GithubStar/neuron
1
0
Fork 0
mirror of https://github.com/emqx/neuron.git synced 2026-10-24 18:51:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #802 from eeff/eeff/user

Browse Source 
Add user accounting
This commit is contained in:
fengzeroz
2022-09-19 17:20:14 +08:00
committed by GitHub
parent 8172bba55e 4e4b872a13
commit a782bad5cc
7 changed files with 624 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+1
View File
@@ -117,6 +117,7 @@ set(NEURON_SOURCES
plugins/restful/plugin_handle.c
plugins/restful/version_handle.c
plugins/restful/rest.c
plugins/restful/user.c
plugins/restful/http.c
plugins/restful/proxy.c
plugins/restful/websocket.c
persistence/0001_2.3.0_users.sql
+33
View File
@@ -0,0 +1,33 @@
/**
* NEURON IIoT System for Industry 4.0
* Copyright (C) 2020-2022 EMQ Technologies Co., Ltd All rights reserved.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 3 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
**/
--- Add users table ---
CREATE TABLE
IF NOT EXISTS users (
name TEXT PRIMARY KEY check(length(name) <= 32),
password TEXT NOT NULL
);
--- Default admin user ---
INSERT INTO
users (name, password)
VALUES
(
"admin",
"$5$PwFeXpBBIBZuZdZl$fP8fFPWCLoaWcnVXVSR.3Xi8TEqCvX92gjhowNNn6S4"
);
plugins/restful/normal_handle.c
+16 -4
View File
@@ -28,6 +28,9 @@
#include <time.h>
#include <unistd.h>
#include "adapter/adapter_internal.h"
#include "persist/persist.h"
#include "user.h"
#include "utils/asprintf.h"
#include "utils/log.h"
@@ -50,12 +53,18 @@ void handle_login(nng_aio *aio)
{
REST_PROCESS_HTTP_REQUEST(
aio, neu_json_login_req_t, neu_json_decode_login_req, {
neu_plugin_t * plugin = neu_rest_get_plugin();
neu_plugin_common_t * common = neu_plugin_to_plugin_common(plugin);
neu_json_login_resp_t login_resp = { 0 };
char * name = "admin";
char * password = "0000";
neu_user_t * user =
neu_load_user(common->adapter->persister, req->name);
if (strcmp(req->name, name) == 0 &&
strcmp(req->pass, password) == 0) {
if (NULL == user) {
nlog_warn("could not find user `%s`", req->name);
NEU_JSON_RESPONSE_ERROR(NEU_ERR_INVALID_USER_OR_PASSWORD, {
http_response(aio, error_code.error, result_error);
});
} else if (neu_user_check_password(user, req->pass)) {
char *token = NULL;
char *result = NULL;
@@ -76,10 +85,13 @@ void handle_login(nng_aio *aio)
jwt_free_str(token);
free(result);
} else {
nlog_warn("user `%s` password check fail", req->name);
NEU_JSON_RESPONSE_ERROR(NEU_ERR_INVALID_USER_OR_PASSWORD, {
http_response(aio, error_code.error, result_error);
});
}
neu_user_free(user);
})
}
plugins/restful/user.c
+402
View File
@@ -0,0 +1,402 @@
#include <assert.h>
#include <string.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_DEPRECATED_3_0)
#include <openssl/des.h>
#endif
#include <openssl/sha.h>
#include "user.h"
static const unsigned char cov_2char[64] = {
0x2E, 0x2F, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38,
0x39, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4A,
0x4B, 0x4C, 0x4D, 0x4E, 0x4F, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55,
