openGauss数据库源码解析系列文章——安全管理源码解析（一）

hostssl   DATABASE USER ADDRESS METHOD [OPTIONS]

typedef struct HbaLine
{
    int linenumber;          /*  规则行号 */
    ConnType conntype;      /*  连接套接字方法 */
    List* databases;        /*  允许访问的数据库集合*/
    List* roles;             /*  允许访问的用户组 */
…
    char* hostname;         /*  允许访问的IP地址 */
    UserAuth auth_method; /*  认证方法 */
…
} HbaLine;

typedef struct Port {
…
SockAddr laddr;             /*  本地进程IP（internet protocol，互联网协议）地址信息 */
SockAddr raddr;             /*  远端客户端进程IP地址信息  */
char* remote_host;         /*  远端host（主机）名称字符串或IP地址*/
char* remote_hostname;    /*  可选项，远程host名称字符串或IP地址*/
    …
    /*  发送给backend（后端）的数据包信息，包括访问的数据库名称、用户名、配置参数*/
char* database_name;
char* user_name;
char* cmdline_options;
List* guc_options;
    
/*  认证相关的配置信息*/
HbaLine* hba;
…
    /*  SSL（secure sockets layer，安全套接层，工作于套接字层的安全协议。）认证信息*/
#ifdef USE_SSL
    SSL* ssl;
    X509* peer;
    char* peer_cn;
    unsigned long count;
#endif
…
    /*  Kerberos认证数据结构信息*/
#ifdef ENABLE_GSS
    char* krbsrvname;           /*  Kerberos服务进程名称*/
    gss_ctx_id_t gss_ctx;         /*  GSS（generic security service，通用安全服务）数据内容*/
    gss_cred_id_t gss_cred;       /*  凭证信息*/
    gss_name_t gss_name;        
    gss_buffer_desc gss_outbuf;    /*  GSS token信息*/
#endif
} Port;

/**扫描HBA文件，寻找匹配连接请求的规则项 */
static void check_hba(hbaPort* port)
{
    ……
    /*  获取当前连接用户的id  */
    roleid = get_role_oid(port->user_name, true);

    foreach (line, t_thrd.libpq_cxt.parsed_hba_lines) {
        hba = (HbaLine*)lfirst(line);
        /*  认证连接行为分为本地连接行为和远程连接行为，需分开考虑  */
        if (hba->conntype == ctLocal) {
        /*  对于local套接字，仅允许初始安装用户本地登录  */
            if (roleid == INITIAL_USER_ID) {
                char sys_user[SYS_USERNAME_MAX + 1];
……
                /*  基于本地环境的uid（user identity，用户身份标识）信息获取当前系统用户名  */
                (void)getpwuid_r(uid, &pwtmp, pwbuf, pwbufsz, &pw);
                ……

                /*  记录当前系统用户名  */
                securec_check(strncpy_s(sys_user,SYS_USERNAME_MAX+1, pw->pw_name, SYS_USERNAME_MAX), "\0", "\0");

/*  对于访问用户与本地系统用户不相匹配的场景，均需提供密码  */
            if (strcmp(port->user_name, sys_user) != 0)
                hba->auth_method = uaSHA256;
            } else if (hba->auth_method == uaTrust) {
                hba->auth_method = uaSHA256;
            }
……
        } else {
            /*  访问行为是远端访问行为，需要逐条判断包括认证方式在内的信息正确性  */
            if (IS_AF_UNIX(port->raddr.addr.ss_family))
                continue;
    /*  SSL连接请求套接字判断  */
#ifdef USE_SSL
if (port->ssl != NULL) {
                    if (hba->conntype == ctHostNoSSL)
                        continue;
                } else {
                    if (hba->conntype == ctHostSSL)
                        continue;
                }
#else
             if (hba->conntype == ctHostSSL)
                   continue;
#endif
               /*  IP白名单校验  */
               switch (hba->ip_cmp_method) {
                   case ipCmpMask:
                       if (hba->hostname != NULL) {
                           if (!check_hostname(port, hba->hostname))
                               continue;
                       } else {
                           if (!check_ip(&port->raddr, (struct sockaddr*)&hba->addr, (struct sockaddr*)&hba->mask))
                               continue;
                       }
                       break;
                   case ipCmpAll:
                       break;
                   case ipCmpSameHost:
                   case ipCmpSameNet:
                       if (!check_same_host_or_net(&port->raddr, hba->ip_cmp_method))
                           continue;
                       break;
                   default:
                       /* shouldn't get here, but deem it no-match if so */
                       continue;
            }
        } /* != ctLocal */

