Skip to content

Commit 96c268c

Browse files
sdwolfzlafriks
sdwolfz
authored and
lafriks
committed
Implements generator cli for secrets (#3531)
Signed-off-by: Codruț Constantin Gușoi <codrut.gusoi@gmail.com>
1 parent e59fe7c commit 96c268c

File tree

12 files changed

+215
-67
lines changed

12 files changed

+215
-67
lines changed

‎cmd/generate.go

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
// Copyright 2016 The Gogs Authors. All rights reserved.
2+
// Copyright 2016 The Gitea Authors. All rights reserved.
3+
// Use of this source code is governed by a MIT-style
4+
// license that can be found in the LICENSE file.
5+
6+
package cmd
7+
8+
import (
9+
"fmt"
10+
11+
"code.gitea.io/gitea/modules/generate"
12+
13+
"github.com/urfave/cli"
14+
)
15+
16+
var (
17+
// CmdGenerate represents the available generate sub-command.
18+
CmdGenerate = cli.Command{
19+
Name: "generate",
20+
Usage: "Command line interface for running generators",
21+
Subcommands: []cli.Command{
22+
subcmdSecret,
23+
},
24+
}
25+
26+
subcmdSecret = cli.Command{
27+
Name: "secret",
28+
Usage: "Generate a secret token",
29+
Subcommands: []cli.Command{
30+
microcmdGenerateInternalToken,
31+
microcmdGenerateLfsJwtSecret,
32+
microcmdGenerateSecretKey,
33+
},
34+
}
35+
36+
microcmdGenerateInternalToken = cli.Command{
37+
Name: "INTERNAL_TOKEN",
38+
Usage: "Generate a new INTERNAL_TOKEN",
39+
Action: runGenerateInternalToken,
40+
}
41+
42+
microcmdGenerateLfsJwtSecret = cli.Command{
43+
Name: "LFS_JWT_SECRET",
44+
Usage: "Generate a new LFS_JWT_SECRET",
45+
Action: runGenerateLfsJwtSecret,
46+
}
47+
48+
microcmdGenerateSecretKey = cli.Command{
49+
Name: "SECRET_KEY",
50+
Usage: "Generate a new SECRET_KEY",
51+
Action: runGenerateSecretKey,
52+
}
53+
)
54+
55+
func runGenerateInternalToken(c *cli.Context) error {
56+
internalToken, err := generate.NewInternalToken()
57+
if err != nil {
58+
return err
59+
}
60+
61+
fmt.Printf("%s\n", internalToken)
62+
return nil
63+
}
64+
65+
func runGenerateLfsJwtSecret(c *cli.Context) error {
66+
JWTSecretBase64, err := generate.NewLfsJwtSecret()
67+
if err != nil {
68+
return err
69+
}
70+
71+
fmt.Printf("%s\n", JWTSecretBase64)
72+
return nil
73+
}
74+
75+
func runGenerateSecretKey(c *cli.Context) error {
76+
secretKey, err := generate.NewSecretKey()
77+
if err != nil {
78+
return err
79+
}
80+
81+
fmt.Printf("%s\n", secretKey)
82+
return nil
83+
}

‎main.go

+1
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ arguments - which can alternatively be run by running the subcommand web.`
4545
cmd.CmdDump,
4646
cmd.CmdCert,
4747
cmd.CmdAdmin,
48+
cmd.CmdGenerate,
4849
}
4950
app.Flags = append(app.Flags, []cli.Flag{}...)
5051
app.Action = cmd.CmdWeb.Action

‎models/migrations/migrations.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import (
2020
gouuid "github.com/satori/go.uuid"
2121
"gopkg.in/ini.v1"
2222

23-
"code.gitea.io/gitea/modules/base"
23+
"code.gitea.io/gitea/modules/generate"
2424
"code.gitea.io/gitea/modules/log"
2525
"code.gitea.io/gitea/modules/setting"
2626
)
@@ -539,10 +539,10 @@ func generateOrgRandsAndSalt(x *xorm.Engine) (err error) {
539539
}
540540

541541
for _, org := range orgs {
542-
if org.Rands, err = base.GetRandomString(10); err != nil {
542+
if org.Rands, err = generate.GetRandomString(10); err != nil {
543543
return err
544544
}
545-
if org.Salt, err = base.GetRandomString(10); err != nil {
545+
if org.Salt, err = generate.GetRandomString(10); err != nil {
546546
return err
547547
}
548548
if _, err = sess.Id(org.ID).Update(org); err != nil {

‎models/twofactor.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ import (
1616

1717
"github.com/pquerna/otp/totp"
1818

19-
"code.gitea.io/gitea/modules/base"
19+
"code.gitea.io/gitea/modules/generate"
2020
"code.gitea.io/gitea/modules/setting"
2121
"code.gitea.io/gitea/modules/util"
2222
)
@@ -33,7 +33,7 @@ type TwoFactor struct {
3333