0x56, 0x57, 0x58, 0x59, 0x5A, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66,
0x67, 0x68, 0x69, 0x6A, 0x6B, 0x6C, 0x6D, 0x6E, 0x6F, 0x70, 0x71,
0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 0x7A
};
static const char ascii_dollar[] = { 0x24, 0x00 };
/*
* SHA based password algorithm, describe by Ulrich Drepper here:
* https://www.akkadia.org/drepper/SHA-crypt.txt
* (note that it's in the public domain)
* See: https://github.com/openssl/openssl/blob/master/apps/passwd.c
*/
static char *shacrypt(const char *passwd, const char *magic, const char *salt)
{
/* Prefix for optional rounds specification. */
static const char rounds_prefix[] = "rounds=";
/* Maximum salt string length. */
#define SALT_LEN_MAX 16
/* Default number of rounds if not explicitly specified. */
#define ROUNDS_DEFAULT 5000
/* Minimum number of rounds. */
#define ROUNDS_MIN 1000
/* Maximum number of rounds. */
#define ROUNDS_MAX 999999999
/* "$6$rounds=<N>$......salt......$...shahash(up to 86 chars)...\0" */
size_t out_len = 3 + 17 + 17 + 86 + 1;
char * out_buf = NULL;
unsigned char buf[SHA512_DIGEST_LENGTH];
unsigned char temp_buf[SHA512_DIGEST_LENGTH];
size_t buf_size = 0;
char ascii_magic[2];
char ascii_salt[17]; /* Max 16 chars plus '\0' */
size_t n;
EVP_MD_CTX * md = NULL, *md2 = NULL;
const EVP_MD *sha = NULL;
size_t passwd_len, salt_len, magic_len;
unsigned int rounds = ROUNDS_DEFAULT; /* Default */
char rounds_custom = 0;
char * p_bytes = NULL;
char * s_bytes = NULL;
char * cp = NULL;
passwd_len = strlen(passwd);
magic_len = strlen(magic);
/* assert it's "5" or "6" */
if (magic_len != 1)
return NULL;
switch (magic[0]) {
case '5':
sha = EVP_sha256();
buf_size = 32;
break;
case '6':
sha = EVP_sha512();
buf_size = 64;
break;
default:
return NULL;
}
if (strncmp(salt, rounds_prefix, sizeof(rounds_prefix) - 1) == 0) {
const char * num = salt + sizeof(rounds_prefix) - 1;
char * endp;
unsigned long int srounds = strtoul(num, &endp, 10);
if (*endp == '$') {
salt = endp + 1;
if (srounds > ROUNDS_MAX) {
rounds = ROUNDS_MAX;
} else if (srounds < ROUNDS_MIN) {
rounds = ROUNDS_MIN;
} else {
rounds = (unsigned int) srounds;
}
rounds_custom = 1;
} else {
return NULL;
}
}
if ((out_buf = OPENSSL_zalloc(out_len)) == NULL) {
return NULL;
}
OPENSSL_strlcpy(ascii_magic, magic, sizeof(ascii_magic));
/* The salt gets truncated to 16 chars */
OPENSSL_strlcpy(ascii_salt, salt, sizeof(ascii_salt));
salt_len = strlen(ascii_salt);
out_buf[0] = 0;
OPENSSL_strlcat(out_buf, ascii_dollar, out_len);
OPENSSL_strlcat(out_buf, ascii_magic, out_len);
OPENSSL_strlcat(out_buf, ascii_dollar, out_len);
if (rounds_custom) {
char tmp_buf[80]; /* "rounds=999999999" */
sprintf(tmp_buf, "rounds=%u", rounds);
OPENSSL_strlcat(out_buf, tmp_buf, out_len);
OPENSSL_strlcat(out_buf, ascii_dollar, out_len);
}
OPENSSL_strlcat(out_buf, ascii_salt, out_len);
/* assert "$5$rounds=999999999$......salt......" */
if (strlen(out_buf) > 3 + 17 * rounds_custom + salt_len) {
goto err;
}
md = EVP_MD_CTX_new();
