11548483589

Committed 28 Oct 2024 06:20AM UTC coverage: 79.696% (-5.6%) from 85.31%

Build # 11548483589

Build Type

push

github

Committed by

pbiering

Commit Message

resync with master

Run Details

1637 of 2158 branches covered (75.86%)

Branch coverage included in aggregate %.

476 of 788 new or added lines in 40 files covered. (60.41%)

54 existing lines in 16 files now uncovered.

3717 of 4560 relevant lines covered (81.51%)

17.39 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

72.0

/radicale/auth/htpasswd.py

# This file is part of Radicale - CalDAV and CardDAV server
# Copyright © 2008 Nicolas Kandel
# Copyright © 2008 Pascal Halter
# Copyright © 2008-2017 Guillaume Ayoub
# Copyright © 2017-2019 Unrud <unrud@outlook.com>
# Copyright © 2024 Peter Bieringer <pb@bieringer.de>
#
# This library is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Radicale.  If not, see <http://www.gnu.org/licenses/>.

"""
Authentication backend that checks credentials with a htpasswd file.

Apache's htpasswd command (httpd.apache.org/docs/programs/htpasswd.html)
manages a file for storing user credentials. It can encrypt passwords using
different the methods BCRYPT/SHA256/SHA512 or MD5-APR1 (a version of MD5 modified for
Apache). MD5-APR1 provides medium security as of 2015. Only BCRYPT/SHA256/SHA512 can be
considered secure by current standards.

MD5-APR1-encrypted credentials can be written by all versions of htpasswd (it
is the default, in fact), whereas BCRYPT/SHA256/SHA512 requires htpasswd 2.4.x or newer.

The `is_authenticated(user, password)` function provided by this module
verifies the user-given credentials by parsing the htpasswd credential file
pointed to by the ``htpasswd_filename`` configuration value while assuming
the password encryption method specified via the ``htpasswd_encryption``
configuration value.

The following htpasswd password encryption methods are supported by Radicale
out-of-the-box:
    - plain-text (created by htpasswd -p ...) -- INSECURE
    - MD5-APR1   (htpasswd -m ...) -- htpasswd's default method, INSECURE
    - SHA256     (htpasswd -2 ...)
    - SHA512     (htpasswd -5 ...)

When bcrypt is installed:
    - BCRYPT     (htpasswd -B ...) -- Requires htpasswd 2.4.x

"""

import functools
import hmac
from typing import Any

from passlib.hash import apr_md5_crypt, sha256_crypt, sha512_crypt

from radicale import auth, config, logger


class Auth(auth.BaseAuth):

    _filename: str
    _encoding: str

    def __init__(self, configuration: config.Configuration) -> None:
        super().__init__(configuration)
        self._filename = configuration.get("auth", "htpasswd_filename")
        self._encoding = configuration.get("encoding", "stock")
        encryption: str = configuration.get("auth", "htpasswd_encryption")

        logger.info("auth htpasswd encryption is 'radicale.auth.htpasswd_encryption.%s'", encryption)

        if encryption == "plain":
            self._verify = self._plain
        elif encryption == "md5":
            self._verify = self._md5apr1
        elif encryption == "sha256":
            self._verify = self._sha256
        elif encryption == "sha512":
            self._verify = self._sha512
        elif encryption == "bcrypt" or encryption == "autodetect":
            try:
                import bcrypt
            except ImportError as e:
                raise RuntimeError(
                    "The htpasswd encryption method 'bcrypt' or 'autodetect' requires "
                    "the bcrypt module.") from e
            if encryption == "bcrypt":
                self._verify = functools.partial(self._bcrypt, bcrypt)
            else:
                self._verify = self._autodetect
                self._verify_bcrypt = functools.partial(self._bcrypt, bcrypt)
        else:
            raise RuntimeError("The htpasswd encryption method %r is not "
                               "supported." % encryption)

    def _plain(self, hash_value: str, password: str) -> bool:
        """Check if ``hash_value`` and ``password`` match, plain method."""
        return hmac.compare_digest(hash_value.encode(), password.encode())

    def _bcrypt(self, bcrypt: Any, hash_value: str, password: str) -> bool:
        return bcrypt.checkpw(password=password.encode('utf-8'), hashed_password=hash_value.encode())

    def _md5apr1(self, hash_value: str, password: str) -> bool:
        return apr_md5_crypt.verify(password, hash_value.strip())

    def _sha256(self, hash_value: str, password: str) -> bool:
        return sha256_crypt.verify(password, hash_value.strip())

    def _sha512(self, hash_value: str, password: str) -> bool:
        return sha512_crypt.verify(password, hash_value.strip())