3434
// GenerateScratchToken recreates the scratch token the user is using.
3535
func (t *TwoFactor) GenerateScratchToken() error {
36-
token, err := base.GetRandomString(8)
36+
token, err := generate.GetRandomString(8)
3737
if err != nil {
3838
return err
3939
}

‎models/user.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434

3535
"code.gitea.io/gitea/modules/avatar"
3636
"code.gitea.io/gitea/modules/base"
37+
"code.gitea.io/gitea/modules/generate"
3738
"code.gitea.io/gitea/modules/log"
3839
"code.gitea.io/gitea/modules/setting"
3940
"code.gitea.io/gitea/modules/util"
@@ -638,7 +639,7 @@ func IsUserExist(uid int64, name string) (bool, error) {
638639

639640
// GetUserSalt returns a random user salt token.
640641
func GetUserSalt() (string, error) {
641-
return base.GetRandomString(10)
642+
return generate.GetRandomString(10)
642643
}
643644

644645
// NewGhostUser creates and returns a fake user for someone has deleted his/her account.

‎modules/base/tool.go

-29
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ import (
1414
"html/template"
1515
"io"
1616
"math"
17-
"math/big"
1817
"net/http"
1918
"net/url"
2019
"path"
@@ -88,25 +87,6 @@ func BasicAuthEncode(username, password string) string {
8887
return base64.StdEncoding.EncodeToString([]byte(username + ":" + password))
8988
}
9089

91-
// GetRandomString generate random string by specify chars.
92-
func GetRandomString(n int) (string, error) {
93-
const alphanum = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
94-
95-
buffer := make([]byte, n)
96-
max := big.NewInt(int64(len(alphanum)))
97-
98-
for i := 0; i < n; i++ {
99-
index, err := randomInt(max)
100-
if err != nil {
101-
return "", err
102-
}
103-
104-
buffer[i] = alphanum[index]
105-
}
106-
107-
return string(buffer), nil
108-
}
109-
11090
// GetRandomBytesAsBase64 generates a random base64 string from n bytes
11191
func GetRandomBytesAsBase64(n int) string {
11292
bytes := make([]byte, 32)
@@ -119,15 +99,6 @@ func GetRandomBytesAsBase64(n int) string {
11999
return base64.RawURLEncoding.EncodeToString(bytes)
120100
}
121101

122-
func randomInt(max *big.Int) (int, error) {
123-
rand, err := rand.Int(rand.Reader, max)
124-
if err != nil {
125-
return 0, err
126-
}
127-
128-
return int(rand.Int64()), nil
129-
}
130-
131102
// VerifyTimeLimitCode verify time limit code
132103
func VerifyTimeLimitCode(data string, minutes int, code string) bool {
133104
if len(code) <= 18 {

‎modules/base/tool_test.go

-6
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,6 @@ func TestBasicAuthEncode(t *testing.T) {
107107
assert.Equal(t, "Zm9vOmJhcg==", BasicAuthEncode("foo", "bar"))
108108
}
109109

110-
func TestGetRandomString(t *testing.T) {
111-
randomString, err := GetRandomString(4)
112-
assert.NoError(t, err)
113-
assert.Len(t, randomString, 4)
114-
}
115-
116110
// TODO: Test PBKDF2()
117111
// TODO: Test VerifyTimeLimitCode()
118112
// TODO: Test CreateTimeLimitCode()