if (md == NULL || !EVP_DigestInit_ex(md, sha, NULL) ||
!EVP_DigestUpdate(md, passwd, passwd_len) ||
!EVP_DigestUpdate(md, ascii_salt, salt_len))
goto err;
md2 = EVP_MD_CTX_new();
if (md2 == NULL || !EVP_DigestInit_ex(md2, sha, NULL) ||
!EVP_DigestUpdate(md2, passwd, passwd_len) ||
!EVP_DigestUpdate(md2, ascii_salt, salt_len) ||
!EVP_DigestUpdate(md2, passwd, passwd_len) ||
!EVP_DigestFinal_ex(md2, buf, NULL))
goto err;
for (n = passwd_len; n > buf_size; n -= buf_size) {
if (!EVP_DigestUpdate(md, buf, buf_size))
goto err;
}
if (!EVP_DigestUpdate(md, buf, n)) {
goto err;
}
n = passwd_len;
while (n) {
if (!EVP_DigestUpdate(md,
(n & 1) ? buf : (const unsigned char *) passwd,
(n & 1) ? buf_size : passwd_len)) {
goto err;
}
n >>= 1;
}
if (!EVP_DigestFinal_ex(md, buf, NULL)) {
goto err;
}
/* P sequence */
if (!EVP_DigestInit_ex(md2, sha, NULL)) {
goto err;
}
for (n = passwd_len; n > 0; n--) {
if (!EVP_DigestUpdate(md2, passwd, passwd_len)) {
goto err;
}
}
if (!EVP_DigestFinal_ex(md2, temp_buf, NULL)) {
goto err;
}
if ((p_bytes = OPENSSL_zalloc(passwd_len)) == NULL) {
goto err;
}
for (cp = p_bytes, n = passwd_len; n > buf_size;
n -= buf_size, cp += buf_size) {
memcpy(cp, temp_buf, buf_size);
}
memcpy(cp, temp_buf, n);
/* S sequence */
if (!EVP_DigestInit_ex(md2, sha, NULL)) {
goto err;
}
for (n = 16 + buf[0]; n > 0; n--) {
if (!EVP_DigestUpdate(md2, ascii_salt, salt_len)) {
goto err;
}
}
if (!EVP_DigestFinal_ex(md2, temp_buf, NULL)) {
goto err;
}
if ((s_bytes = OPENSSL_zalloc(salt_len)) == NULL) {
goto err;
}
for (cp = s_bytes, n = salt_len; n > buf_size;
n -= buf_size, cp += buf_size) {
memcpy(cp, temp_buf, buf_size);
}
memcpy(cp, temp_buf, n);
for (n = 0; n < rounds; n++) {
if (!EVP_DigestInit_ex(md2, sha, NULL)) {
goto err;
}
if (!EVP_DigestUpdate(md2,
(n & 1) ? (const unsigned char *) p_bytes : buf,
(n & 1) ? passwd_len : buf_size)) {
goto err;
}
if (n % 3) {
if (!EVP_DigestUpdate(md2, s_bytes, salt_len)) {
goto err;
}
}
if (n % 7) {
if (!EVP_DigestUpdate(md2, p_bytes, passwd_len)) {
goto err;
}
}
if (!EVP_DigestUpdate(md2,
(n & 1) ? buf : (const unsigned char *) p_bytes,
(n & 1) ? buf_size : passwd_len)) {
goto err;
}
if (!EVP_DigestFinal_ex(md2, buf, NULL)) {
goto err;
}
}
EVP_MD_CTX_free(md2);
EVP_MD_CTX_free(md);
md2 = NULL;
md = NULL;
OPENSSL_free(p_bytes);
OPENSSL_free(s_bytes);
p_bytes = NULL;
s_bytes = NULL;
cp = out_buf + strlen(out_buf);
*cp++ = ascii_dollar[0];
#define b64_from_24bit(B2, B1, B0, N) \
do { \
unsigned int w = ((B2) << 16) | ((B1) << 8) | (B0); \
int i = (N); \
while (i-- > 0) { \
*cp++ = cov_2char[w & 0x3f]; \
w >>= 6; \
} \
} while (0)
switch (magic[0]) {
case '5':
b64_from_24bit(buf[0], buf[10], buf[20], 4);
b64_from_24bit(buf[21], buf[1], buf[11], 4);
b64_from_24bit(buf[12], buf[22], buf[2], 4);
b64_from_24bit(buf[3], buf[13], buf[23], 4);
b64_from_24bit(buf[24], buf[4], buf[14], 4);
b64_from_24bit(buf[15], buf[25], buf[5], 4);
b64_from_24bit(buf[6], buf[16], buf[26], 4);
b64_from_24bit(buf[27], buf[7], buf[17], 4);
b64_from_24bit(buf[18], buf[28], buf[8], 4);
