From 29bdd2f8fbac54d98fbcd2c1442ae4f337c2d711 Mon Sep 17 00:00:00 2001 From: andrea Date: Wed, 13 May 2015 22:25:05 +0200 Subject: [PATCH] Modified the format of password_file.conf now accept only sha256 hashed passwords --- broker/config/password_file.conf | 3 +- broker/pom.xml | 6 ++ .../moquette/spi/impl/FileAuthenticator.java | 56 +++++++++++++------ .../spi/impl/FileAuthenticatorTest.java | 6 +- .../test/resources/config/password_file.conf | 3 +- broker/src/test/resources/password_file.conf | 3 +- 6 files changed, 54 insertions(+), 23 deletions(-) diff --git a/broker/config/password_file.conf b/broker/config/password_file.conf index de74f4d7..d7033982 100644 --- a/broker/config/password_file.conf +++ b/broker/config/password_file.conf @@ -1 +1,2 @@ -testuser:passwd \ No newline at end of file +#the password is sha256(passwd) +testuser:36767030e79073783c8e9b299d9f8f1d4cd66baa82cd8869caad8dbb55204099 \ No newline at end of file diff --git a/broker/pom.xml b/broker/pom.xml index b0eb936a..2295f67c 100644 --- a/broker/pom.xml +++ b/broker/pom.xml @@ -106,6 +106,12 @@ netty-codec-http ${netty.version} + + + commons-codec + commons-codec + 1.10 + org.mapdb diff --git a/broker/src/main/java/org/eclipse/moquette/spi/impl/FileAuthenticator.java b/broker/src/main/java/org/eclipse/moquette/spi/impl/FileAuthenticator.java index c08bb585..c92f748d 100644 --- a/broker/src/main/java/org/eclipse/moquette/spi/impl/FileAuthenticator.java +++ b/broker/src/main/java/org/eclipse/moquette/spi/impl/FileAuthenticator.java @@ -15,20 +15,27 @@ */ package org.eclipse.moquette.spi.impl; -import java.io.BufferedReader; -import java.io.File; -import java.io.FileNotFoundException; -import java.io.FileReader; -import java.io.IOException; -import java.io.Reader; -import java.text.ParseException; -import java.util.HashMap; -import java.util.Map; +import org.apache.commons.codec.binary.Hex; import org.eclipse.moquette.server.IAuthenticator; import org.slf4j.Logger; import org.slf4j.LoggerFactory; +import java.io.*; +import java.security.MessageDigest; +import java.security.NoSuchAlgorithmException; +import java.text.ParseException; +import java.util.HashMap; +import java.util.Map; + /** + * Load user credentials from a text file. + * Each line of the file is formatted as ":". The username mustn't contains : char. + * + * To encode your password from command line on Linux systems, you could use: + * 
+ *     echo -n "yourpassword" | sha256sum
+ *
+ * NB -n is important because echo append a newline by default at the of string. -n avoid this behaviour. * * @author andrea */ @@ -36,8 +43,9 @@ public class FileAuthenticator implements IAuthenticator { private static final Logger LOG = LoggerFactory.getLogger(FileAuthenticator.class); - private Map m_identities = new HashMap(); - + private Map m_identities = new HashMap<>(); + private MessageDigest m_digest; + FileAuthenticator(String parent, String filePath) { File file = new File(parent, filePath); LOG.info("Loading password file: " + file); @@ -45,14 +53,20 @@ public class FileAuthenticator implements IAuthenticator { LOG.warn(String.format("Bad file reference %s is a directory", file)); return; } - + try { + this.m_digest = MessageDigest.getInstance("SHA-256"); + } catch (NoSuchAlgorithmException nsaex) { + LOG.error("Can't find SHA-256 for password encoding", nsaex); + throw new RuntimeException(nsaex); + } + try { FileReader reader = new FileReader(file); parse(reader); } catch (FileNotFoundException fex) { LOG.warn(String.format("Parsing not existing file %s", file), fex); } catch (ParseException pex) { - LOG.warn(String.format("Fromat ero in parsing password file %s", file), pex); + LOG.warn(String.format("Format error in parsing password file %s", file), pex); } } @@ -81,9 +95,9 @@ public class FileAuthenticator implements IAuthenticator { } //split till the first space - int deilimiterIdx = line.indexOf(':'); - String username = line.substring(0, deilimiterIdx).trim(); - String password = line.substring(deilimiterIdx + 1).trim(); + int delimiterIdx = line.indexOf(':'); + String username = line.substring(0, delimiterIdx).trim(); + String password = line.substring(delimiterIdx + 1).trim(); m_identities.put(username, password); } @@ -98,8 +112,14 @@ public class FileAuthenticator implements IAuthenticator { if (foundPwq == null) { return false; } - - return foundPwq.equals(password); + try { + m_digest.update(password.getBytes("UTF-8")); + } catch (UnsupportedEncodingException e) { + e.printStackTrace(); + } + byte[] digest = m_digest.digest(); + String encodedPasswd = new String(Hex.encodeHex(digest)); + return foundPwq.equals(encodedPasswd); } } diff --git a/broker/src/test/java/org/eclipse/moquette/spi/impl/FileAuthenticatorTest.java b/broker/src/test/java/org/eclipse/moquette/spi/impl/FileAuthenticatorTest.java index b546e095..0ca9f109 100644 --- a/broker/src/test/java/org/eclipse/moquette/spi/impl/FileAuthenticatorTest.java +++ b/broker/src/test/java/org/eclipse/moquette/spi/impl/FileAuthenticatorTest.java @@ -17,7 +17,9 @@ package org.eclipse.moquette.spi.impl; import org.eclipse.moquette.server.IAuthenticator; import org.junit.Test; -import static org.junit.Assert.*; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; /** * @@ -47,5 +49,5 @@ public class FileAuthenticatorTest { assertFalse(auth.checkValid("testuser2", "passwd")); } - + } \ No newline at end of file diff --git a/broker/src/test/resources/config/password_file.conf b/broker/src/test/resources/config/password_file.conf index de74f4d7..54d075e4 100644 --- a/broker/src/test/resources/config/password_file.conf +++ b/broker/src/test/resources/config/password_file.conf @@ -1 +1,2 @@ -testuser:passwd \ No newline at end of file +#the password is sha256(passwd) +testuser:0d6be69b264717f2dd33652e212b173104b4a647b7c11ae72e9885f11cd312fb \ No newline at end of file diff --git a/broker/src/test/resources/password_file.conf b/broker/src/test/resources/password_file.conf index 86f95c35..54d075e4 100644 --- a/broker/src/test/resources/password_file.conf +++ b/broker/src/test/resources/password_file.conf @@ -1 +1,2 @@ -testuser:passwd +#the password is sha256(passwd) +testuser:0d6be69b264717f2dd33652e212b173104b4a647b7c11ae72e9885f11cd312fb \ No newline at end of file