From d6e599008329c54ab5a90dee946e53b85c748cb4 Mon Sep 17 00:00:00 2001 From: Timshel Date: Thu, 6 Aug 2026 16:06:37 +0200 Subject: [PATCH] 2FA userVerificationToken for Authenticator, Email and Duo --- src/api/core/two_factor/authenticator.rs | 52 +++---- src/api/core/two_factor/duo.rs | 111 ++++++-------- src/api/core/two_factor/email.rs | 90 +++++++----- src/api/mod.rs | 2 +- src/auth.rs | 3 + src/auth/two_factor.rs | 175 +++++++++++++++++++++++ 6 files changed, 295 insertions(+), 138 deletions(-) create mode 100644 src/auth/two_factor.rs diff --git a/src/api/core/two_factor/authenticator.rs b/src/api/core/two_factor/authenticator.rs index 692e8248..3412387f 100644 --- a/src/api/core/two_factor/authenticator.rs +++ b/src/api/core/two_factor/authenticator.rs @@ -3,7 +3,7 @@ use rocket::{Route, serde::json::Json}; use crate::{ api::{EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code}, - auth::{ClientIp, Headers}, + auth::{ClientIp, Headers, two_factor}, crypto, db::{ DbConn, @@ -20,7 +20,6 @@ pub fn routes() -> Vec { #[post("/two-factor/get-authenticator", data = "")] async fn generate_authenticator(data: Json, headers: Headers, conn: DbConn) -> JsonResult { - let data: PasswordOrOtpData = data.into_inner(); let user = headers.user; data.validate(&user, false, &conn).await?; @@ -33,14 +32,12 @@ async fn generate_authenticator(data: Json, headers: Headers, _ => (false, crypto::encode_random_bytes::<20>(&BASE32)), }; - // Upstream seems to also return `userVerificationToken`, but doesn't seem to be used at all. - // It should help prevent TOTP disclosure if someone keeps their vault unlocked. - // Since it doesn't seem to be used, and also does not cause any issues, lets leave it out of the response. - // See: https://github.com/bitwarden/server/blob/9ebe16587175b1c0e9208f84397bb75d0d595510/src/Api/Auth/Controllers/TwoFactorController.cs#L94 - Ok(Json(json!({ - "enabled": enabled, - "key": key, - "object": "twoFactorAuthenticator" + Ok(Json(rocket::serde::json::json!({ + "authenticator": rocket::serde::json::json!({ + "enabled": enabled, + "key": key, + }), + "userVerificationToken": two_factor::authenticator_token(user.uuid, key, enabled), }))) } @@ -49,8 +46,7 @@ async fn generate_authenticator(data: Json, headers: Headers, struct EnableAuthenticatorData { key: String, token: NumberOrString, - master_password_hash: Option, - otp: Option, + user_verification_token: String, } #[post("/two-factor/authenticator", data = "")] @@ -61,12 +57,7 @@ async fn activate_authenticator(data: Json, headers: He let mut user = headers.user; - PasswordOrOtpData { - master_password_hash: data.master_password_hash, - otp: data.otp, - } - .validate(&user, true, &conn) - .await?; + two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &key, false)?; // Validate key as base32 and 20 bytes length let decoded_key: Vec = if let Ok(decoded) = BASE32.decode(key.as_bytes()) { @@ -87,9 +78,10 @@ async fn activate_authenticator(data: Json, headers: He log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await; Ok(Json(json!({ - "enabled": true, - "key": key, - "object": "twoFactorAuthenticator" + "authenticator": json!({ + "enabled": true, + "key": key, + }), }))) } @@ -184,20 +176,18 @@ pub async fn validate_totp_code( #[serde(rename_all = "camelCase")] struct DisableAuthenticatorData { key: String, - master_password_hash: String, - r#type: NumberOrString, + user_verification_token: String, } #[delete("/two-factor/authenticator", data = "")] async fn disable_authenticator(data: Json, headers: Headers, conn: DbConn) -> JsonResult { let user = headers.user; - let type_ = data.r#type.into_i32()?; - if !user.check_valid_password(&data.master_password_hash) { - err!