relay: add command "handshake" in weechat relay protocol and nonce to prevent replay attacks (closes #1474)

This introduces a new command called "handshake" in the weechat relay protocol.
It should be sent by the client before the "init" command, to negotiate the way
to authenticate with a password.

3 new options are added:

* relay.network.auth_password
* relay.network.hash_iterations
* relay.network.nonce_size

src/plugins/relay/CMakeLists.txt

@@ -19,13 +19,9 @@
 
 add_library(relay MODULE
   relay.c relay.h
+  relay-auth.c relay-auth.h
   relay-buffer.c relay-buffer.h
   relay-client.c relay-client.h
-  irc/relay-irc.c irc/relay-irc.h
-  weechat/relay-weechat.c weechat/relay-weechat.h
-  weechat/relay-weechat-msg.c weechat/relay-weechat-msg.h
-  weechat/relay-weechat-nicklist.c weechat/relay-weechat-nicklist.h
-  weechat/relay-weechat-protocol.c weechat/relay-weechat-protocol.h
   relay-command.c relay-command.h
   relay-completion.c relay-completion.h
   relay-config.c relay-config.h
@@ -35,6 +31,13 @@ add_library(relay MODULE
   relay-server.c relay-server.h
   relay-upgrade.c relay-upgrade.h
   relay-websocket.c relay-websocket.h
+  # irc relay
+  irc/relay-irc.c irc/relay-irc.h
+  # weechat relay
+  weechat/relay-weechat.c weechat/relay-weechat.h
+  weechat/relay-weechat-msg.c weechat/relay-weechat-msg.h
+  weechat/relay-weechat-nicklist.c weechat/relay-weechat-nicklist.h
+  weechat/relay-weechat-protocol.c weechat/relay-weechat-protocol.h
 )
 set_target_properties(relay PROPERTIES PREFIX "")
 

src/plugins/relay/Makefile.am

@@ -25,20 +25,12 @@ lib_LTLIBRARIES = relay.la
 
 relay_la_SOURCES = relay.c \
                    relay.h \
+                   relay-auth.c \
+                   relay-auth.h \
                    relay-buffer.c \
                    relay-buffer.h \
                    relay-client.c \
                    relay-client.h \
-                   irc/relay-irc.c \
-                   irc/relay-irc.h \
-                   weechat/relay-weechat.c \
-                   weechat/relay-weechat.h \
-                   weechat/relay-weechat-msg.c \
-                   weechat/relay-weechat-msg.h \
-                   weechat/relay-weechat-nicklist.c \
-                   weechat/relay-weechat-nicklist.h \
-                   weechat/relay-weechat-protocol.c \
-                   weechat/relay-weechat-protocol.h \
                    relay-command.c \
                    relay-command.h \
                    relay-completion.c \
@@ -56,7 +48,17 @@ relay_la_SOURCES = relay.c \
                    relay-upgrade.c \
                    relay-upgrade.h \
                    relay-websocket.c \
-                   relay-websocket.h
+                   relay-websocket.h \
+                   irc/relay-irc.c \
+                   irc/relay-irc.h \
+                   weechat/relay-weechat.c \
+                   weechat/relay-weechat.h \
+                   weechat/relay-weechat-msg.c \
+                   weechat/relay-weechat-msg.h \
+                   weechat/relay-weechat-nicklist.c \
+                   weechat/relay-weechat-nicklist.h \
+                   weechat/relay-weechat-protocol.c \
+                   weechat/relay-weechat-protocol.h
 
 relay_la_LDFLAGS = -module -no-undefined
 relay_la_LIBADD  = $(RELAY_LFLAGS) $(ZLIB_LFLAGS) $(GNUTLS_LFLAGS)

src/plugins/relay/relay-auth.h

@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2003-2020 Sébastien Helleu <flashcode@flashtux.org>
+ *
+ * This file is part of WeeChat, the extensible chat client.
+ *
+ * WeeChat is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * WeeChat is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with WeeChat.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef WEECHAT_PLUGIN_RELAY_AUTH_H
+#define WEECHAT_PLUGIN_RELAY_AUTH_H
+
+struct t_relay_client;
+
+enum t_relay_auth_password
+{
+    RELAY_AUTH_PASSWORD_PLAIN = 0,
+    RELAY_AUTH_PASSWORD_SHA256,
+    RELAY_AUTH_PASSWORD_SHA512,
+    RELAY_AUTH_PASSWORD_PBKDF2_SHA256,
+    RELAY_AUTH_PASSWORD_PBKDF2_SHA512,
+    /* number of password auths */
+    RELAY_NUM_PASSWORD_AUTHS,
+};
+
+extern char *relay_auth_password_name[];
+
+extern int relay_auth_password_search (const char *name);
+extern char *relay_auth_generate_nonce ();
+extern int relay_auth_check_password_plain (const char *password,
+                                            const char *relay_password);
+extern int relay_auth_password (struct t_relay_client *client,
+                                const char *password,
+                                const char *relay_password);
+extern void relay_auth_parse_sha (const char *parameters,
+                                  char **salt_hexa,
+                                  char **salt,
+                                  int *salt_size,
+                                  char **hash);
+extern void relay_auth_parse_pbkdf2 (const char *parameters,
+                                     char **salt_hexa,
+                                     char **salt,
+                                     int *salt_size,
+                                     int *iterations,
+                                     char **hash);
+extern int relay_auth_check_salt (struct t_relay_client *client,
+                                  const char *salt_hexa);
+extern int relay_auth_check_hash_sha (const char *hash_algo,
+                                      const char *salt,
+                                      int salt_size,
+                                      const char *hash_sha,
+                                      const char *relay_password);
+extern int relay_auth_check_hash_pbkdf2 (const char *hash_pbkdf2_algo,
+                                         const char *salt,
+                                         int salt_size,
+                                         int iterations,
+                                         const char *hash_pbkdf2,
+                                         const char *relay_password);
+extern int relay_auth_password_hash (struct t_relay_client *client,
+                                     const char *hashed_password,
+                                     const char *relay_password);
+
+#endif /* WEECHAT_PLUGIN_RELAY_AUTH_H */