        /*  校验数据库信息和用户信息  */
        if (!check_db(port->database_name, port->user_name, roleid, hba->databases))
            continue;
        if (!check_role(port->user_name, roleid, hba->roles))
            continue;
        ……
        port->hba = hba;
        return;
    }

    /*  没有匹配则拒绝当前连接请求  */
    hba = (HbaLine*)palloc0(sizeof(HbaLine));
    hba->auth_method = uaImplicitReject;
    port->hba = hba;
}

SaltedPassword := Hi(password, salt, iteration_count) /*其中，Hi()本质上是PBKDF2*/
ClientKey := HMAC(SaltedPassword, "Client Key")
StoredKey := sha256(ClientKey)
ServerKey := HMAC(SaltedPassword, "Sever Key")
ClientSignature:=HMAC(StoredKey, token)
ServerSignature:= HMAC(ServerKey, token)
ClientProof:= ClientSignature XOR ClientKey

ServerSignature := HMAC(ServerKey, token)

ClientSignature := HMAC(StoredKey,token)

ClientProof := ClientKey XOR ClientSignature

ClientSignature := HMAC(StoredKey, token)
HMAC(ClientProof XOR ClientSignature ) = StoredKey

void ClientAuthentication(Port* port)
{
    int status = STATUS_ERROR;
    char details[PGAUDIT_MAXLENGTH] = {0};
    char token[TOKEN_LENGTH + 1] = {0};
    errno_t rc = EOK;
    GS_UINT32 retval = 0;
hba_getauthmethod(port);
……
    switch (port->hba->auth_method) {
        case uaReject:
……
case uaImplicitReject:
        ……
/*  使用MD5口令认证  */
case uaMD5:
            sendAuthRequest(port, AUTH_REQ_MD5);
            status = recv_and_check_password_packet(port);
            break;
/*  使用sha256认证方法  */
case uaSHA256:
            /*  禁止使用初始用户进行远程连接  */
            if (isRemoteInitialUser(port)) {
                ereport(FATAL,
                  (errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION), errmsg("Forbid remote connection with initial user.")));
    }
    rc = memset_s(port->token, TOKEN_LENGTH * 2 + 1, 0, TOKEN_LENGTH * 2 + 1);
    securec_check(rc, "\0", "\0");
    HOLD_INTERRUPTS();
    /*  生成随机数token  */
    retval = RAND_priv_bytes ((GS_UCHAR*)token, (GS_UINT32)TOKEN_LENGTH);
    RESUME_INTERRUPTS();
    CHECK_FOR_INTERRUPTS();
    if (retval != 1) {
        ereport(ERROR, (errmsg("Failed to Generate the random number,errcode:%u", retval)));
    }
    sha_bytes_to_hex8((uint8*)token, port->token);
    port->token[TOKEN_LENGTH * 2] = '\0';
    /*  发送认证请求到前端，认证码为AUTH_REQ_SHA256  */
    sendAuthRequest(port, AUTH_REQ_SHA256);
    /*  接收并校验客户端的信息  */
    status = recv_and_check_password_packet(port);
    break;
……
}
……
if (status == STATUS_OK)
    sendAuthRequest(port, AUTH_REQ_OK);
else {
    auth_failed(port, status);
}

/*  完成认证，关闭参数ImmediateInterruptOK  */
t_thrd.int_cxt.ImmediateInterruptOK = false;
}

static int pg_password_sendauth(PGconn* conn, const char* password, AuthRequest areq)
{
int ret;
/*  初始化变量  */
……
    char h[HMAC_LENGTH + 1] = {0};
    char h_string[HMAC_LENGTH * 2 + 1] = {0};
    char hmac_result[HMAC_LENGTH + 1] = {0};
    char client_key_bytes[HMAC_LENGTH + 1] = {0};
    switch (areq) {
      case AUTH_REQ_MD5: 
/*  pg_md5_encrypt()通过MD5Salt进行MD5加密  */
……
case AUTH_REQ_MD5_SHA256:
……
      case AUTH_REQ_SHA256: {
        char* crypt_pwd2 = NULL;
        if (SHA256_PASSWORD == conn->password_stored_method || PLAIN_PASSWORD == conn->password_stored_method) {
            /*  通过SHA256方式加密密码  */
            if (!pg_sha256_encrypt(
                    password, conn->salt, strlen(conn->salt), (char*)buf, client_key_buf, conn->iteration_count))
                return STATUS_ERROR;