("Invalid password"); - } + two_factor::validate_authenticator(&data.user_verification_token, &user.uuid, &data.key, true)?; - if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await { + if let Some(twofactor) = + TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Authenticator as i32, &conn).await + { if twofactor.data == data.key { twofactor.delete(&conn).await?; log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn) @@ -211,9 +201,5 @@ async fn disable_authenticator(data: Json, headers: He super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?; } - Ok(Json(json!({ - "enabled": false, - "keys": type_, - "object": "twoFactorProvider" - }))) + Ok(Json(json!({}))) } diff --git a/src/api/core/two_factor/duo.rs b/src/api/core/two_factor/duo.rs index ed112eb9..74d95712 100644 --- a/src/api/core/two_factor/duo.rs +++ b/src/api/core/two_factor/duo.rs @@ -8,7 +8,7 @@ use crate::{ ApiResult, EmptyResult, JsonResult, PasswordOrOtpData, core::log_user_event, core::two_factor::generate_recover_code, }, - auth::Headers, + auth::{Headers, two_factor, two_factor::DuoData}, crypto, db::{ DbConn, @@ -19,55 +19,7 @@ use crate::{ }; pub fn routes() -> Vec { - routes![get_duo, activate_duo, activate_duo_put,] -} - -#[derive(Serialize, Deserialize)] -struct DuoData { - host: String, // Duo API hostname - ik: String, // client id - sk: String, // client secret -} - -impl DuoData { - fn global() -> Option { - match (CONFIG._enable_duo(), CONFIG.duo_host()) { - (true, Some(host)) => Some(Self { - host, - ik: CONFIG.duo_ikey().unwrap(), - sk: CONFIG.duo_skey().unwrap(), - }), - _ => None, - } - } - fn msg(s: &str) -> Self { - Self { - host: s.into(), - ik: s.into(), - sk: s.into(), - } - } - fn secret() -> Self { - Self::msg("") - } - fn obscure(self) -> Self { - let mut host = self.host; - let mut ik = self.ik; - let mut sk = self.sk; - - let digits = 4; - let replaced = "************"; - - host.replace_range(digits.., replaced); - ik.replace_range(digits.., replaced); - sk.replace_range(digits.., replaced); - - Self { - host, - ik, - sk, - } - } + routes![get_duo, activate_duo, activate_duo_put, disable_duo,] } enum DuoStatus { @@ -96,22 +48,19 @@ async fn get_duo(data: Json, headers: Headers, conn: DbConn) data.validate(&user, false, &conn).await?; - let data = get_user_duo_data(&user.uuid, &conn).await; - - let (enabled, data) = match data { + let (enabled, duo) = match get_user_duo_data(&user.uuid, &conn).await { DuoStatus::Global(_) => (true, Some(DuoData::secret())), DuoStatus::User(data) => (true, Some(data.obscure())), DuoStatus::Disabled(true) => (false, Some(DuoData::msg(DISABLED_MESSAGE_DEFAULT))), DuoStatus::Disabled(false) => (false, None), }; - let json = if let Some(data) = data { + let duo_json = if let Some(data) = duo.as_ref() { json!({ "enabled": enabled, "host": data.host, "clientSecret": data.sk, "clientId": data.ik, - "object": "twoFactorDuo" }) } else { json!({ @@ -119,11 +68,13 @@ async fn get_duo(data: Json, headers: Headers, conn: DbConn) "host": null, "clientSecret": null, "clientId": null, - "object": "twoFactorDuo" }) }; - Ok(Json(json)) + Ok(Json(rocket::serde::json::json!({ + "duo": duo_json, + "userVerificationToken": two_factor::duo_token(user.uuid, duo, enabled), + }))) } #[derive(Deserialize)] @@ -132,8 +83,7 @@ struct EnableDuoData { host: String, client_secret: String, client_id: String, - master_password_hash: Option, - otp: Option, + user_verification_token: String, } impl From for DuoData { @@ -160,12 +110,7 @@ async fn activate_duo(data: Json, headers: Headers, conn: DbConn) let data: EnableDuoData = data.into_inner(); let mut user = headers.user; - PasswordOrOtpData { - master_password_hash: data.master_password_hash.clone(), - otp: data.otp.clone(), - } - .validate(&user, true, &conn) - .await?; + two_factor::validate_duo(&data.user_verification_token, &user.uuid, None, false)?; let (data, data_str) = if check_duo_fields_custom(&data) { let data_req: DuoData = data.into(); @@ -198,6 +143,38 @@ async fn activate_duo_put(data: Json, headers: Headers, conn: DbC activate_duo(data, headers, conn).await } +#[derive(Debug, Deserialize)] +#[serde(rename_all = "camelCase")] +struct