Two factor authentication support (#630)

* Initial commit for 2FA support

Signed-off-by: Andrew <write@imaginarycode.com>

* Add vendored files

* Add missing depends

* A few clean ups

* Added improvements, proper encryption

* Better encryption key

* Simplify "key" generation

* Make 2FA enrollment page more robust

* Fix typo

* Rename twofa/2FA to TwoFactor

* UNIQUE INDEX -> UNIQUE

cmd/web.go

@@ -203,6 +203,12 @@ func runWeb(ctx *cli.Context) error {
 		m.Post("/sign_up", bindIgnErr(auth.RegisterForm{}), user.SignUpPost)
 		m.Get("/reset_password", user.ResetPasswd)
 		m.Post("/reset_password", user.ResetPasswdPost)
+		m.Group("/two_factor", func() {
+			m.Get("", user.TwoFactor)
+			m.Post("", bindIgnErr(auth.TwoFactorAuthForm{}), user.TwoFactorPost)
+			m.Get("/scratch", user.TwoFactorScratch)
+			m.Post("/scratch", bindIgnErr(auth.TwoFactorScratchAuthForm{}), user.TwoFactorScratchPost)
+		})
 	}, reqSignOut)
 
 	m.Group("/user/settings", func() {
@@ -223,6 +229,13 @@ func runWeb(ctx *cli.Context) error {
 			Post(bindIgnErr(auth.NewAccessTokenForm{}), user.SettingsApplicationsPost)
 		m.Post("/applications/delete", user.SettingsDeleteApplication)
 		m.Route("/delete", "GET,POST", user.SettingsDelete)
+		m.Group("/two_factor", func() {
+			m.Get("", user.SettingsTwoFactor)
+			m.Post("/regenerate_scratch", user.SettingsTwoFactorRegenerateScratch)
+			m.Post("/disable", user.SettingsTwoFactorDisable)
+			m.Get("/enroll", user.SettingsTwoFactorEnroll)
+			m.Post("/enroll", bindIgnErr(auth.TwoFactorAuthForm{}), user.SettingsTwoFactorEnrollPost)
+		})
 	}, reqSignIn, func(ctx *context.Context) {
 		ctx.Data["PageIsUserSettings"] = true
 	})

models/error.go

@@ -787,6 +787,25 @@ func (err ErrTeamAlreadyExist) Error() string {
 	return fmt.Sprintf("team already exists [org_id: %d, name: %s]", err.OrgID, err.Name)
 }
 
+//
+// Two-factor authentication
+//
+
+// ErrTwoFactorNotEnrolled indicates that a user is not enrolled in two-factor authentication.
+type ErrTwoFactorNotEnrolled struct {
+	UID int64
+}
+
+// IsErrTwoFactorNotEnrolled checks if an error is a ErrTwoFactorNotEnrolled.
+func IsErrTwoFactorNotEnrolled(err error) bool {
+	_, ok := err.(ErrTwoFactorNotEnrolled)
+	return ok
+}
+
+func (err ErrTwoFactorNotEnrolled) Error() string {
+	return fmt.Sprintf("user not enrolled in 2FA [uid: %d]", err.UID)
+}
+
 //  ____ ___        .__                    .___
 // |    |   \______ |  |   _________     __| _/
 // |    |   /\____ \|  |  /  _ \__  \   / __ |

models/models.go

@@ -105,6 +105,7 @@ func init() {
 		new(Notification),
 		new(IssueUser),
 		new(LFSMetaObject),
+		new(TwoFactor),
 	)
 
