORTED_VERIFIER_TYPE,
+              this.verifierType.toString(16));
+          } else {
+            numPairs += 1;
+          }
+          ED.updateVerifierData(this.sessionData, this.password, this.newPassword, verifier11G, this);
+
+          // The comboKey is cached inside the conn which is used
+          // for changePassword issued on the connection
+          this.conn.comboKey = this.comboKey;
+          if (this.newPassword) {
+            numPairs += 1;
+          }
+        }
+
+        if (this.privateKey) {
+          numPairs += 2;
+        }
+        if (this.conn.connClass) {
+          numPairs += 1;
+        }
+        if (this.conn.purity) {
+          numPairs += 1;
+        }
+        if (this.conn.jdwpData) {
+          this.encryptedJDWPData = ED.getEncryptedJSWPData(this.sessionKey, this.conn.jdwpData);
+          numPairs += 1;
+        }
+        if (this.schemaUser.length !== 0) {
+          numPairs += 1;
+        }
+      }
+
+      buf.writeUInt8(1);
+      buf.writeUB4(numPairs);
+      buf.writeUInt8(1);
+      buf.writeUInt8(1);
+      if (this.userByteLen > 0)
+        buf.writeBytesWithLength(Buffer.from(this.username));
+      if (this.token) {
+        buf.writeKeyValue("AUTH_TOKEN", this.token);
+      } else {
+        if (!this.changePassword) {
+          buf.writeKeyValue("AUTH_SESSKEY", this.sessionKey, 1);
+          if (!verifier11G) {
+            buf.writeKeyValue("AUTH_PBKDF2_SPEEDY_KEY", this.speedyKey);
+          }
+        }
+      }
+      if (!this.changePassword) {
+        buf.writeKeyValue("SESSION_CLIENT_CHARSET", "873");
+        buf.writeKeyValue("SESSION_CLIENT_DRIVER_NAME", constants.DRIVER_NAME);
+        buf.writeKeyValue("SESSION_CLIENT_VERSION",
+          constants.CLIENT_VERSION.toString());
+        buf.writeKeyValue("AUTH_ALTER_SESSION", this.getAlterTimezoneStatement(), 1);
+      }
+      if (this.encodedPassword) {
+        buf.writeKeyValue("AUTH_PASSWORD", this.encodedPassword);
+      }
+      if (this.proxyStatus === 0) {
+        buf.writeKeyValue("PROXY_CLIENT_NAME", this.schemaUser);
+      }
+      if (this.encodedNewPassword) {
+        buf.writeKeyValue("AUTH_NEWPASSWORD", this.encodedNewPassword);
+      }
+      if (this.conn.connClass) {
+        buf.writeKeyValue("AUTH_KPPL_CONN_CLASS", this.conn.connClass);
+      }
+      if (this.conn.purity) {
+        buf.writeKeyValue("AUTH_KPPL_PURITY", '' + this.conn.purity);
+      }
+      if (this.privateKey) {
+        const currentDate = new Date();
+        const currentDateFormatted = currentDate.toGMTString();
+
+        let header = "date: " + currentDateFormatted + "\n" +
+          "(request-target): " + this.serviceName  + "\n" +
+          "host: " + this.remoteAddress;
+
+        let signature = crypto.createSign('RSA-SHA256')
+          .update(header)
+          .sign(this.privateKey, 'base64');
+
+        buf.writeKeyValue("AUTH_HEADER", header);
+        buf.writeKeyValue("AUTH_SIGNATURE", signature);
+      }
+      if (this.conn.jdwpData) {
+        buf.writeKeyValue("AUTH_ORA_DEBUG_JDWP", this.encryptedJDWPData);
+      }
+
+    }
+  }
+
+  processReturnParameter(buf) {
+    let numParams = buf.readUB2();
+    for (let i = 0; i < numParams;i++) {
+      buf.skipUB4();
+      let key = buf.readStr(constants.TNS_CS_IMPLICIT);
+      let value = "";
+      let numBytes = buf.readUB4();
+      if (numBytes > 0) {
+        value = buf.readStr(constants.TNS_CS_IMPLICIT);
+      }
+      let flag = buf.readUB4();
+      if (key === "AUTH_VFR_DATA") {
+        this.verifierType = flag;
+      }
+      this.sessionData[key] = value;
+
+    }
+    if (this.functionCode === constants.TNS_FUNC_AUTH_PHASE_ONE) {
+      this.functionCode = constants.TNS_FUNC_AUTH_PHASE_TWO;
+    } else {
+      let versionNum;
+      let releaseNum;
+      let updateNum;
+      let portReleaseNum;
+      let portUpdateNum;
+
+      this.conn.sessionID = this.sessionData['AUTH_SESSION_ID'];
+      this.conn.serialNum = this.sessionData['AUTH_SERIAL_NUM'];
+      let fullVersionNum = Number(this.sessionData['AUTH_VERSION_NO']);
+      versionNum = (fullVersionNum >> 24) & 0xFF;
+      if (buf.caps.ttcFieldVersion >= constants.TNS_CCAP_FIELD_VERSION_18_1_EXT_1) {
+        releaseNum = (fullVersionNum >> 16) & 0xFF;
+        updateNum = (fullVersionNum >> 12) & 0x0F;
+        portReleaseNum = (fullVersionNum >> 4) & 0xFF;
+        portUpdateNum = fullVersionNum & 0x0F;
+      } else {
+        releaseNum = (fullVersionNum >> 20) & 0x0F;
+        updateNum = (fullVersionNum >> 12) & 0xFF;
+        portReleaseNum = (fullVersionNum >> 8) & 0x0F;
+        portUpdateNum = fullVersionNum & 0xFF;
+      }
+      this.conn.serverVersionString = versionNum + '.' + releaseNum + '.' + updateNum + '.' + portReleaseNum + '.' + portUpdateNum;
+      this.conn.serverVersion = versionNum * 100000000 + releaseNum * 1000000 + updateNum * 10000 + portReleaseNum * 100 + portUpdateNum * 1;
+    }
+  }
+
+}
+
+module.exports = AuthMessage;