DisableDuoData { + user_verification_token: String, +} + +#[delete("/two-factor/duo", data = "")] +async fn disable_duo(data: Json, headers: Headers, conn: DbConn) -> JsonResult { + let user = headers.user; + + if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Duo as i32, &conn).await { + // Apply the same transformation than in `get_duo` to check we are disabling the correct one + let duo = match to_user_duo_data(&twofactor) { + DuoStatus::Global(_) => Some(DuoData::secret()), + DuoStatus::User(data) => Some(data.obscure()), + DuoStatus::Disabled(_) => None, + }; + + two_factor::validate_duo(&data.user_verification_token, &user.uuid, duo.as_ref(), true)?; + + twofactor.delete(&conn).await?; + log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn) + .await; + } + + if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() { + super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?; + } + + Ok(Json(json!({}))) +} + async fn duo_api_request(method: &str, path: &str, params: &str, data: &DuoData) -> EmptyResult { use reqwest::{Method, header}; use std::str::FromStr; @@ -237,6 +214,10 @@ async fn get_user_duo_data(user_id: &UserId, conn: &DbConn) -> DuoStatus { return DuoStatus::Disabled(DuoData::global().is_some()); }; + to_user_duo_data(&twofactor) +} + +fn to_user_duo_data(twofactor: &TwoFactor) -> DuoStatus { // If the user has the required values, we use those if let Ok(data) = serde_json::from_str(&twofactor.data) { return DuoStatus::User(data); diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs index 44ba2e7f..8aca6cf6 100644 --- a/src/api/core/two_factor/email.rs +++ b/src/api/core/two_factor/email.rs @@ -7,7 +7,7 @@ use crate::{ EmptyResult, JsonResult, PasswordOrOtpData, core::{log_user_event, two_factor::generate_recover_code}, }, - auth::{ClientHeaders, Headers}, + auth::{ClientHeaders, Headers, two_factor}, crypto, db::{ DbConn, @@ -18,7 +18,7 @@ use crate::{ }; pub fn routes() -> Vec { - routes![get_email, send_email_login, send_email, email,] + routes![get_email, send_email_login, send_email, email, disable_email] } #[derive(Deserialize)] @@ -131,18 +131,19 @@ async fn get_email(data: Json, headers: Headers, conn: DbConn data.validate(&user, false, &conn).await?; let (enabled, mfa_email) = - match TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await { - Some(x) => { - let twofactor_data = EmailTokenData::from_json(&x.data)?; - (true, json!(twofactor_data.email)) - } - _ => (false, serde_json::value::Value::Null), + if let Some(x) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await { + let twofactor_data = EmailTokenData::from_json(&x.data)?; + (true, Some(twofactor_data.email)) + } else { + (false, None) }; - Ok(Json(json!({ - "email": mfa_email, - "enabled": enabled, - "object": "twoFactorEmail" + Ok(Json(rocket::serde::json::json!({ + "email": rocket::serde::json::json!({ + "enabled": enabled, + "email": mfa_email, + }), + "userVerificationToken": two_factor::email_token(user.uuid, mfa_email, enabled), }))) } @@ -151,22 +152,16 @@ async fn get_email(data: Json, headers: Headers, conn: DbConn struct SendEmailData { /// Email where 2FA codes will be sent to, can be different than user email account. email: String, - master_password_hash: Option, - otp: Option, + user_verification_token: String, } /// Send a verification email to the specified email address to check whether it exists/belongs to user. #[post("/two-factor/send-email", data = "")] -async fn send_email(data: Json, headers: Headers, conn: DbConn) -> EmptyResult { +async fn send_email(data: Json, headers: Headers, conn: DbConn) -> JsonResult { let data: SendEmailData = data.into_inner(); let user = headers.user; - PasswordOrOtpData { - master_password_hash: data.master_password_hash, - otp: data.otp, - } - .validate(&user, false, &conn) - .await?; + two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email.clone(), false)?; if !CONFIG._enable_email_2fa() { err!