feat(authentication): provide an authentication mechanism (#19)

* moves server into session

* renames jsonrpc server to jsonrpc proxy

* moves server into session

* renames jsonrpc server to jsonrpc proxy

* adds json rpc server

* removes obsolete proxy from protocol

* changes interface of jsonrpc_proxy_onresult to accept previously parsed messages

* adds infrastructure to process incoming requests; fixes invalid read of ill formatted responses

* adds description of authentication request

* adds authentication request

* adds userdb for authentication purposes

* removes debug code: console.log()

* fixes cmake build error (missing openssl symbols)

* fixes typo

* replaces ASCII art by UML diagram

* renames BAD_NOACCESS to BAD_ACCESS_DENIED

* fixes style

* adds docu of authentication

* ignored false positives of flawfinder

* fixes style issues

* fixes javascript style issues

example/daemon/main.c

@@ -7,9 +7,9 @@
 
 #include <unistd.h>
 #include <getopt.h>
-#include <jansson.h>
 
 #include <webfuse_adapter.h>
+#include <userdb.h>
 
 
 struct args
@@ -50,24 +50,16 @@ static bool authenticate(struct wf_credentials * creds, void * user_data)
 	char const * password = wf_credentials_get(creds, "password");
 	if ((NULL != username) && (NULL != password))
 	{
-		json_t * passwd = json_load_file(args->passwd_path, 0, NULL);
-		if (NULL != passwd)
+		struct userdb * db = userdb_create("<pepper>");
+		result = userdb_load(db, args->passwd_path); 
+		if (result)
 		{
-			json_t * user = json_object_get(passwd, username);
-			if (json_is_object(user)) 
-			{
-				json_t * password_holder = json_object_get(user, "password");
-				if (json_is_string(password_holder)) 
-				{
-					result = (0 == strcmp(password, json_string_value(password_holder)));					
-				} 
-			}
-
-			json_decref(passwd);
+			result = userdb_check(db, username, password);
+			userdb_dispose(db);
 		}
 	}
 
-	return result; 
+	return result;
 }
 
 static int parse_arguments(int argc, char * argv[], struct args * args)

example/daemon/www/js/connection_view.js

@@ -6,20 +6,51 @@ export class ConnectionView {
 
         this.element = document.createElement("div");
 
+        const connectBox = document.createElement("div");
+        this.element.appendChild(connectBox);
+
         const urlLabel = document.createElement("span");
         urlLabel.textContent = "URL:";
-        this.element.appendChild(urlLabel);
+        connectBox.appendChild(urlLabel);
         
         this.urlTextbox = document.createElement("input");
         this.urlTextbox.type = "text";
         this.urlTextbox.value = window.location.href.replace(/^http/, "ws");
-        this.element.appendChild(this.urlTextbox);
+        connectBox.appendChild(this.urlTextbox);
 
         this.connectButton = document.createElement("input");
         this.connectButton.type = "button";
         this.connectButton.value = "connect";
         this.connectButton.addEventListener("click", () => { this._onConnectButtonClicked(); });
-        this.element.appendChild(this.connectButton);
+        connectBox.appendChild(this.connectButton);
+
+
+        const authenticateBox = document.createElement("div");
+        this.element.appendChild(authenticateBox);
+
+        const usernameLabel = document.createElement("span");
+        usernameLabel.textContent = "user:";
+        authenticateBox.appendChild(usernameLabel);
+        
+        this.usernameTextbox = document.createElement("input");
+        this.usernameTextbox.type = "text";
+        this.usernameTextbox.value = "bob";
+        authenticateBox.appendChild(this.usernameTextbox);
+
+        const passwordLabel = document.createElement("span");
+        passwordLabel.textContent = "user:";
+        authenticateBox.appendChild(passwordLabel);
+        
+        this.passwordTextbox = document.createElement("input");
+        this.passwordTextbox.type = "password";
+        this.passwordTextbox.value = "secret";
+        authenticateBox.appendChild(this.passwordTextbox);
+
+        this.authenticateButton = document.createElement("input");
+        this.authenticateButton.type = "button";
+        this.authenticateButton.value = "authenticate";
+        this.authenticateButton.addEventListener("click", () => { this._onAuthenticateButtonClicked(); });
+        authenticateBox.appendChild(this.authenticateButton);
     }
 
     _onConnectButtonClicked() {
@@ -32,6 +63,15 @@ export class ConnectionView {
         }
     }
 
+    _onAuthenticateButtonClicked() {
+        if (this._client.isConnected()) {
+            const username = this.usernameTextbox.value;
+            const password = this.passwordTextbox.value;
+
+            this._client.authenticate("username", { username, password });
+        }
+    }
+
     _onConnectionOpened() {
         this.connectButton.value = "disconnect";
     }

example/daemon/www/js/webfuse/client.js

@@ -24,6 +24,16 @@ export class Client {
         };
     }
 
+    authenticate(type, credentials) {
+        const request = {
+            "method": "authenticate",
+            "params": [type, credentials],
+            "id": 42
+        };
+        
+        this._ws.send(JSON.stringify(request));
+    }
+
     disconnect() {
         if (this._ws) {
             this._ws.close();

example/lib/userdb/src/userdb.c

@@ -127,9 +127,9 @@ static char * compute_hash(
     {
         EVP_MD_CTX * context = EVP_MD_CTX_new();        
         EVP_DigestInit_ex(context, digest, NULL);        
-        EVP_DigestUpdate(context, password, strlen(password));
-        EVP_DigestUpdate(context, salt, strlen(salt));
-        EVP_DigestUpdate(context, db->pepper, strlen(db->pepper));
+        EVP_DigestUpdate(context, password, strlen(password)); /* Flawfinder: ignore */
+        EVP_DigestUpdate(context, salt, strlen(salt)); /* Flawfinder: ignore */
+        EVP_DigestUpdate(context, db->pepper, strlen(db->pepper)); /* Flawfinder: ignore */
         EVP_DigestFinal_ex(context, hash, &hash_size);
         EVP_MD_CTX_free(context);
 

example/provider/main.c

@@ -268,7 +268,7 @@ static void fs_open(
         }
         else
         {
-            wfp_respond_error(request, WF_BAD_NOACCESS);
+            wfp_respond_error(request, WF_BAD_ACCESS_DENIED);
         }        
     }
     else