 	gonicNames := []string{"SSL", "UID"}

models/twofactor.go

@@ -0,0 +1,141 @@
+// Copyright 2017 The Gitea Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package models
+
+import (
+	"crypto/md5"
+	"crypto/subtle"
+	"encoding/base64"
+	"time"
+
+	"github.com/Unknwon/com"
+	"github.com/go-xorm/xorm"
+	"github.com/pquerna/otp/totp"
+
+	"code.gitea.io/gitea/modules/base"
+	"code.gitea.io/gitea/modules/setting"
+)
+
+// TwoFactor represents a two-factor authentication token.
+type TwoFactor struct {
+	ID           int64 `xorm:"pk autoincr"`
+	UID          int64 `xorm:"UNIQUE"`
+	Secret       string
+	ScratchToken string
+
+	Created     time.Time `xorm:"-"`
+	CreatedUnix int64     `xorm:"INDEX"`
+	Updated     time.Time `xorm:"-"` // Note: Updated must below Created for AfterSet.
+	UpdatedUnix int64     `xorm:"INDEX"`
+}
+
+// BeforeInsert will be invoked by XORM before inserting a record representing this object.
+func (t *TwoFactor) BeforeInsert() {
+	t.CreatedUnix = time.Now().Unix()
+}
+
+// BeforeUpdate is invoked from XORM before updating this object.
+func (t *TwoFactor) BeforeUpdate() {
+	t.UpdatedUnix = time.Now().Unix()
+}
+
+// AfterSet is invoked from XORM after setting the value of a field of this object.
+func (t *TwoFactor) AfterSet(colName string, _ xorm.Cell) {
+	switch colName {
+	case "created_unix":
+		t.Created = time.Unix(t.CreatedUnix, 0).Local()
+	case "updated_unix":
+		t.Updated = time.Unix(t.UpdatedUnix, 0).Local()
+	}
+}
+
+// GenerateScratchToken recreates the scratch token the user is using.
+func (t *TwoFactor) GenerateScratchToken() error {
+	token, err := base.GetRandomString(8)
+	if err != nil {
+		return err
+	}
+	t.ScratchToken = token
+	return nil
+}
+
+// VerifyScratchToken verifies if the specified scratch token is valid.
+func (t *TwoFactor) VerifyScratchToken(token string) bool {
+	if len(token) == 0 {
+		return false
+	}
+	return subtle.ConstantTimeCompare([]byte(token), []byte(t.ScratchToken)) == 1
+}
+
+func (t *TwoFactor) getEncryptionKey() []byte {
+	k := md5.Sum([]byte(setting.SecretKey))
+	return k[:]
+}
+
+// SetSecret sets the 2FA secret.
+func (t *TwoFactor) SetSecret(secret string) error {
+	secretBytes, err := com.AESEncrypt(t.getEncryptionKey(), []byte(secret))
+	if err != nil {
+		return err
+	}
+	t.Secret = base64.StdEncoding.EncodeToString(secretBytes)
+	return nil
+}
+
+// ValidateTOTP validates the provided passcode.
+func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
+	decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
+	if err != nil {
+		return false, err
+	}
+	secret, err := com.AESDecrypt(t.getEncryptionKey(), decodedStoredSecret)
+	if err != nil {
+		return false, err
+	}
+	secretStr := string(secret)
+	return totp.Validate(passcode, secretStr), nil
+}
+
+// NewTwoFactor creates a new two-factor authentication token.
+func NewTwoFactor(t *TwoFactor) error {
+	err := t.GenerateScratchToken()
+	if err != nil {
+		return err
+	}
+	_, err = x.Insert(t)
+	return err
+}
+
+// UpdateTwoFactor updates a two-factor authentication token.
+func UpdateTwoFactor(t *TwoFactor) error {
+	_, err := x.Id(t.ID).AllCols().Update(t)
+	return err
+}
+
+// GetTwoFactorByUID returns the two-factor authentication token associated with
+// the user, if any.
+func GetTwoFactorByUID(uid int64) (*TwoFactor, error) {
+	twofa := &TwoFactor{UID: uid}
+	has, err := x.Get(twofa)
+	if err != nil {
+		return nil, err
+	} else if !has {
+		return nil, ErrTwoFactorNotEnrolled{uid}
+	}
+	return twofa, nil
+}
+
+// DeleteTwoFactorByID deletes two-factor authentication token by given ID.
+func DeleteTwoFactorByID(id, userID int64) error {
+	cnt, err := x.Id(id).Delete(&TwoFactor{
+		UID: userID,
+	})
+	if err != nil {
+		return err
+	} else if cnt != 1 {
+		return ErrTwoFactorNotEnrolled{userID}
+	}
+	return nil
+}

