1-- This script may be used with the auth-filter. Be sure to configure it as you wish.
  2--
  3-- Requirements:
  4-- 	luacrypto >= 0.3
  5-- 	<http://mkottman.github.io/luacrypto/>
  6--
  7
  8
  9--
 10--
 11-- Configure these variables for your settings.
 12--
 13--
 14
 15-- A list of password protected repositories along with the users who can access them.
 16local protected_repos = {
 17	glouglou	= { laurent = true, jason = true },
 18	qt		= { jason = true, bob = true }
 19}
 20
 21-- Please note that, in production, you'll want to replace this simple lookup
 22-- table with either a table of salted and hashed passwords (using something
 23-- smart like scrypt), or replace this table lookup with an external support,
 24-- such as consulting your system's pam / shadow system, or an external
 25-- database, or an external validating web service. For testing, or for
 26-- extremely low-security usage, you may be able, however, to get away with
 27-- compromising on hardcoding the passwords in cleartext, as we have done here.
 28local users = {
 29	jason		= "secretpassword",
 30	laurent		= "s3cr3t",
 31	bob		= "ilikelua"
 32}
 33
 34-- All cookies will be authenticated based on this secret. Make it something
 35-- totally random and impossible to guess. It should be large.
 36local secret = "BE SURE TO CUSTOMIZE THIS STRING TO SOMETHING BIG AND RANDOM"
 37
 38
 39
 40--
 41--
 42-- Authentication functions follow below. Swap these out if you want different authentication semantics.
 43--
 44--
 45
 46-- Sets HTTP cookie headers based on post and sets up redirection.
 47function authenticate_post()
 48	local password = users[post["username"]]
 49	local redirect = validate_value("redirect", post["redirect"])
 50
 51	if redirect == nil then
 52		not_found()
 53		return 0
 54	end
 55
 56	redirect_to(redirect)
 57
 58	-- Lua hashes strings, so these comparisons are time invariant.
 59	if password == nil or password ~= post["password"] then
 60		set_cookie("cgitauth", "")
 61	else
 62		-- One week expiration time
 63		local username = secure_value("username", post["username"], os.time() + 604800)
 64		set_cookie("cgitauth", username)
 65	end
 66
 67	html("\n")
 68	return 0
 69end
 70
 71
 72-- Returns 1 if the cookie is valid and 0 if it is not.
 73function authenticate_cookie()
 74	accepted_users = protected_repos[cgit["repo"]]
 75	if accepted_users == nil then
 76		-- We return as valid if the repo is not protected.
 77		return 1
 78	end
 79
 80	local username = validate_value("username", get_cookie(http["cookie"], "cgitauth"))
 81	if username == nil or not accepted_users[username:lower()] then
 82		return 0
 83	else
 84		return 1
 85	end
 86end
 87
 88-- Prints the html for the login form.
 89function body()
 90	html("<h2>Authentication Required</h2>")
 91	html("<form method='post' action='")
 92	html_attr(cgit["login"])
 93	html("'>")
 94	html("<input type='hidden' name='redirect' value='")
 95	html_attr(secure_value("redirect", cgit["url"], 0))
 96	html("' />")
 97	html("<table>")
 98	html("<tr><td><label for='username'>Username:</label></td><td><input id='username' name='username' autofocus /></td></tr>")
 99	html("<tr><td><label for='password'>Password:</label></td><td><input id='password' name='password' type='password' /></td></tr>")
100	html("<tr><td colspan='2'><input value='Login' type='submit' /></td></tr>")
101	html("</table></form>")
102
103	return 0
104end
105
106
107
108--
109--
110-- Wrapper around filter API, exposing the http table, the cgit table, and the post table to the above functions.
111--
112--
113
114local actions = {}
115actions["authenticate-post"] = authenticate_post
116actions["authenticate-cookie"] = authenticate_cookie
117actions["body"] = body
118
119function filter_open(...)
120	action = actions[select(1, ...)]
121
122	http = {}
123	http["cookie"] = select(2, ...)
124	http["method"] = select(3, ...)
125	http["query"] = select(4, ...)