src/plugins/relay/relay-client.c

@@ -36,14 +36,15 @@
 #include "../weechat-plugin.h"
 #include "relay.h"
 #include "relay-client.h"
-#include "irc/relay-irc.h"
-#include "weechat/relay-weechat.h"
+#include "relay-auth.h"
 #include "relay-config.h"
 #include "relay-buffer.h"
 #include "relay-network.h"
 #include "relay-raw.h"
 #include "relay-server.h"
 #include "relay-websocket.h"
+#include "irc/relay-irc.h"
+#include "weechat/relay-weechat.h"
 
 
 char *relay_client_status_string[] =   /* status strings for display        */
@@ -1269,6 +1270,7 @@ struct t_relay_client *
 relay_client_new (int sock, const char *address, struct t_relay_server *server)
 {
     struct t_relay_client *new_client;
+    int plain_text_password;
 #ifdef HAVE_GNUTLS
     int bits;
     struct t_config_option *ptr_option;
@@ -1295,6 +1297,14 @@ relay_client_new (int sock, const char *address, struct t_relay_server *server)
         new_client->protocol = server->protocol;
         new_client->protocol_string = (server->protocol_string) ? strdup (server->protocol_string) : NULL;
         new_client->protocol_args = (server->protocol_args) ? strdup (server->protocol_args) : NULL;
+        plain_text_password = weechat_string_match_list (
+            relay_auth_password_name[0],
+            (const char **)relay_config_network_auth_password_list,
+            1);
+        new_client->auth_password = (plain_text_password) ? 0 : -1;
+        new_client->hash_iterations = weechat_config_integer (
+            relay_config_network_hash_iterations);
+        new_client->nonce = relay_auth_generate_nonce ();
         new_client->listen_start_time = server->start_time;
         new_client->start_time = time (NULL);
         new_client->end_time = 0;
@@ -1496,6 +1506,22 @@ relay_client_new_with_infolist (struct t_infolist *infolist)
         new_client->protocol_string = (str) ? strdup (str) : NULL;
         str = weechat_infolist_string (infolist, "protocol_args");
         new_client->protocol_args = (str) ? strdup (str) : NULL;
+        /* "auth_password" is new in WeeChat 2.9 */
+        if (weechat_infolist_search_var (infolist, "auth_password"))
+            new_client->auth_password = weechat_infolist_integer (infolist, "auth_password");
+        else
+            new_client->auth_password = RELAY_AUTH_PASSWORD_PLAIN;
+        /* "hash_iterations" is new in WeeChat 2.9 */
+        if (weechat_infolist_search_var (infolist, "hash_iterations"))
+            new_client->hash_iterations = weechat_infolist_integer (infolist, "hash_iterations");
+        else
+            new_client->hash_iterations = weechat_config_integer (
+                relay_config_network_hash_iterations);
+        /* "nonce" is new in WeeChat 2.9 */
+        if (weechat_infolist_search_var (infolist, "nonce"))
+            new_client->nonce = strdup (weechat_infolist_string (infolist, "nonce"));
+        else
+            new_client->nonce = relay_auth_generate_nonce ();
         new_client->listen_start_time = weechat_infolist_time (infolist, "listen_start_time");
         new_client->start_time = weechat_infolist_time (infolist, "start_time");
         new_client->end_time = weechat_infolist_time (infolist, "end_time");
@@ -1693,6 +1719,8 @@ relay_client_free (struct t_relay_client *client)
         free (client->protocol_string);
     if (client->protocol_args)
         free (client->protocol_args);
+    if (client->nonce)
+        free (client->nonce);
 #ifdef HAVE_GNUTLS
     if (client->hook_timer_handshake)
         weechat_unhook (client->hook_timer_handshake);
@@ -1829,6 +1857,12 @@ relay_client_add_to_infolist (struct t_infolist *infolist,
         return 0;
     if (!weechat_infolist_new_var_string (ptr_item, "protocol_args", client->protocol_args))
         return 0;
+    if (!weechat_infolist_new_var_integer (ptr_item, "auth_password", client->auth_password))
+        return 0;
+    if (!weechat_infolist_new_var_integer (ptr_item, "hash_iterations", client->hash_iterations))
+        return 0;
+    if (!weechat_infolist_new_var_string (ptr_item, "nonce", client->nonce))
+        return 0;
     if (!weechat_infolist_new_var_time (ptr_item, "listen_start_time", client->listen_start_time))
         return 0;
     if (!weechat_infolist_new_var_time (ptr_item, "start_time", client->start_time))
@@ -1905,6 +1939,12 @@ relay_client_print_log ()
                             relay_protocol_string[ptr_client->protocol]);
         weechat_log_printf ("  protocol_string . . . : '%s'",  ptr_client->protocol_string);
         weechat_log_printf ("  protocol_args . . . . : '%s'",  ptr_client->protocol_args);
+        weechat_log_printf ("  auth_password . . . . : %d (%s)",
+                            ptr_client->auth_password,
+                            (ptr_client->auth_password >= 0) ?
+                            relay_auth_password_name[ptr_client->auth_password] : "");
+        weechat_log_printf ("  hash_iterations . . . : %d",    ptr_client->hash_iterations);
+        weechat_log_printf ("  nonce . . . . . . . . : '%s'",  ptr_client->nonce);
         weechat_log_printf ("  listen_start_time . . : %lld",  (long long)ptr_client->listen_start_time);
         weechat_log_printf ("  start_time. . . . . . : %lld",  (long long)ptr_client->start_time);
         weechat_log_printf ("  end_time. . . . . . . : %lld",  (long long)ptr_client->end_time);

