|
|
@@ -6,9 +6,9 @@ package auth
|
|
|
// broadcasts get sent to members of this map
|
|
|
|
|
|
import (
|
|
|
- "crypto/rand"
|
|
|
+ // "crypto/rand"
|
|
|
"crypto/sha512"
|
|
|
- "encoding/base64"
|
|
|
+ // "encoding/base64"
|
|
|
"encoding/hex"
|
|
|
"encoding/json"
|
|
|
"fmt"
|
|
|
@@ -21,7 +21,7 @@ import (
|
|
|
"time"
|
|
|
|
|
|
"github.com/gorilla/websocket"
|
|
|
- "golang.org/x/crypto/nacl/secretbox"
|
|
|
+ fernet "github.com/fernet/fernet-go"
|
|
|
)
|
|
|
|
|
|
var (
|
|
|
@@ -220,51 +220,37 @@ func AddSession(tokenID string, hash string, created string, authorized bool) er
|
|
|
}
|
|
|
|
|
|
// encrypt the contents using stored keyfile val
|
|
|
-func KeyfileEncrypt(contents map[string]string, key string) (string, error) {
|
|
|
- contentBytes, err := json.Marshal(contents)
|
|
|
- if err != nil {
|
|
|
- return "", err
|
|
|
- }
|
|
|
- // convert key to bytes
|
|
|
- keyBytes := []byte(key)
|
|
|
- if len(keyBytes) != 32 {
|
|
|
- return "", fmt.Errorf("key must be 32 bytes in length; actual length:",len(keyBytes))
|
|
|
- }
|
|
|
- var keyArray [32]byte
|
|
|
- copy(keyArray[:], keyBytes)
|
|
|
- // generate nonce
|
|
|
- var nonce [24]byte
|
|
|
- if _, err := rand.Read(nonce[:]); err != nil {
|
|
|
- return "", err
|
|
|
- }
|
|
|
- // encrypt contents
|
|
|
- encrypted := secretbox.Seal(nonce[:], contentBytes, &nonce, &keyArray)
|
|
|
- return base64.URLEncoding.EncodeToString(encrypted), nil
|
|
|
+func KeyfileEncrypt(contents map[string]string, keyStr string) (string, error) {
|
|
|
+ contentBytes, err := json.Marshal(contents)
|
|
|
+ if err != nil {
|
|
|
+ return "", err
|
|
|
+ }
|
|
|
+ key, err := fernet.DecodeKey(keyStr)
|
|
|
+ if err != nil {
|
|
|
+ return "", err
|
|
|
+ }
|
|
|
+ tok, err := fernet.EncryptAndSign(contentBytes, key)
|
|
|
+ if err != nil {
|
|
|
+ return "", err
|
|
|
+ }
|
|
|
+ return string(tok), nil
|
|
|
}
|
|
|
|
|
|
-// decrypt routine
|
|
|
-func KeyfileDecrypt(encryptedText string, key string) (map[string]string, error) {
|
|
|
- // get bytes
|
|
|
- keyBytes := []byte(key)
|
|
|
- var keyArray [32]byte
|
|
|
- copy(keyArray[:], keyBytes)
|
|
|
- encryptedBytes, err := base64.URLEncoding.DecodeString(encryptedText)
|
|
|
- if err != nil {
|
|
|
- return nil, err
|
|
|
- }
|
|
|
- // get nonce
|
|
|
- var nonce [24]byte
|
|
|
- copy(nonce[:], encryptedBytes[:24])
|
|
|
- // attempt decrypt
|
|
|
- decrypted, ok := secretbox.Open(nil, encryptedBytes[24:], &nonce, &keyArray)
|
|
|
- if !ok {
|
|
|
- return nil, fmt.Errorf("Decryption failed")
|
|
|
- }
|
|
|
- var contents map[string]string
|
|
|
- if err := json.Unmarshal(decrypted, &contents); err != nil {
|
|
|
- return nil, err
|
|
|
- }
|
|
|
- return contents, nil
|
|
|
+func KeyfileDecrypt(tokenStr string, keyStr string) (map[string]string, error) {
|
|
|
+ key, err := fernet.DecodeKey(keyStr)
|
|
|
+ if err != nil {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ decrypted := fernet.VerifyAndDecrypt([]byte(tokenStr), 60*time.Second, []*fernet.Key{key})
|
|
|
+ if decrypted == nil {
|
|
|
+ return nil, fmt.Errorf("verification or decryption failed")
|
|
|
+ }
|
|
|
+ var contents map[string]string
|
|
|
+ err = json.Unmarshal(decrypted, &contents)
|
|
|
+ if err != nil {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ return contents, nil
|
|
|
}
|
|
|
|
|
|
// salted sha512
|
reid