mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-12-05 07:12:50 +01:00
d71a8cc9fb
- In Go 1.21 the crypto/sha256 [got a massive improvement](https://go.dev/doc/go1.21#crypto/sha256) by utilizing the SHA instructions for AMD64 CPUs, which sha256-simd already was doing. The performance is now on par and I think it's preferable to use the standard library rather than a package when possible. ``` cpu: AMD Ryzen 5 3600X 6-Core Processor │ simd.txt │ go.txt │ │ sec/op │ sec/op vs base │ Hash/8Bytes-12 63.25n ± 1% 73.38n ± 1% +16.02% (p=0.002 n=6) Hash/64Bytes-12 98.73n ± 1% 105.30n ± 1% +6.65% (p=0.002 n=6) Hash/1K-12 567.2n ± 1% 572.8n ± 1% +0.99% (p=0.002 n=6) Hash/8K-12 4.062µ ± 1% 4.062µ ± 1% ~ (p=0.396 n=6) Hash/1M-12 512.1µ ± 0% 510.6µ ± 1% ~ (p=0.485 n=6) Hash/5M-12 2.556m ± 1% 2.564m ± 0% ~ (p=0.093 n=6) Hash/10M-12 5.112m ± 0% 5.127m ± 0% ~ (p=0.093 n=6) geomean 13.82µ 14.27µ +3.28% │ simd.txt │ go.txt │ │ B/s │ B/s vs base │ Hash/8Bytes-12 120.6Mi ± 1% 104.0Mi ± 1% -13.81% (p=0.002 n=6) Hash/64Bytes-12 618.2Mi ± 1% 579.8Mi ± 1% -6.22% (p=0.002 n=6) Hash/1K-12 1.682Gi ± 1% 1.665Gi ± 1% -0.98% (p=0.002 n=6) Hash/8K-12 1.878Gi ± 1% 1.878Gi ± 1% ~ (p=0.310 n=6) Hash/1M-12 1.907Gi ± 0% 1.913Gi ± 1% ~ (p=0.485 n=6) Hash/5M-12 1.911Gi ± 1% 1.904Gi ± 0% ~ (p=0.093 n=6) Hash/10M-12 1.910Gi ± 0% 1.905Gi ± 0% ~ (p=0.093 n=6) geomean 1.066Gi 1.032Gi -3.18% ``` (cherry picked from commitabd94ff5b5
) (cherry picked from commit15e81637ab
) Conflicts: go.mod https://codeberg.org/forgejo/forgejo/pulls/1581 (cherry picked from commit 5caea2d75aeac78fb306f58a3cf7809d5b70c7f2) (cherry picked from commit08da542cce
)
166 lines
4.7 KiB
Go
166 lines
4.7 KiB
Go
// Copyright 2017 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package auth
|
|
|
|
import (
|
|
"context"
|
|
"crypto/md5"
|
|
"crypto/sha256"
|
|
"crypto/subtle"
|
|
"encoding/base32"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"fmt"
|
|
|
|
"code.gitea.io/gitea/models/db"
|
|
"code.gitea.io/gitea/modules/secret"
|
|
"code.gitea.io/gitea/modules/setting"
|
|
"code.gitea.io/gitea/modules/timeutil"
|
|
"code.gitea.io/gitea/modules/util"
|
|
|
|
"github.com/pquerna/otp/totp"
|
|
"golang.org/x/crypto/pbkdf2"
|
|
)
|
|
|
|
//
|
|
// Two-factor authentication
|
|
//
|
|
|
|
// ErrTwoFactorNotEnrolled indicates that a user is not enrolled in two-factor authentication.
|
|
type ErrTwoFactorNotEnrolled struct {
|
|
UID int64
|
|
}
|
|
|
|
// IsErrTwoFactorNotEnrolled checks if an error is a ErrTwoFactorNotEnrolled.
|
|
func IsErrTwoFactorNotEnrolled(err error) bool {
|
|
_, ok := err.(ErrTwoFactorNotEnrolled)
|
|
return ok
|
|
}
|
|
|
|
func (err ErrTwoFactorNotEnrolled) Error() string {
|
|
return fmt.Sprintf("user not enrolled in 2FA [uid: %d]", err.UID)
|
|
}
|
|
|
|
// Unwrap unwraps this as a ErrNotExist err
|
|
func (err ErrTwoFactorNotEnrolled) Unwrap() error {
|
|
return util.ErrNotExist
|
|
}
|
|
|
|
// TwoFactor represents a two-factor authentication token.