    def _autodetect(self, hash_value: str, password: str) -> bool:
        if hash_value.startswith("$apr1$", 0, 6) and len(hash_value) == 37:
            # MD5-APR1
            return self._md5apr1(hash_value, password)
        elif hash_value.startswith("$2y$", 0, 4) and len(hash_value) == 60:
            # BCRYPT
            return self._verify_bcrypt(hash_value, password)
        elif hash_value.startswith("$5$", 0, 3) and len(hash_value) == 63:
            # SHA-256
            return self._sha256(hash_value, password)
        elif hash_value.startswith("$6$", 0, 3) and len(hash_value) == 106:
            # SHA-512
            return self._sha512(hash_value, password)
        else:
            # assumed plaintext
            return self._plain(hash_value, password)

    def _login(self, login: str, password: str) -> str:
        """Validate credentials.

        Iterate through htpasswd credential file until login matches, extract
        hash (encrypted password) and check hash against password,
        using the method specified in the Radicale config.

        The content of the file is not cached because reading is generally a
        very cheap operation, and it's useful to get live updates of the
        htpasswd file.

        """
        try:
            with open(self._filename, encoding=self._encoding) as f:
                for line in f:
                    line = line.rstrip("\n")
                    if line.lstrip() and not line.lstrip().startswith("#"):
                        try:
                            hash_login, hash_value = line.split(
                                ":", maxsplit=1)
                            # Always compare both login and password to avoid
                            # timing attacks, see #591.
                            login_ok = hmac.compare_digest(
                                hash_login.encode(), login.encode())
                            password_ok = self._verify(hash_value, password)
                            if login_ok and password_ok:
                                return login
                        except ValueError as e:
                            raise RuntimeError("Invalid htpasswd file %r: %s" %
                                               (self._filename, e)) from e
        except OSError as e:
            raise RuntimeError("Failed to load htpasswd file %r: %s" %
                               (self._filename, e)) from e
        return ""