b64_from_24bit(buf[9], buf[19], buf[29], 4);
b64_from_24bit(0, buf[31], buf[30], 3);
break;
case '6':
b64_from_24bit(buf[0], buf[21], buf[42], 4);
b64_from_24bit(buf[22], buf[43], buf[1], 4);
b64_from_24bit(buf[44], buf[2], buf[23], 4);
b64_from_24bit(buf[3], buf[24], buf[45], 4);
b64_from_24bit(buf[25], buf[46], buf[4], 4);
b64_from_24bit(buf[47], buf[5], buf[26], 4);
b64_from_24bit(buf[6], buf[27], buf[48], 4);
b64_from_24bit(buf[28], buf[49], buf[7], 4);
b64_from_24bit(buf[50], buf[8], buf[29], 4);
b64_from_24bit(buf[9], buf[30], buf[51], 4);
b64_from_24bit(buf[31], buf[52], buf[10], 4);
b64_from_24bit(buf[53], buf[11], buf[32], 4);
b64_from_24bit(buf[12], buf[33], buf[54], 4);
b64_from_24bit(buf[34], buf[55], buf[13], 4);
b64_from_24bit(buf[56], buf[14], buf[35], 4);
b64_from_24bit(buf[15], buf[36], buf[57], 4);
b64_from_24bit(buf[37], buf[58], buf[16], 4);
b64_from_24bit(buf[59], buf[17], buf[38], 4);
b64_from_24bit(buf[18], buf[39], buf[60], 4);
b64_from_24bit(buf[40], buf[61], buf[19], 4);
b64_from_24bit(buf[62], buf[20], buf[41], 4);
b64_from_24bit(0, 0, buf[63], 2);
break;
default:
goto err;
}
*cp = '\0';
return out_buf;
err:
EVP_MD_CTX_free(md2);
EVP_MD_CTX_free(md);
OPENSSL_free(p_bytes);
OPENSSL_free(s_bytes);
OPENSSL_free(out_buf);
return NULL;
}
// NOTE: if provided, require salt length of 16
static char *hash_password(const char *passwd, const char *salt)
{
char * hash = NULL;
char * salt_p = NULL;
const size_t saltlen = 16;
// first make sure we have a salt
if (NULL == salt) {
salt = salt_p = malloc(saltlen + 1);
if (RAND_bytes((unsigned char *) salt_p, saltlen) <= 0) {
goto end;
}
size_t i;
for (i = 0; i < saltlen; i++) {
salt_p[i] = cov_2char[salt_p[i] & 0x3f]; /* 6 bits */
}
salt_p[i] = 0;
}
assert(salt != NULL);
hash = shacrypt(passwd, "5", salt);
end:
free(salt_p);
return hash;
}
neu_user_t *neu_user_new(const char *name, const char *password)
{
neu_user_t *user = malloc(sizeof(*user));
if (NULL == user) {
return NULL;
}
user->name = strdup(name);
user->hash = hash_password(password, NULL);
if (NULL == user->name || NULL == user->hash) {
free(user->name);
free(user->hash);
free(user);
return NULL;
}
return user;
}
void neu_user_free(neu_user_t *user)
{
if (NULL != user) {
free(user->name);
free(user->hash);
free(user);
}
}
bool neu_user_check_password(neu_user_t *user, const char *password)
{
char *salt = user->hash + 3;
char *hash = hash_password(password, salt);
bool pass = NULL != hash && 0 == strcmp(user->hash, hash);
free(hash);
return pass;
}
neu_user_t *neu_load_user(neu_persister_t *persister, const char *name)
{
neu_user_t *user = malloc(sizeof(*user));
if (NULL == user) {
return NULL;
}
neu_persist_user_info_t *info = NULL;
if (0 != neu_persister_load_user(persister, name, &info)) {
free(user);
return NULL;
}
user->name = info->name;
user->hash = info->hash;
free(info);
return user;
}
plugins/restful/user.h
+46
View File
@@ -0,0 +1,46 @@
/**
* NEURON IIoT System for Industry 4.0
* Copyright (C) 2020-2022 EMQ Technologies Co., Ltd All rights reserved.