src/plugins/relay/relay-client.h

@@ -106,6 +106,9 @@ struct t_relay_client
     char *protocol_string;             /* example: "ipv6.ssl.irc.freenode"  */
     char *protocol_args;               /* arguments used for protocol       */
                                        /* example: server for irc protocol  */
+    int auth_password;                 /* password auth (negotiated/client) */
+    int hash_iterations;               /* hash iterations                   */
+    char *nonce;                       /* nonce used in salt of hashed pwd  */
     time_t listen_start_time;          /* when listening started            */
     time_t start_time;                 /* time of client connection         */
     time_t end_time;                   /* time of client disconnection      */
@@ -124,6 +127,7 @@ struct t_relay_client
 };
 
 extern char *relay_client_status_string[];
+extern char *relay_client_status_name[];
 extern char *relay_client_msg_type_string[];
 extern struct t_relay_client *relay_clients;
 extern struct t_relay_client *last_relay_client;

src/plugins/relay/relay-config.h

@@ -39,12 +39,15 @@ extern struct t_config_option *relay_config_color_text_selected;
 
 extern struct t_config_option *relay_config_network_allow_empty_password;
 extern struct t_config_option *relay_config_network_allowed_ips;
+extern struct t_config_option *relay_config_network_auth_password;
 extern struct t_config_option *relay_config_network_auth_timeout;
 extern struct t_config_option *relay_config_network_bind_address;
 extern struct t_config_option *relay_config_network_clients_purge_delay;
 extern struct t_config_option *relay_config_network_compression_level;
+extern struct t_config_option *relay_config_network_hash_iterations;
 extern struct t_config_option *relay_config_network_ipv6;
 extern struct t_config_option *relay_config_network_max_clients;
+extern struct t_config_option *relay_config_network_nonce_size;
 extern struct t_config_option *relay_config_network_password;
 extern struct t_config_option *relay_config_network_ssl_cert_key;
 extern struct t_config_option *relay_config_network_ssl_priorities;
@@ -64,6 +67,7 @@ extern struct t_config_option *relay_config_weechat_commands;
 extern regex_t *relay_config_regex_allowed_ips;
 extern regex_t *relay_config_regex_websocket_allowed_origins;
 extern struct t_hashtable *relay_config_hashtable_irc_backlog_tags;
+extern char **relay_config_network_auth_password_list;
 
 extern int relay_config_check_network_totp_secret (const void *pointer,
                                                    void *data,

src/plugins/relay/weechat/relay-weechat-msg.h

@@ -70,6 +70,8 @@ extern void relay_weechat_msg_add_pointer (struct t_relay_weechat_msg *msg,
                                            void *pointer);
 extern void relay_weechat_msg_add_time (struct t_relay_weechat_msg *msg,
                                         time_t time);
+extern void relay_weechat_msg_add_hashtable (struct t_relay_weechat_msg *msg,
+                                             struct t_hashtable *hashtable);
 extern int relay_weechat_msg_add_hdata (struct t_relay_weechat_msg *msg,
                                         const char *path, const char *keys);
 extern void relay_weechat_msg_add_infolist (struct t_relay_weechat_msg *msg,

src/plugins/relay/weechat/relay-weechat.c

@@ -40,7 +40,7 @@
 #include "../relay-raw.h"
 
 
-char *relay_weechat_compression_string[] = /* strings for compressions      */
+char *relay_weechat_compression_string[] = /* strings for compression       */
 { "off", "zlib" };