1	# This file is part of Radicale - CalDAV and CardDAV server
2	# Copyright © 2008 Nicolas Kandel
3	# Copyright © 2008 Pascal Halter
4	# Copyright © 2008-2017 Guillaume Ayoub
5	# Copyright © 2017-2019 Unrud <unrud@outlook.com>
6	# Copyright © 2024 Peter Bieringer <pb@bieringer.de>
7	#
8	# This library is free software: you can redistribute it and/or modify
9	# it under the terms of the GNU General Public License as published by
10	# the Free Software Foundation, either version 3 of the License, or
11	# (at your option) any later version.
12	#
13	# This library is distributed in the hope that it will be useful,
14	# but WITHOUT ANY WARRANTY; without even the implied warranty of
15	# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	# GNU General Public License for more details.
17	#
18	# You should have received a copy of the GNU General Public License
19	# along with Radicale. If not, see <http://www.gnu.org/licenses/>.
20
21	"""	3✔
22	Authentication backend that checks credentials with a htpasswd file.
23
24	Apache's htpasswd command (httpd.apache.org/docs/programs/htpasswd.html)
25	manages a file for storing user credentials. It can encrypt passwords using
26	different the methods BCRYPT/SHA256/SHA512 or MD5-APR1 (a version of MD5 modified for
27	Apache). MD5-APR1 provides medium security as of 2015. Only BCRYPT/SHA256/SHA512 can be
28	considered secure by current standards.
29
30	MD5-APR1-encrypted credentials can be written by all versions of htpasswd (it
31	is the default, in fact), whereas BCRYPT/SHA256/SHA512 requires htpasswd 2.4.x or newer.
32
33	The `is_authenticated(user, password)` function provided by this module
34	verifies the user-given credentials by parsing the htpasswd credential file
35	pointed to by the ``htpasswd_filename`` configuration value while assuming
36	the password encryption method specified via the ``htpasswd_encryption``
37	configuration value.
38
39	The following htpasswd password encryption methods are supported by Radicale
40	out-of-the-box:
41	- plain-text (created by htpasswd -p ...) -- INSECURE
42	- MD5-APR1 (htpasswd -m ...) -- htpasswd's default method, INSECURE
43	- SHA256 (htpasswd -2 ...)
44	- SHA512 (htpasswd -5 ...)
45
46	When bcrypt is installed:
47	- BCRYPT (htpasswd -B ...) -- Requires htpasswd 2.4.x
48
49	"""
50
51	import functools	22✔
52	import hmac	22✔
53	from typing import Any	22✔
54
55	from passlib.hash import apr_md5_crypt, sha256_crypt, sha512_crypt	22✔
56
57	from radicale import auth, config, logger	22✔
58
59
60	class Auth(auth.BaseAuth):	22✔
61
62	_filename: str	22✔
63	_encoding: str	22✔
64
65	def __init__(self, configuration: config.Configuration) -> None:	22✔
66	super().__init__(configuration)	22✔
67	self._filename = configuration.get("auth", "htpasswd_filename")	22✔
68	self._encoding = configuration.get("encoding", "stock")	22✔
69	encryption: str = configuration.get("auth", "htpasswd_encryption")	22✔
70
71	logger.info("auth htpasswd encryption is 'radicale.auth.htpasswd_encryption.%s'", encryption)	22✔
72
73	if encryption == "plain":	22✔
74	self._verify = self._plain	22✔
75	elif encryption == "md5":	22✔
76	self._verify = self._md5apr1	22✔
77	elif encryption == "sha256":	22✔
78	self._verify = self._sha256	22✔
79	elif encryption == "sha512":	22✔
80	self._verify = self._sha512	22✔
81	elif encryption == "bcrypt" or encryption == "autodetect":	22!
82	try:	22✔
83	import bcrypt	22✔
84	except ImportError as e:	×
85	raise RuntimeError(	×
86	"The htpasswd encryption method 'bcrypt' or 'autodetect' requires "
87	"the bcrypt module.") from e
88	if encryption == "bcrypt":	22!
89	self._verify = functools.partial(self._bcrypt, bcrypt)	22✔
90	else:
NEW 91	self._verify = self._autodetect	×
NEW 92	self._verify_bcrypt = functools.partial(self._bcrypt, bcrypt)	×
93	else:
94	raise RuntimeError("The htpasswd encryption method %r is not "	×
95	"supported." % encryption)
96
97	def _plain(self, hash_value: str, password: str) -> bool:	22✔
98	"""Check if ``hash_value`` and ``password`` match, plain method."""
99	return hmac.compare_digest(hash_value.encode(), password.encode())	22✔
100
101	def _bcrypt(self, bcrypt: Any, hash_value: str, password: str) -> bool:	22✔
102	return bcrypt.checkpw(password=password.encode('utf-8'), hashed_password=hash_value.encode())	22✔
103
104	def _md5apr1(self, hash_value: str, password: str) -> bool:	22✔
105	return apr_md5_crypt.verify(password, hash_value.strip())	22✔
106
107	def _sha256(self, hash_value: str, password: str) -> bool:	22✔
108	return sha256_crypt.verify(password, hash_value.strip())	22✔
109
110	def _sha512(self, hash_value: str, password: str) -> bool:	22✔
111	return sha512_crypt.verify(password, hash_value.strip())	22✔
112
113	def _autodetect(self, hash_value: str, password: str) -> bool:	22✔
NEW 114	if hash_value.startswith("$apr1$", 0, 6) and len(hash_value) == 37:	×
115	# MD5-APR1
NEW 116	return self._md5apr1(hash_value, password)	×
NEW 117	elif hash_value.startswith("$2y$", 0, 4) and len(hash_value) == 60:	×
118	# BCRYPT
NEW 119	return self._verify_bcrypt(hash_value, password)	×
NEW 120	elif hash_value.startswith("$5$", 0, 3) and len(hash_value) == 63:	×
121	# SHA-256
NEW 122	return self._sha256(hash_value, password)	×
NEW 123	elif hash_value.startswith("$6$", 0, 3) and len(hash_value) == 106:	×
124	# SHA-512
NEW 125	return self._sha512(hash_value, password)	×
126	else:
127	# assumed plaintext
NEW 128	return self._plain(hash_value, password)	×
129
130	def _login(self, login: str, password: str) -> str:	22✔
131	"""Validate credentials.
132
133	Iterate through htpasswd credential file until login matches, extract
134	hash (encrypted password) and check hash against password,
135	using the method specified in the Radicale config.
136
137	The content of the file is not cached because reading is generally a
138	very cheap operation, and it's useful to get live updates of the
139	htpasswd file.
140
141	"""
142	try:	22✔
143	with open(self._filename, encoding=self._encoding) as f:	22✔
144	for line in f:	22✔
145	line = line.rstrip("\n")	22✔
146	if line.lstrip() and not line.lstrip().startswith("#"):	22✔
147	try:	22✔
148	hash_login, hash_value = line.split(	22✔
149	":", maxsplit=1)
150	# Always compare both login and password to avoid
151	# timing attacks, see #591.
152	login_ok = hmac.compare_digest(	22✔
153	hash_login.encode(), login.encode())
154	password_ok = self._verify(hash_value, password)	22✔
155	if login_ok and password_ok:	22✔
156	return login	22✔
157	except ValueError as e:	×
158	raise RuntimeError("Invalid htpasswd file %r: %s" %	×
159	(self._filename, e)) from e
160	except OSError as e:	×
161	raise RuntimeError("Failed to load htpasswd file %r: %s" %	×
162	(self._filename, e)) from e
163	return ""	22✔

Kozea / Radicale / 11548483589

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous