From e466f25ecfa356137523ee597b9fc6ab0da5df22 Mon Sep 17 00:00:00 2001 From: Yigit Sever Date: Wed, 14 Apr 2021 03:27:27 +0300 Subject: [WIP] Initial implementation of user auth There is a dance involved and everything Write down specs for RSA and AES, padding scheme, ugh. --- src/custom_filters.rs | 8 ++++---- src/handlers.rs | 34 ++++++++++++++++++++++++++++++++-- src/lib.rs | 40 +++++++++++++++++++++++++++++++++++++++- src/schema.rs | 9 ++++++++- 4 files changed, 83 insertions(+), 8 deletions(-) (limited to 'src') diff --git a/src/custom_filters.rs b/src/custom_filters.rs index ae8a56c..299cd8d 100644 --- a/src/custom_filters.rs +++ b/src/custom_filters.rs @@ -1,5 +1,5 @@ /// Functions that extracts Structs to be used in warp routines -use crate::schema::{AuthRequest, Block, Db, Transaction}; +use crate::schema::{Block, Db, InitialAuthRequest, Transaction}; use std::convert::Infallible; use warp::{Filter, Rejection}; @@ -8,12 +8,12 @@ pub fn with_db(db: Db) -> impl Filter + Clo warp::any().map(move || db.clone()) } -/// Extracts an `AuthRequest` JSON body from the request +/// Extracts an `InitialAuthRequest` JSON body from the request /// Accepts only JSON encoded `AuthRequest` body and rejects big payloads /// // TODO: find a good limit for this, (=e2482057; 8 char String + rsa pem) <11-04-21, yigit> // -pub fn auth_request_json_body() -> impl Filter + Clone -{ +pub fn auth_request_json_body( +) -> impl Filter + Clone { warp::body::content_length_limit(1024 * 32).and(warp::body::json()) } diff --git a/src/handlers.rs b/src/handlers.rs index b9df931..9d1bb10 100644 --- a/src/handlers.rs +++ b/src/handlers.rs @@ -1,3 +1,4 @@ +use base64; /// API handlers, the ends of each filter chain use blake2::{Blake2s, Digest}; use jsonwebtoken::errors::ErrorKind; @@ -5,12 +6,16 @@ use jsonwebtoken::{decode, Algorithm, DecodingKey, TokenData, Validation}; use log::{debug, warn}; use md5::Md5; use parking_lot::RwLockUpgradableReadGuard; +use rsa::{PaddingScheme, RSAPrivateKey}; use serde::Serialize; use serde_json; +use sha2; use std::convert::Infallible; use std::fs; use warp::{http::StatusCode, reply}; +use crate::PRIVATE_KEY; + #[derive(Serialize, Debug)] struct GradeCoinResponse { res: ResponseType, @@ -23,7 +28,9 @@ enum ResponseType { Error, } -use crate::schema::{AuthRequest, Block, Claims, Db, MetuId, NakedBlock, Transaction, User}; +use crate::schema::{ + AuthRequest, Block, Claims, Db, InitialAuthRequest, MetuId, NakedBlock, Transaction, User, +}; const BEARER: &str = "Bearer "; @@ -32,11 +39,34 @@ const BEARER: &str = "Bearer "; /// Lets a [`User`] (=student) to authenticate themselves to the system /// This `request` can be rejected if the payload is malformed (= not authenticated properly) or if /// the [`AuthRequest.user_id`] of the `request` is not in the list of users that can hold a Gradecoin account +/// The request first comes in encrypted pub async fn authenticate_user( - request: AuthRequest, + request: InitialAuthRequest, db: Db, ) -> Result { debug!("POST request to /register, authenticate_user"); + + // TODO: lazyload or something <14-04-21, yigit> // + let der_encoded = PRIVATE_KEY + .lines() + .filter(|line| !line.starts_with("-")) + .fold(String::new(), |mut data, line| { + data.push_str(&line); + data + }); + let der_bytes = base64::decode(&der_encoded).expect("failed to decode base64 content"); + let private_key = RSAPrivateKey::from_pkcs1(&der_bytes).expect("failed to parse key"); + + let padding = PaddingScheme::new_oaep::(); + let dec_key = private_key + .decrypt(padding, &request.key.as_bytes()) + .expect("failed to decrypt"); + + // then