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 3 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program; if not, write to the Free Software Foundation,
* Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
**/
#ifndef NEURON_REST_USER_H
#define NEURON_REST_USER_H
#ifdef __cplusplus
extern "C" {
#endif
#include <stdbool.h>
#include "persist/persist.h"
typedef struct {
char *name;
char *hash;
} neu_user_t;
neu_user_t *neu_user_new(const char *name, const char *password);
void neu_user_free(neu_user_t *user);
bool neu_user_check_password(neu_user_t *user, const char *password);
neu_user_t *neu_load_user(neu_persister_t *persister, const char *name);
#ifdef __cplusplus
}
#endif
#endif
src/persist/persist.c
+78
View File
@@ -1224,3 +1224,81 @@ int neu_persister_delete_node_setting(neu_persister_t *persister,
return execute_sql(persister->db, "DELETE FROM settings WHERE node_name=%Q",
node_name);
}
int neu_persister_store_user(neu_persister_t * persister,
const neu_persist_user_info_t *user)
{
return execute_sql(persister->db,
"INSERT INTO users (name, password) VALUES (%Q, %Q)",
user->name, user->hash);
}
int neu_persister_update_user(neu_persister_t * persister,
const neu_persist_user_info_t *user)
{
return execute_sql(persister->db,
"UPDATE users SET password=%Q WHERE name=%Q", user->hash,
user->name);
}
int neu_persister_load_user(neu_persister_t *persister, const char *user_name,
neu_persist_user_info_t **user_p)
{
neu_persist_user_info_t *user = NULL;
sqlite3_stmt * stmt = NULL;
const char * query = "SELECT password FROM users WHERE name=?";
if (SQLITE_OK !=
sqlite3_prepare_v2(persister->db, query, -1, &stmt, NULL)) {
nlog_error("prepare `%s` with `%s` fail: %s", query, user_name,
sqlite3_errmsg(persister->db));
return NEU_ERR_EINTERNAL;
}
if (SQLITE_OK != sqlite3_bind_text(stmt, 1, user_name, -1, NULL)) {
nlog_error("bind `%s` with `%s` fail: %s", query, user_name,
sqlite3_errmsg(persister->db));
goto error;
}
if (SQLITE_ROW != sqlite3_step(stmt)) {
nlog_warn("SQL `%s` with `%s` fail: %s", query, user_name,
sqlite3_errmsg(persister->db));
goto error;
}
user = calloc(1, sizeof(*user));
if (NULL == user) {
goto error;
}
user->hash = strdup((char *) sqlite3_column_text(stmt, 0));
if (NULL == user->hash) {
nlog_error("strdup fail");
goto error;
}
user->name = strdup(user_name);
if (NULL == user->name) {
nlog_error("strdup fail");
goto error;
}
*user_p = user;
sqlite3_finalize(stmt);
return 0;
error:
if (user) {
neu_persist_user_info_fini(user);
free(user);
}
sqlite3_finalize(stmt);
return NEU_ERR_EINTERNAL;
}
int neu_persister_delete_user(neu_persister_t *persister, const char *user_name)
{
return execute_sql(persister->db, "DELETE FROM users WHERE name=%Q",
user_name);
}
src/persist/persist.h
+48
View File
@@ -46,6 +46,11 @@ typedef struct {
char *group_name;
} neu_persist_subscription_info_t;
typedef struct {
char *name;
char *hash;
} neu_persist_user_info_t;
static inline void neu_persist_plugin_infos_free(UT_array *plugin_infos)
{
utarray_free(plugin_infos);
@@ -69,6 +74,12 @@ neu_persist_subscription_info_fini(neu_persist_subscription_info_t *info)
free(info->group_name);
}
static inline void neu_persist_user_info_fini(neu_persist_user_info_t *info)
{
free(info->name);
free(info->hash);
}
/**
* Persister, provide methods to persist data */
typedef struct neu_persister neu_persister_t;
@@ -305,6 +316,43 @@ int neu_persister_load_node_setting(neu_persister_t * persister,
int neu_persister_delete_node_setting(neu_persister_t *persister,
const char * node_name);
/**
* Save user info.
* @param persister persister object.
* @param user user info
* @return 0 on success, none-zero on failure
*/
int neu_persister_store_user(neu_persister_t * persister,
const neu_persist_user_info_t *user);
/**
* Update user info.
* @param persister persister object.
* @param user user info
* @return 0 on success, none-zero on failure
*/
int neu_persister_update_user(neu_persister_t * persister,
const neu_persist_user_info_t *user);
/**
* Load user info.
* @param persister persister object.
* @param user_name name of the user.
* @param user_p output parameter of user info
* @return 0 on success, none-zero on failure
*/
int neu_persister_load_user(neu_persister_t *persister, const char *user_name,
neu_persist_user_info_t **user_p);
/**
* Delete user info.
* @param persister persister object.
* @param user_name name of the user.
* @return 0 on success, none-zero on failure
*/
int neu_persister_delete_user(neu_persister_t *persister,
const char * user_name);
#ifdef __cplusplus
}
#endif