|
|
type TwoFactor struct {
|
|
ID int64 `xorm:"pk autoincr"`
|
|
UID int64 `xorm:"UNIQUE"`
|
|
Secret string
|
|
ScratchSalt string
|
|
ScratchHash string
|
|
LastUsedPasscode string `xorm:"VARCHAR(10)"`
|
|
CreatedUnix timeutil.TimeStamp `xorm:"INDEX created"`
|
|
UpdatedUnix timeutil.TimeStamp `xorm:"INDEX updated"`
|
|
}
|
|
|
|
func init() {
|
|
db.RegisterModel(new(TwoFactor))
|
|
}
|
|
|
|
// GenerateScratchToken recreates the scratch token the user is using.
|
|
func (t *TwoFactor) GenerateScratchToken() (string, error) {
|
|
tokenBytes, err := util.CryptoRandomBytes(6)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
// these chars are specially chosen, avoid ambiguous chars like `0`, `O`, `1`, `I`.
|
|
const base32Chars = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
|
|
token := base32.NewEncoding(base32Chars).WithPadding(base32.NoPadding).EncodeToString(tokenBytes)
|
|
t.ScratchSalt, _ = util.CryptoRandomString(10)
|
|
t.ScratchHash = HashToken(token, t.ScratchSalt)
|
|
return token, nil
|
|
}
|
|
|
|
// HashToken return the hashable salt
|
|
func HashToken(token, salt string) string {
|
|
tempHash := pbkdf2.Key([]byte(token), []byte(salt), 10000, 50, sha256.New)
|
|
return hex.EncodeToString(tempHash)
|
|
}
|
|
|
|
// VerifyScratchToken verifies if the specified scratch token is valid.
|
|
func (t *TwoFactor) VerifyScratchToken(token string) bool {
|
|
if len(token) == 0 {
|
|
return false
|
|
}
|
|
tempHash := HashToken(token, t.ScratchSalt)
|
|
return subtle.ConstantTimeCompare([]byte(t.ScratchHash), []byte(tempHash)) == 1
|
|
}
|
|
|
|
func (t *TwoFactor) getEncryptionKey() []byte {
|
|
k := md5.Sum([]byte(setting.SecretKey))
|
|
return k[:]
|
|
}
|
|
|
|
// SetSecret sets the 2FA secret.
|
|
func (t *TwoFactor) SetSecret(secretString string) error {
|
|
secretBytes, err := secret.AesEncrypt(t.getEncryptionKey(), []byte(secretString))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
t.Secret = base64.StdEncoding.EncodeToString(secretBytes)
|
|
return nil
|
|
}
|
|
|
|
// ValidateTOTP validates the provided passcode.
|
|
func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
|
|
decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
secretBytes, err := secret.AesDecrypt(t.getEncryptionKey(), decodedStoredSecret)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
secretStr := string(secretBytes)
|
|
return totp.Validate(passcode, secretStr), nil
|
|
}
|
|
|
|
// NewTwoFactor creates a new two-factor authentication token.
|
|
func NewTwoFactor(ctx context.Context, t *TwoFactor) error {
|
|
_, err := db.GetEngine(ctx).Insert(t)
|
|
return err
|
|
}
|
|
|
|
// UpdateTwoFactor updates a two-factor authentication token.
|
|
func UpdateTwoFactor(ctx context.Context, t *TwoFactor) error {
|
|
_, err := db.GetEngine(ctx).ID(t.ID).AllCols().Update(t)
|
|
return err
|
|
}
|
|
|
|
// GetTwoFactorByUID returns the two-factor authentication token associated with
|
|
// the user, if any.
|
|
func GetTwoFactorByUID(ctx context.Context, uid int64) (*TwoFactor, error) {
|
|
twofa := &TwoFactor{}
|
|
has, err := db.GetEngine(ctx).Where("uid=?", uid).Get(twofa)
|
|
if err != nil {
|
|
return nil, err
|
|
} else if !has {
|
|
return nil, ErrTwoFactorNotEnrolled{uid}
|
|
}
|
|
return twofa, nil
|
|
}
|
|
|
|
// HasTwoFactorByUID returns the two-factor authentication token associated with
|
|
// the user, if any.
|
|
func HasTwoFactorByUID(ctx context.Context, uid int64) (bool, error) {
|
|
return db.GetEngine(ctx).Where("uid=?", uid).Exist(&TwoFactor{})
|
|
}
|
|
|
|
// DeleteTwoFactorByID deletes two-factor authentication token by given ID.
|
|
func DeleteTwoFactorByID(ctx context.Context, id, userID int64) error {
|
|
cnt, err := db.GetEngine(ctx).ID(id).Delete(&TwoFactor{
|
|
UID: userID,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
} else if cnt != 1 {
|
|
return ErrTwoFactorNotEnrolled{userID}
|
|
}
|
|
return nil
|
|
}
|