126	http["referer"] = select(5, ...)
127	http["path"] = select(6, ...)
128	http["host"] = select(7, ...)
129	http["https"] = select(8, ...)
130
131	cgit = {}
132	cgit["repo"] = select(9, ...)
133	cgit["page"] = select(10, ...)
134	cgit["url"] = select(11, ...)
135	cgit["login"] = select(12, ...)
136
137end
138
139function filter_close()
140	return action()
141end
142
143function filter_write(str)
144	post = parse_qs(str)
145end
146
147
148--
149--
150-- Utility functions based on keplerproject/wsapi.
151--
152--
153
154function url_decode(str)
155	if not str then
156		return ""
157	end
158	str = string.gsub(str, "+", " ")
159	str = string.gsub(str, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
160	str = string.gsub(str, "\r\n", "\n")
161	return str
162end
163
164function url_encode(str)
165	if not str then
166		return ""
167	end
168	str = string.gsub(str, "\n", "\r\n")
169	str = string.gsub(str, "([^%w ])", function(c) return string.format("%%%02X", string.byte(c)) end)
170	str = string.gsub(str, " ", "+")
171	return str
172end
173
174function parse_qs(qs)
175	local tab = {}
176	for key, val in string.gmatch(qs, "([^&=]+)=([^&=]*)&?") do
177		tab[url_decode(key)] = url_decode(val)
178	end
179	return tab
180end
181
182function get_cookie(cookies, name)
183	cookies = string.gsub(";" .. cookies .. ";", "%s*;%s*", ";")
184	return url_decode(string.match(cookies, ";" .. name .. "=(.-);"))
185end
186
187
188--
189--
190-- Cookie construction and validation helpers.
191--
192--
193
194local crypto = require("crypto")
195
196-- Returns value of cookie if cookie is valid. Otherwise returns nil.
197function validate_value(expected_field, cookie)
198	local i = 0
199	local value = ""
200	local field = ""
201	local expiration = 0
202	local salt = ""
203	local hmac = ""
204
205	if cookie == nil or cookie:len() < 3 or cookie:sub(1, 1) == "|" then
206		return nil
207	end
208
209	for component in string.gmatch(cookie, "[^|]+") do
210		if i == 0 then
211			field = component
212		elseif i == 1 then
213			value = component
214		elseif i == 2 then
215			expiration = tonumber(component)
216			if expiration == nil then
217				expiration = -1
218			end
219		elseif i == 3 then
220			salt = component
221		elseif i == 4 then
222			hmac = component
223		else
224			break
225		end
226		i = i + 1
227	end
228
229	if hmac == nil or hmac:len() == 0 then
230		return nil
231	end
232
233	-- Lua hashes strings, so these comparisons are time invariant.
234	if hmac ~= crypto.hmac.digest("sha1", field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt, secret) then
235		return nil
236	end
237
238	if expiration == -1 or (expiration ~= 0 and expiration <= os.time()) then
239		return nil
240	end
241
242	if url_decode(field) ~= expected_field then
243		return nil
244	end
245
246	return url_decode(value)
247end
248
249function secure_value(field, value, expiration)
250	if value == nil or value:len() <= 0 then
251		return ""
252	end
253
254	local authstr = ""
255	local salt = crypto.hex(crypto.rand.bytes(16))
256	value = url_encode(value)
257	field = url_encode(field)
258	authstr = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
259	authstr = authstr .. "|" .. crypto.hmac.digest("sha1", authstr, secret)
260	return authstr
261end
262
263function set_cookie(cookie, value)
264	html("Set-Cookie: " .. cookie .. "=" .. value .. "; HttpOnly")
265	if http["https"] == "yes" or http["https"] == "on" or http["https"] == "1" then
266		html("; secure")
267	end
268	html("\n")
269end
270
271function redirect_to(url)
272	html("Status: 302 Redirect\n")
273	html("Cache-Control: no-cache, no-store\n")
274	html("Location: " .. url .. "\n")
275end
276
277function not_found()
278	html("Status: 404 Not Found\n")
279	html("Cache-Control: no-cache, no-store\n\n")
280end