decrypt c using key dec_key + + // let request: AuthRequest = serde_json::from_str(&String::from_utf8(dec_data).unwrap()).unwrap(); + let request; + let provided_id = request.student_id.clone(); let priv_student_id = match MetuId::new(request.student_id, request.passwd) { diff --git a/src/lib.rs b/src/lib.rs index 42def0f..7a24f9f 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -22,7 +22,45 @@ //! `Authorization`: The request header should have Bearer JWT.Token signed with Student Public Key pub mod custom_filters; +pub mod error; pub mod handlers; pub mod routes; pub mod schema; -pub mod error; + +pub const PRIVATE_KEY: &'static str = "-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAyGuqiCPGcguy+Y9TH7Bl7XlEsalyqb9bYlzpbV0dnqZ3lPkE +PkuOhkN+GcuiV6iXtSwyh7nB+xTRXKJFRUBO/jbN8jfcxVwBu0JxjF3v1YRBxbOH +hz2A295mbKD9xHQCKxkfYBNkUXxj8gd+GaDvQiSW5NdrX/lEkvqfGtdEX1m2+Hdc +G0+3YW24Xg0znhCwLr+sorLuJaDy9Xa0Uo+DPWGC5s001U/BxkCIWJ+eJQCb7Bv+ +9vXb8BGRK/ecMb/fb6h5O+8fgB64RCHMgcc2v+Q/dPt8kHX1OJdMuYUrUJGACppM +QY3W6e1HdlRIBcZKL2LMZ2CrIB/2D5LiJhPThQIDAQABAoIBABbHrg1lS5QA4mnd +MYyDh0JTq0wqP18t4dwvRVTp5Yj30NW87A+MlPmLyFR0QdKG1h+Ak4m7wmGgfx9x +TkBNy+y3G/dxBAXmrEe1iKR0tOLm8nbfLgNgKTpUb/3e2pkuumRdqaRI7/kXE2Ea +Guoc0bUJ5aDDH3A8K+As3lK1rw7LNxwxZdmqmpO+EAldP6NaLnXNP5BegjLK50xP +NXTDNx6pw+I2ZHHwC/A6+QVksSA6zPipI1poANaO0frHffwKhcEZ/VucuXlJGGq/ +aqXT/cc7IkKUVq8EZUwUqHi4SrnyDDq/mtuikSD0MazxumbeC6fBKRP98Kavy2rT +JItHSYECgYEA8H/yC9GDrR1bwBesD0pKdKBy18UMFQF3BrB04OjqdGzugdVafF4e +7azYQQTQ0ZddLDvgYl0QYvQaZfv26L7o4VrN5XEg8WjUWKuww8XUYOCfPn4gOFL1 +ar8nQ0w3P65gYf/rw0rFMo3eB78rJMROYnG8nZ/3OdgQjVaYPJxFKmECgYEA1VZy +EQz8dHK3+F0EfQIFeXOSlYGUegmPZ9iYmh+yvW/zWKLYdXBEHNhAIRlBmfe7Yhj6 +1FNluNGjFqZYuRnP0RuiBxt2RCd+AL90Lqq+O6jem4XNgr3cOKoaV0FbaU49sI4s +/B6iiYBFdVuPBiknz+Wf1KEF9lQ+w2VYSLucY6UCgYAWPe73ste3sehjWo0aGOfL +427bj6ivZKRKZRVaG5BbVhu0vDOTHu1DU+HoGXbqe1ItnhgBYNP8ItEyL1xFaCqH +dOtn1c+TI/vHe5FseaZLk1qG4AlAzENQLP+HlMvjQtA9H/sA47BbHY20L7TgwJrz +NcuY1Et7+QSG3cRUjqtC4QKBgGuP+VUVehfwW0dzBrdMlJwGpGqS+dyKA271awOS +ZdlTn5saCA82OnFcqwDFLilGGYk9VQJGxivoLtVVq7gwBnLE/u2ccAWu773KyfZZ +ii6kVxCM5vA7b9R2F2/U+RTgKQRiutWnUIYJUXv5XORbTcJpYSugwFPRaA+2gkux +pAktAoGABRyVs5LOhQ/oeXe2H2kvuaUq9c7f/dTtnyMNdNxK0uZcQn4jcB2eK9kB +PDYHM9dfQ8xn51U0fTeaXjy/8Km8fyX2Jtxntlm6puyhSTJ8AX+FEgJkC4ajNEvA +mJ1Gsy2fXKUyyZdI2b74MLqOpzr9cvS60tmTIScuiHFzg/SJgiA= +-----END RSA PRIVATE KEY-----"; + +pub const PUB_KEY: &'static str = "-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGuqiCPGcguy+Y9TH7Bl +7XlEsalyqb9bYlzpbV0dnqZ3lPkEPkuOhkN+GcuiV6iXtSwyh7nB+xTRXKJFRUBO +/jbN8jfcxVwBu0JxjF3v1YRBxbOHhz2A295mbKD9xHQCKxkfYBNkUXxj8gd+GaDv +QiSW5NdrX/lEkvqfGtdEX1m2+HdcG0+3YW24Xg0znhCwLr+sorLuJaDy9Xa0Uo+D +PWGC5s001U/BxkCIWJ+eJQCb7Bv+9vXb8BGRK/ecMb/fb6h5O+8fgB64RCHMgcc2 +v+Q/dPt8kHX1OJdMuYUrUJGACppMQY3W6e1HdlRIBcZKL2LMZ2CrIB/2D5LiJhPT +hQIDAQAB +-----END PUBLIC KEY-----"; diff --git a/src/schema.rs b/src/schema.rs index 9e157c7..f159d83 100644 --- a/src/schema.rs +++ b/src/schema.rs @@ -178,7 +178,7 @@ pub struct MetuId { passwd: String, } -// TODO: this will arrive encrypted <13-04-21, yigit> // +/// The plaintext of the initial user authentication request #[derive(Serialize, Deserialize, Debug, PartialEq)] pub struct AuthRequest { pub student_id: String, @@ -186,6 +186,13 @@ pub struct AuthRequest { pub public_key: String, } +/// Ciphertext of the initial authentication request, or what we will receive +#[derive(Serialize, Deserialize, Debug)] +pub struct InitialAuthRequest { + pub c: String, + pub key: String, +} + lazy_static! { static ref OUR_STUDENTS: HashSet<(&'static str, &'static str)> = { [ -- cgit v1.2.3-70-g09d2