Merge pull request #3642 from cesanta/jwt

Add JWT Bearer Authentication support and tutorial

test/Makefile

@@ -106,7 +106,7 @@ mongoose.c: Makefile $(wildcard ../src/*.c) $(wildcard ../src/drivers/*.c)
 	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#include "mongoose.h"' ; (for F in src/*.c src/drivers/*.c ; do echo; echo '#ifdef MG_ENABLE_LINES'; echo "#line 1 \"$$F\""; echo '#endif'; cat $$F | sed -e 's,#include ".*,,'; done))> $@
 
 mongoose.h: $(HDRS) Makefile
-	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_x25519.h src/tls_aes128.h src/tls_uecc.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/rpc.h src/dash.h src/ota.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
+	cd .. && (export LC_ALL=C ; cat src/license.h; echo; echo '#ifndef MONGOOSE_H'; echo '#define MONGOOSE_H'; echo; cat src/version.h ; echo; echo '#ifdef __cplusplus'; echo 'extern "C" {'; echo '#endif'; cat src/arch.h src/arch_*.h src/os_*.h src/net_ft.h src/net_lwip.h src/net_rl.h src/config.h src/profile.h src/str.h src/queue.h src/fmt.h src/printf.h src/log.h src/timer.h src/fs.h src/util.h src/url.h src/iobuf.h src/base64.h src/md5.h src/sha1.h src/sha256.h src/event.h src/net.h src/http.h src/ssi.h src/tls.h src/tls_x25519.h src/tls_aes128.h src/tls_uecc.h src/tls_chacha20.h src/tls_rsa.h src/tls_mbed.h src/tls_openssl.h src/ws.h src/sntp.h src/mqtt.h src/dns.h src/modbus.h src/json.h src/jwt.h src/rpc.h src/dash.h src/ota.h src/flash.h src/wifi.h src/l2.h src/net_builtin.h src/bsd.h src/drivers/*.h | sed -e '/keep/! s,#include ".*,,' -e 's,^#pragma once,,'; echo; echo '#ifdef __cplusplus'; echo '}'; echo '#endif'; echo '#endif  // MONGOOSE_H')> $@
 
 # Check that all external (exported) symbols have "mg_" prefix
 mg_prefix: mongoose.c mongoose.h

test/unit_test.c

@@ -301,6 +301,13 @@ static void test_base64(void) {
   ASSERT(mg_base64_decode("AAA=", 4, buf, 2) == 0);
   ASSERT(mg_base64_decode("AAA=", 4, buf, 3) == 0);
   ASSERT(mg_base64_decode("AAA=", 4, buf, 4) == 2);
+
+  ASSERT(mg_base64url_encode((uint8_t *) "???", 3, buf, sizeof(buf)) == 4);
+  ASSERT(strcmp(buf, "Pz8_") == 0);
+  ASSERT(mg_base64url_decode("Pz8_", 4, buf, sizeof(buf)) == 3);
+  ASSERT(strcmp(buf, "???") == 0);
+  ASSERT(mg_base64url_decode("Pz8/", 4, buf, sizeof(buf)) == 0);
+  ASSERT(mg_base64url_decode("A", 1, buf, sizeof(buf)) == 0);
 }
 
 static void test_iobuf(void) {
@@ -4388,6 +4395,83 @@ static void test_rsa(void) {
 #endif
 }
 
+static void test_jwt(void) {
+  char jwt[512], claims[128], got[128], hdr[128], extra[64], tampered[512];
+  struct mg_jwt_opts opts, bad;
+  const char *dot;
+  char *str;
+  size_t n, m;
+
+  mg_snprintf(claims, sizeof(claims), "{%m:%m,%m:%d}", MG_ESC("sub"),
+              MG_ESC("admin"), MG_ESC("iat"), 123);
+  mg_snprintf(extra, sizeof(extra), "%m:%m", MG_ESC("cty"), MG_ESC("JWT"));
+  memset(&opts, 0, sizeof(opts));
+  opts.claims = mg_str(claims);
+  opts.header = mg_str(extra);
+  opts.kid = mg_str("hmac-key-1");
+  opts.secret = mg_str("secret");
+  n = mg_jwt_sign_hs256(&opts, jwt, sizeof(jwt));
+  ASSERT(n > 0 && n + 1 < sizeof(jwt));
+  jwt[n] = '\0';
+
+  dot = strchr(jwt, '.');
+  ASSERT(dot != NULL);
+  ASSERT(mg_base64url_decode(jwt, (size_t) (dot - jwt), hdr,
+                             sizeof(hdr)) > 0);
+  str = mg_json_get_str(mg_str(hdr), "$.kid");
+  ASSERT(str != NULL && strcmp(str, "hmac-key-1") == 0);
+  mg_free(str);
+  str = mg_json_get_str(mg_str(hdr), "$.cty");
+  ASSERT(str != NULL && strcmp(str, "JWT") == 0);
+  mg_free(str);
+
+  m = mg_jwt_verify_hs256(mg_str_n(jwt, n), &opts, got, sizeof(got));
+  ASSERT(m == strlen(claims));
+  ASSERT(strcmp(got, claims) == 0);
+  bad = opts;
+  bad.secret = mg_str("bad-secret");
+  ASSERT(mg_jwt_verify_hs256(mg_str_n(jwt, n), &bad, got,
+                             sizeof(got)) == 0);
+  memcpy(tampered, jwt, n + 1);
+  tampered[n - 1] = tampered[n - 1] == 'A' ? 'B' : 'A';
+  ASSERT(mg_jwt_verify_hs256(mg_str_n(tampered, n), &opts, got,
+                             sizeof(got)) == 0);
+  ASSERT(mg_jwt_sign_hs256(&opts, got, 10) == 0);
+  ASSERT(mg_jwt_verify_hs256(mg_str_n(jwt, n), &opts, got, 4) == 0);
+
+#if MG_TLS == MG_TLS_BUILTIN
+  {
+    const char *key_pem =
+        "-----BEGIN EC PRIVATE KEY-----\n"
+        "MHcCAQEEIAVdo8UAScxG7jiuNY2UZESNX/KPH8qJ0u0gOMMsAzYWoAoGCCqGSM49\n"
+        "AwEHoUQDQgAEqN6BIhvgbk7ecmUcn8Da9Avkj/uDNERtqWJG9r/or26X4u9jR5Jl\n"
+        "4hf5Gx17YJkq5/z3k6ogPDPpoAYWIw1/sw==\n"
+        "-----END EC PRIVATE KEY-----\n";
+    uint8_t key[32], pub[64];
+
+    memset(&opts, 0, sizeof(opts));
+    opts.claims = mg_str(claims);
+    opts.kid = mg_str("ec-key-1");
+    opts.private_key = key;
+    opts.public_key = pub;
+    ASSERT(mg_uecc_parse_private_key(mg_str(key_pem), key, sizeof(key)) == 32);
+    ASSERT(mg_uecc_compute_public_key(key, pub, mg_uecc_secp256r1()) == 1);
+    n = mg_jwt_sign_es256(&opts, jwt, sizeof(jwt));
+    ASSERT(n > 0 && n + 1 < sizeof(jwt));
+    jwt[n] = '\0';
+    m = mg_jwt_verify_es256(mg_str_n(jwt, n), &opts, got, sizeof(got));
+    ASSERT(m == strlen(claims));
+    ASSERT(strcmp(got, claims) == 0);
+    ASSERT(mg_jwt_verify_hs256(mg_str_n(jwt, n), &bad, got,
+                               sizeof(got)) == 0);
+    memcpy(tampered, jwt, n + 1);
+    tampered[n - 1] = tampered[n - 1] == 'A' ? 'B' : 'A';
+    ASSERT(mg_jwt_verify_es256(mg_str_n(tampered, n), &opts, got,
+                               sizeof(got)) == 0);
+  }
+#endif
+}
+
 static void test_crypto(void) {
   test_md5();
   test_sha1();
@@ -4395,6 +4479,7 @@ static void test_crypto(void) {
   test_sha384();
   test_x25519();
   test_rsa();
+  test_jwt();
 }
 
 static void dash_custom(struct mg_connection *c, int ev, void *ev_data) {