("Email 2FA is disabled") @@ -182,12 +177,13 @@ async fn send_email(data: Json, headers: Headers, conn: DbConn) - let twofactor_data = EmailTokenData::new(data.email, generated_token); // Uses EmailVerificationChallenge as type to show that it's not verified yet. - let twofactor = TwoFactor::new(user.uuid, TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json()); + let twofactor = + TwoFactor::new(user.uuid.clone(), TwoFactorType::EmailVerificationChallenge, twofactor_data.to_json()); twofactor.save(&conn).await?; mail::send_token(&twofactor_data.email, &twofactor_data.last_token.map_res("Token is empty")?).await?; - Ok(()) + Ok(Json(json!({}))) } #[derive(Deserialize, Serialize)] @@ -195,8 +191,7 @@ async fn send_email(data: Json, headers: Headers, conn: DbConn) - struct EmailData { email: String, token: String, - master_password_hash: Option, - otp: Option, + user_verification_token: String, } /// Verify email belongs to user and can be used for 2FA email codes. @@ -205,17 +200,12 @@ async fn email(data: Json, headers: Headers, conn: DbConn) -> JsonRes let data: EmailData = data.into_inner(); let mut user = headers.user; - // This is the last step in the verification process, delete the otp directly afterwards - PasswordOrOtpData { - master_password_hash: data.master_password_hash, - otp: data.otp, - } - .validate(&user, true, &conn) - .await?; + two_factor::validate_email(&data.user_verification_token, &user.uuid, data.email, false)?; - let type_ = TwoFactorType::EmailVerificationChallenge as i32; let mut twofactor = - TwoFactor::find_by_user_and_type(&user.uuid, type_, &conn).await.map_res("Two factor not found")?; + TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::EmailVerificationChallenge as i32, &conn) + .await + .map_res("Two factor not found")?; let mut email_data = EmailTokenData::from_json(&twofactor.data)?; @@ -236,11 +226,33 @@ async fn email(data: Json, headers: Headers, conn: DbConn) -> JsonRes log_user_event(EventType::UserUpdated2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await; - Ok(Json(json!({ - "email": email_data.email, - "enabled": "true", - "object": "twoFactorEmail" - }))) + Ok(Json(json!({}))) +} + +#[derive(Debug, Deserialize)] +#[serde(rename_all = "camelCase")] +struct DisableEmailData { + user_verification_token: String, +} + +#[delete("/two-factor/email", data = "")] +async fn disable_email(data: Json, headers: Headers, conn: DbConn) -> JsonResult { + let user = headers.user; + + if let Some(twofactor) = TwoFactor::find_by_user_and_type(&user.uuid, TwoFactorType::Email as i32, &conn).await { + let twofactor_data = EmailTokenData::from_json(&twofactor.data)?; + two_factor::validate_email(&data.user_verification_token, &user.uuid, twofactor_data.email, true)?; + + twofactor.delete(&conn).await?; + log_user_event(EventType::UserDisabled2fa as i32, &user.uuid, headers.device.atype, &headers.ip.ip, &conn) + .await; + } + + if TwoFactor::find_by_user(&user.uuid, &conn).await.is_empty() { + super::enforce_2fa_policy(&user, &user.uuid, headers.device.atype, &headers.ip.ip, &conn).await?; + } + + Ok(Json(json!({}))) } /// Validate the email code when used as TwoFactor token mechanism diff --git a/src/api/mod.rs b/src/api/mod.rs index 05c4215d..54e96004 100644 --- a/src/api/mod.rs +++ b/src/api/mod.rs @@ -46,7 +46,7 @@ pub type JsonResult = ApiResult>; pub type EmptyResult = ApiResult<()>; // Common structs representing JSON data received -#[derive(Deserialize)] +#[derive(Debug, Deserialize)] #[serde(rename_all = "camelCase")] struct PasswordOrOtpData { #[serde(alias = "MasterPasswordHash")] diff --git a/src/auth.rs b/src/auth.rs index 762088e5..57f689d5 100644 --- a/src/auth.rs +++ b/src/auth.rs @@ -1,3 +1,6 @@ +#[path = "auth/two_factor.rs"] +pub mod two_factor; + #[path = "auth/send.rs"] pub mod send; pub type SendTokens = send::SendTokens; diff --git a/src/auth/two_factor.rs b/src/auth/two_factor.rs new file mode 100644 index 00000000..1235bc2f --- /dev/null +++ b/src/auth/two_factor.rs @@ -0,0 +1,175 @@ +use chrono::{TimeDelta, Utc}; +use serde::{de::DeserializeOwned, ser::Serialize}; +use std::sync::LazyLock; + +use crate::{ + CONFIG, + api::{ApiResult, EmptyResult}, + auth::{decode_jwt, encode_jwt}, + db::models::UserId, +}; + +static JWT_2FA_AUTH_ISSUER: LazyLock = LazyLock::new(|| format!