modules/auth/user_form.go

@@ -173,3 +173,23 @@ type NewAccessTokenForm struct {
 func (f *NewAccessTokenForm) Validate(ctx *macaron.Context, errs binding.Errors) binding.Errors {
 	return validate(errs, ctx.Data, f, ctx.Locale)
 }
+
+// TwoFactorAuthForm for logging in with 2FA token.
+type TwoFactorAuthForm struct {
+	Passcode string `binding:"Required"`
+}
+
+// Validate valideates the fields
+func (f *TwoFactorAuthForm) Validate(ctx *macaron.Context, errs binding.Errors) binding.Errors {
+	return validate(errs, ctx.Data, f, ctx.Locale)
+}
+
+// TwoFactorScratchAuthForm for logging in with 2FA scratch token.
+type TwoFactorScratchAuthForm struct {
+	Token string `binding:"Required"`
+}
+
+// Validate valideates the fields
+func (f *TwoFactorScratchAuthForm) Validate(ctx *macaron.Context, errs binding.Errors) binding.Errors {
+	return validate(errs, ctx.Data, f, ctx.Locale)
+}

options/locale/locale_en-US.ini

@@ -23,6 +23,9 @@ email = Email
 password = Password
 re_type = Re-Type
 captcha = Captcha
+twofa = Two-factor authentication
+twofa_scratch = Two-factor scratch code
+passcode = Passcode
 
 repository = Repository
 organization = Organization
@@ -175,6 +178,12 @@ invalid_code = Sorry, your confirmation code has expired or not valid.
 reset_password_helper = Click here to reset your password
 password_too_short = Password length cannot be less then %d.
 non_local_account = Non-local accounts cannot change passwords through Gitea.
+verify = Verify
+scratch_code = Scratch code
+use_scratch_code = Use a scratch code
+twofa_scratch_used = You have used your scratch code. You have been redirected to the two-factor settings page so you may remove your device enrollment or generate a new scratch code.
+twofa_passcode_incorrect = Your passcode is not correct. If you misplaced your device, use your scratch code.
+twofa_scratch_token_incorrect = Your scratch code is not correct.
 
 [mail]
 activate_account = Please activate your account
@@ -266,6 +275,7 @@ social = Social Accounts
 applications = Applications
 orgs = Organizations
 delete = Delete Account
+twofa = Two-Factor Authentication
 uid = Uid
 
 public_profile = Public Profile
@@ -351,6 +361,23 @@ access_token_deletion = Personal Access Token Deletion
 access_token_deletion_desc = Delete this personal access token will remove all related accesses of application. Do you want to continue?
 delete_token_success = Personal access token has been removed successfully! Don't forget to update your application as well.
 
+twofa_desc = Gitea supports two-factor authentication to provide additional security for your account.
+twofa_is_enrolled = Your account is <strong>enrolled</strong> into two-factor authentication.
+twofa_not_enrolled = Your account is not currently enrolled into two-factor authentication.
+twofa_disable = Disable two-factor authentication
+twofa_scratch_token_regenerate = Regenerate scratch token
+twofa_scratch_token_regenerated = Your scratch token has been regenerated. It is now %s. Keep it in a safe place.
+twofa_enroll = Enroll into two-factor authentication
+twofa_disable_note = If needed, you can disable two-factor authentication.
+twofa_disable_desc = Disabling two-factor authentication will make your account less secure. Are you sure you want to proceed?
+regenerate_scratch_token_desc = If you misplaced your scratch token, or had to use it to log in, you can reset it.
+twofa_disabled = Two-factor authentication has been disabled.
+scan_this_image = Scan this image with your authentication application:
+or_enter_secret = Or enter the secret: %s
+then_enter_passcode = Then enter the passcode the application gives you:
+passcode_invalid = That passcode is invalid. Try again.
+twofa_enrolled = Your account has now been enrolled in two-factor authentication. Make sure to save your scratch token (%s), as it will only be shown once!
+
 delete_account = Delete Your Account
 delete_prompt = The operation will delete your account permanently, and <strong>CANNOT</strong> be undone!
 confirm_delete_account = Confirm Deletion