auth.h

Go to the documentation of this file.

// Copyright (c) 2023 anabrid GmbH
// Contact: https://www.anabrid.com/licensing/
// SPDX-License-Identifier: MIT OR GPL-2.0-or-later
 
#pragma once
 
#ifdef ARDUINO
 
#include <IPAddress.h>
#include <Printable.h>
#include <cstring>
#include <list>
#include <map>
 
#include "utils/durations.h"
#include "utils/json.h"
#include "utils/mac.h"
#include "utils/singleton.h"
 
#include "nvmconfig/persistent.h"
 
namespace net {
 
namespace auth {
 
enum class SecurityLevel { RequiresAdmin, RequiresLogin, RequiresNothing };
 
using User = std::string;
 
class AuthentificationContext; // defined below
 
class UserPasswordAuthentification {
  // bool enable_authentification;
  std::map<User, std::string> db;
 
public:
  static constexpr const char *admin = "admin";
 
  static constexpr const char *user = "user";
 
  void reset_defaults(); 
 
  bool is_disabled() const { return /* !enable_authentification ||*/ db.empty(); }
 
  bool is_valid(const User &user, const std::string &pwd) {
    return /*is_disabled() ||*/ (db.count(user) && db[user] == pwd);
  }
 
  bool can_do(const User &user, SecurityLevel task) const {
    // if(is_disabled()) return true;
    if (task == SecurityLevel::RequiresAdmin)
      return user == admin;
    if (task == SecurityLevel::RequiresLogin)
      return !user.empty();
    /* if RequiresNothing */ return true;
  }
 
  // note that these serializations deal with the sensitive user+password information
  // and are only used for eeprom::UserSettings.
  void fromJson(JsonObjectConst serialized_conf);
  void toJson(JsonObject target) const;
 
  // if you want to let (any) remote users know something, use this
  void status(JsonObject target);
};
 
JSON_CONVERT_SUGAR(UserPasswordAuthentification);
 
class RemoteIdentifier { // : public Printable { // no inheritance for POD
public:
  IPAddress ip;
 
  bool isLocal() const {
    return ip[0] == 0 && ip[1] == 0 && ip[2] == 0 && ip[3] == 0;
  } // (uint32_t)ip) doesnt work
 
  size_t printTo(Print &p) const { return isLocal() ? p.print("[serial-local]") : ip.printTo(p); }
};
 
struct DeviceLock {
  User holder;
  utils::duration locked_at;
  static constexpr utils::time_ms max_lock_duration = 3 * 60 * 1000; // 3min...
 
  void check() {
    if (locked_at.expired(max_lock_duration))
      /* force_unlock(): */ holder.clear();
  }
 
  bool is_locked() {
    check();
    return !holder.empty();
  }
 
  void force_unlock() { holder.clear(); }
 
  void enable_lock(const User &user) {
    holder = user;
    locked_at.reset();
  }
};
 
class FailToBan {
  uint8_t max_known_stations = 20;
  constexpr static utils::time_ms max_waiting_time = 10 * 1000; // 10sec
 
  struct EndpointInformation {
    IPAddress ip;
    utils::duration last_failure;
    uint8_t failures = 0;
  };
 
  std::list<EndpointInformation> endpoints;
 
  void clean() {
    if (endpoints.size() >= max_known_stations)
      endpoints.pop_front();
    endpoints.remove_if([](EndpointInformation &a) { return a.last_failure.expired(max_waiting_time); });
  }
 
  EndpointInformation *find(const IPAddress &ip) {
    for (auto &e : endpoints)
      if (e.ip == ip)
        return &e;
    return nullptr;
  }
 
public:
  utils::time_ms failure_time(const IPAddress &ip) {
    clean();
    EndpointInformation *e;
    uint8_t failures = 1;
    if ((e = find(ip)))
      failures = ++e->failures;
    else
      endpoints.push_back({ip, utils::duration(), failures});
    return failures * failures * 100; // roughly 1sec after 3 attempts then up to 10secs timeout
  }
};
 
struct Gatekeeper : public nvmconfig::PersistentSettings, public utils::HeapSingleton<Gatekeeper> {
  bool enable_auth,      
       enable_users,     
       enable_whitelist; 
 
  UserPasswordAuthentification users;
  utils::IPMaskList whitelist;
 
  DeviceLock lock;
  FailToBan ban;
 
  std::string access_control_allow_origin; 
  // TODO, check also websocket_upgrade Origin field.
 
  int login(JsonObjectConst msg_in, JsonObject &msg_out, AuthentificationContext &user_context);
  int lock_acquire(JsonObjectConst msg_in, JsonObject &msg_out, AuthentificationContext &user_context);
  int lock_release(JsonObjectConst msg_in, JsonObject &msg_out, AuthentificationContext &user_context);
 
 
  std::string name() const { return "auth"; }
 
  void reset_defaults() override;
 
  void fromJson(JsonObjectConst src, nvmconfig::Context c = nvmconfig::Context::Flash) override {
    JSON_GET(src, enable_auth);
    JSON_GET(src, enable_users);
    JSON_GET(src, enable_whitelist);
    JSON_GET(src, users);
    JSON_GET(src, whitelist);
    JSON_GET_AS(src, access_control_allow_origin, std::string);
  }
 
  void toJson(JsonObject target, nvmconfig::Context c = nvmconfig::Context::Flash) const override {
    JSON_SET(target, enable_auth);
    JSON_SET(target, enable_users);
    JSON_SET(target, enable_whitelist);
    JSON_SET(target, users);
    JSON_SET(target, whitelist);
    JSON_SET(target, access_control_allow_origin);
  }
};
 
JSON_CONVERT_SUGAR(Gatekeeper);
 
class AuthentificationContext : public Printable {
  static UserPasswordAuthentification &auth() { return Gatekeeper::get().users; }
 
  RemoteIdentifier _remote;
  User _user;
 
public:
  AuthentificationContext(User user) : _user(user) {}
 
  AuthentificationContext() {}
 
  void set_remote_identifier(RemoteIdentifier r) { _remote = r; }
 
  bool can_do(SecurityLevel task) const {
    // TODO Also implement IP-based access here
    #ifdef ANABRID_UNSAFE_INTERNET
    return true;
    #else
    return !Gatekeeper::get().enable_auth || !Gatekeeper::get().enable_users || auth().can_do(_user, task);
    #endif
  }
 
  bool hasBetterClearenceThen(const User &other) const {
    return (can_do(SecurityLevel::RequiresAdmin) && !auth().can_do(other, SecurityLevel::RequiresAdmin)) ||
           (can_do(SecurityLevel::RequiresLogin) && !auth().can_do(other, SecurityLevel::RequiresLogin));
  }
 
  void login(const User &user) { _user = user; }
 
  User user() const { return _user.empty() ? "[nobody]" : _user; }
 
  size_t printTo(Print &p) const override {
    return p.print(user().c_str()) + p.print("@") + _remote.printTo(p);
  }
};
 
} // namespace auth
} // namespace net
 
#endif // ARDUINO