‎modules/generate/generate.go

+89
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
// Copyright 2016 The Gogs Authors. All rights reserved.
2+
// Copyright 2016 The Gitea Authors. All rights reserved.
3+
// Use of this source code is governed by a MIT-style
4+
// license that can be found in the LICENSE file.
5+
6+
package generate
7+
8+
import (
9+
"crypto/rand"
10+
"encoding/base64"
11+
"io"
12+
"math/big"
13+
"time"
14+
15+
"github.com/dgrijalva/jwt-go"
16+
)
17+
18+
// GetRandomString generate random string by specify chars.
19+
func GetRandomString(n int) (string, error) {
20+
const alphanum = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
21+
22+
buffer := make([]byte, n)
23+
max := big.NewInt(int64(len(alphanum)))
24+
25+
for i := 0; i < n; i++ {
26+
index, err := randomInt(max)
27+
if err != nil {
28+
return "", err
29+
}
30+
31+
buffer[i] = alphanum[index]
32+
}
33+
34+
return string(buffer), nil
35+
}
36+
37+
// NewInternalToken generate a new value intended to be used by INTERNAL_TOKEN.
38+
func NewInternalToken() (string, error) {
39+
secretBytes := make([]byte, 32)
40+
_, err := io.ReadFull(rand.Reader, secretBytes)
41+
if err != nil {
42+
return "", err
43+
}
44+
45+
secretKey := base64.RawURLEncoding.EncodeToString(secretBytes)
46+
47+
now := time.Now()
48+
49+
var internalToken string
50+
internalToken, err = jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
51+
"nbf": now.Unix(),
52+
}).SignedString([]byte(secretKey))
53+
if err != nil {
54+
return "", err
55+
}
56+
57+
return internalToken, nil
58+
}
59+
60+
// NewLfsJwtSecret generate a new value intended to be used by LFS_JWT_SECRET.
61+
func NewLfsJwtSecret() (string, error) {
62+
JWTSecretBytes := make([]byte, 32)
63+
_, err := io.ReadFull(rand.Reader, JWTSecretBytes)
64+
if err != nil {
65+
return "", err
66+
}
67+
68+
JWTSecretBase64 := base64.RawURLEncoding.EncodeToString(JWTSecretBytes)
69+
return JWTSecretBase64, nil
70+
}
71+
72+
// NewSecretKey generate a new value intended to be used by SECRET_KEY.
73+
func NewSecretKey() (string, error) {
74+
secretKey, err := GetRandomString(64)
75+
if err != nil {
76+
return "", err
77+
}
78+
79+
return secretKey, nil
80+
}
81+
82+
func randomInt(max *big.Int) (int, error) {
83+
rand, err := rand.Int(rand.Reader, max)
84+
if err != nil {
85+
return 0, err
86+
}
87+
88+
return int(rand.Int64()), nil
89+
}

‎modules/generate/generate_test.go

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
package generate
2+
3+
import (
4+
"os"
5+
"testing"
6+
7+
"github.com/stretchr/testify/assert"
8+
)
9+
10+
func TestMain(m *testing.M) {
11+
retVal := m.Run()
12+
13+
os.Exit(retVal)
14+
}
15+
16+
func TestGetRandomString(t *testing.T) {
17+
randomString, err := GetRandomString(4)
18+
assert.NoError(t, err)
19+
assert.Len(t, randomString, 4)
20+
}

‎modules/setting/setting.go

+5-23
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,8 @@
66
package setting
77

88
import (
9-
"crypto/rand"
109
"encoding/base64"
1110
"fmt"
12-
"io"
1311
"net"
1412
"net/mail"
1513
"net/url"
@@ -24,12 +22,12 @@ import (
2422
"time"
2523

2624
"code.gitea.io/git"
25+
"code.gitea.io/gitea/modules/generate"
2726
"code.gitea.io/gitea/modules/log"
2827
_ "code.gitea.io/gitea/modules/minwinsvc" // import minwinsvc for windows services
2928
"code.gitea.io/gitea/modules/user"
3029

3130
"github.com/Unknwon/com"
32-
"github.com/dgrijalva/jwt-go"
3331
_ "github.com/go-macaron/cache/memcache" // memcache plugin for cache
3432
_ "github.com/go-macaron/cache/redis"
3533
"github.com/go-macaron/session"
@@ -834,16 +832,12 @@ func NewContext() {
834832
n, err := base64.RawURLEncoding.Decode(LFS.JWTSecretBytes, []byte(LFS.JWTSecretBase64))
835833

836834
if err != nil || n != 32 {
837-
//Generate new secret and save to config
838-
839-
_, err := io.ReadFull(rand.Reader, LFS.JWTSecretBytes)
840-
835+
LFS.JWTSecretBase64, err = generate.NewLfsJwtSecret()
841836
if err != nil {
842-
log.Fatal(4, "Error reading random bytes: %v", err)
837+
log.Fatal(4, "Error generating JWT Secret for custom config: %v", err)
838+
return
843839
}
844840

845-
LFS.JWTSecretBase64 = base64.RawURLEncoding.EncodeToString(LFS.JWTSecretBytes)
846-
847841
// Save secret
848842
cfg := ini.Empty()
849843
if com.IsFile(CustomConf) {
@@ -913,19 +907,7 @@ func NewContext() {
913907
DisableGitHooks = sec.Key("DISABLE_GIT_HOOKS").MustBool(false)
914908
InternalToken = sec.Key("INTERNAL_TOKEN").String()
915909
if len(InternalToken) == 0 {
916-
secretBytes := make([]byte, 32)
917-
_, err := io.ReadFull(rand.Reader, secretBytes)
918-
if err != nil {
919-
log.Fatal(4, "Error reading random bytes: %v", err)
920-
}
921-
922-
secretKey := base64.RawURLEncoding.EncodeToString(secretBytes)
923-
924-
now := time.Now()
925-
InternalToken, err = jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
926-
"nbf": now.Unix(),
927-
}).SignedString([]byte(secretKey))
928-
910+
InternalToken, err = generate.NewInternalToken()
929911
if err != nil {
930912
log.Fatal(4, "Error generate internal token: %v", err)
931913
}

0 commit comments

Comments
 (0)