            rc = strncpy_s(server_key_string,
                sizeof(server_key_string),
                &buf[SHA256_LENGTH + SALT_STRING_LENGTH],
                sizeof(server_key_string) - 1);
            securec_check_c(rc, "\0", "\0");
            rc = strncpy_s(stored_key_string,
                sizeof(stored_key_string),
                &buf[SHA256_LENGTH + SALT_STRING_LENGTH + HMAC_STRING_LENGTH],
                sizeof(stored_key_string) - 1);
            securec_check_c(rc, "\0", "\0");
            server_key_string[sizeof(server_key_string) - 1] = '\0';
            stored_key_string[sizeof(stored_key_string) - 1] = '\0';

            sha_hex_to_bytes32(server_key_bytes, server_key_string);
            sha_hex_to_bytes4(token, conn->token);
/*  通过server_key和token调用HMAC算法计算，得到client_server_signature_bytes，通过该变量转为字符串变量，用来验证与服务端传来的server_signature是否相等。  */
            CRYPT_hmac_ret1 = CRYPT_hmac(NID_hmacWithSHA256,
                (GS_UCHAR*)server_key_bytes,
                HMAC_LENGTH,
                (GS_UCHAR*)token,
                TOKEN_LENGTH,
                (GS_UCHAR*)client_server_signature_bytes,
                (GS_UINT32*)&hmac_length);
            if (CRYPT_hmac_ret1) {
                return STATUS_ERROR;
            }
            sha_bytes_to_hex64((uint8*)client_server_signature_bytes, client_server_signature_string);

/*  调用函数strncmp判断计算的client_server_signature_string和服务端传来的server_signature值是否相等  */
            if (PG_PROTOCOL_MINOR(conn->pversion) < PG_PROTOCOL_GAUSS_BASE &&
                0 != strncmp(conn->server_signature, client_server_signature_string, HMAC_STRING_LENGTH)) {
                pwd_to_send = fail_info;  /*  不相等则认证失败  */
            } else {
                sha_hex_to_bytes32(stored_key_bytes, stored_key_string);
                /*  通过stored_key和token计算得到hmac_result  */
                CRYPT_hmac_ret2 = CRYPT_hmac(NID_hmacWithSHA256,
                    (GS_UCHAR*)stored_key_bytes,
                    STORED_KEY_LENGTH,
                    (GS_UCHAR*)token,
                    TOKEN_LENGTH,
                    (GS_UCHAR*)hmac_result,
                    (GS_UINT32*)&hmac_length);

                if (CRYPT_hmac_ret2) {
                    return STATUS_ERROR;
                }

                sha_hex_to_bytes32(client_key_bytes, client_key_buf);
/*  hmac_result和client_key_bytes异或得到h，然后将其发送给服务端，用于验证客户端  */
                if (XOR_between_password(hmac_result, client_key_bytes, h, HMAC_LENGTH)) {
                    return STATUS_ERROR;
                }

                sha_bytes_to_hex64((uint8*)h, h_string);
                pwd_to_send = h_string; /* 设置要发送给服务端的值  */
            }
        } 
……
        break;
/*  清空变量  */
……
    return ret;
}

typedef struct GssConn {
    int sock;
    gss_ctx_id_t gctx;        /*  GSS 上下文  */
    gss_name_t gtarg_nam;   /*  GSS 名称  */
    gss_buffer_desc ginbuf;   /*  GSS 输入token  */
    gss_buffer_desc goutbuf;  /*  GSS 输出token  */
} GssConn; 
/*  客户端、服务端接口,用于封装标准kerberos协议调用,其中客户端接口用于向服务端  */
/*  发起访问，同时响应服务端接口GssServerAuth发起的票据请求  */
int GssClientAuth(int socket, char* server_host);
int GssServerAuth(int socket, const char* krb_keyfile);