("{}|api.2fa", CONFIG.domain_origin())); + +#[derive(Serialize, Deserialize)] +pub struct TwopFactorClaims { + // Not before + pub nbf: i64, + // Expiration time + pub exp: i64, + // Issuer + pub iss: String, + // Subject + pub sub: UserId, + + pub enabled: bool, + + pub claims: T, +} + +#[derive(Serialize, Deserialize)] +pub struct AuthenticatorClaims { + pub key: String, +} + +#[derive(Serialize, Deserialize)] +pub struct DuoClaims { + data: Option, +} + +#[derive(Serialize, Deserialize, PartialEq)] +pub struct DuoData { + pub host: String, // Duo API hostname + pub ik: String, // client id + pub sk: String, // client secret +} + +impl DuoData { + pub fn global() -> Option { + match (CONFIG._enable_duo(), CONFIG.duo_host()) { + (true, Some(host)) => Some(Self { + host, + ik: CONFIG.duo_ikey().unwrap(), + sk: CONFIG.duo_skey().unwrap(), + }), + _ => None, + } + } + pub fn msg(s: &str) -> Self { + Self { + host: s.into(), + ik: s.into(), + sk: s.into(), + } + } + pub fn secret() -> Self { + Self::msg("") + } + pub fn obscure(self) -> Self { + let mut host = self.host; + let mut ik = self.ik; + let mut sk = self.sk; + + let digits = 4; + let replaced = "************"; + + host.replace_range(digits.., replaced); + ik.replace_range(digits.., replaced); + sk.replace_range(digits.., replaced); + + Self { + host, + ik, + sk, + } + } +} + +#[derive(Serialize, Deserialize)] +pub struct EmailClaims { + pub email: Option, +} + +fn token(user_id: UserId, enabled: bool, claims: T) -> String { + let time_now = Utc::now(); + let claims = TwopFactorClaims { + nbf: time_now.timestamp(), + exp: (time_now + TimeDelta::try_minutes(5).unwrap()).timestamp(), + iss: JWT_2FA_AUTH_ISSUER.to_string(), + sub: user_id, + enabled, + claims, + }; + encode_jwt(&claims) +} + +fn validate(token: &str, user_id: &UserId, enabled: bool) -> ApiResult { + match decode_jwt::>(token, JWT_2FA_AUTH_ISSUER.to_string()) { + Ok(claims) => { + if claims.sub != *user_id { + err!("Invalid verification token: Invalid user"); + } + if claims.enabled != enabled { + err!("Invalid verification token: Invalid state"); + } + Ok(claims.claims) + } + Err(err) => err!(format!("Failed to decode verification token: {err}")), + } +} + +pub fn authenticator_token(user_id: UserId, key: String, enabled: bool) -> String { + token( + user_id, + enabled, + AuthenticatorClaims { + key, + }, + ) +} + +pub fn validate_authenticator(token: &str, user_id: &UserId, key: &str, enabled: bool) -> EmptyResult { + let claims = validate::(token, user_id, enabled)?; + if claims.key != key { + err!("Invalid verification token: Invalid key"); + } + Ok(()) +} + +pub fn duo_token(user_id: UserId, data: Option, enabled: bool) -> String { + token( + user_id, + enabled, + DuoClaims { + data, + }, + ) +} + +// When disabling we check that it's the correct data +pub fn validate_duo(token: &str, user_id: &UserId, data: Option<&DuoData>, enabled: bool) -> EmptyResult { + let claims = validate::(token, user_id, enabled)?; + if enabled && claims.data.as_ref() != data { + err!("Invalid verification token: Invalid duo data"); + } + Ok(()) +} + +pub fn email_token(user_id: UserId, email: Option, enabled: bool) -> String { + token( + user_id, + enabled, + EmailClaims { + email, + }, + ) +} + +// When disabling we check that it's the correct `email` +pub fn validate_email(token: &str, user_id: &UserId, email: String, enabled: bool) -> EmptyResult { + let claims = validate::(token, user_id, enabled)?; + if enabled && claims.email != Some(email) { + err!("Invalid verification token: Invalid email"); + } + Ok(()) +}