forked from drakkan/sftpgo
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
telemetry server: add optional https and authentication
- Loading branch information
Showing
21 changed files
with
491 additions
and
168 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,134 @@ | ||
| package common | ||
|
|
||
| import ( | ||
| "encoding/csv" | ||
| "os" | ||
| "strings" | ||
| "sync" | ||
|
|
||
| "github.com/GehirnInc/crypt/apr1_crypt" | ||
| "github.com/GehirnInc/crypt/md5_crypt" | ||
| "golang.org/x/crypto/bcrypt" | ||
|
|
||
| "github.com/drakkan/sftpgo/logger" | ||
| "github.com/drakkan/sftpgo/utils" | ||
| ) | ||
|
|
||
| const ( | ||
| // HTTPAuthenticationHeader defines the HTTP authentication | ||
| HTTPAuthenticationHeader = "WWW-Authenticate" | ||
| md5CryptPwdPrefix = "$1$" | ||
| apr1CryptPwdPrefix = "$apr1$" | ||
| ) | ||
|
|
||
| var ( | ||
| bcryptPwdPrefixes = []string{"$2a$", "$2$", "$2x$", "$2y$", "$2b$"} | ||
| ) | ||
|
|
||
| // HTTPAuthProvider defines the interface for HTTP auth providers | ||
| type HTTPAuthProvider interface { | ||
| ValidateCredentials(username, password string) bool | ||
| IsEnabled() bool | ||
| } | ||
|
|
||
| type basicAuthProvider struct { | ||
| Path string | ||
| sync.RWMutex | ||
| Info os.FileInfo | ||
| Users map[string]string | ||
| } | ||
|
|
||
| // NewBasicAuthProvider returns an HTTPAuthProvider implementing Basic Auth | ||
| func NewBasicAuthProvider(authUserFile string) (HTTPAuthProvider, error) { | ||
| basicAuthProvider := basicAuthProvider{ | ||
| Path: authUserFile, | ||
| Info: nil, | ||
| Users: make(map[string]string), | ||
| } | ||
| return &basicAuthProvider, basicAuthProvider.loadUsers() | ||
| } | ||
|
|
||
| func (p *basicAuthProvider) IsEnabled() bool { | ||
| return p.Path != "" | ||
| } | ||
|
|
||
| func (p *basicAuthProvider) isReloadNeeded(info os.FileInfo) bool { | ||
| p.RLock() | ||
| defer p.RUnlock() | ||
|
|
||
| return p.Info == nil || p.Info.ModTime() != info.ModTime() || p.Info.Size() != info.Size() | ||
| } | ||
|
|
||
| func (p *basicAuthProvider) loadUsers() error { | ||
| if !p.IsEnabled() { | ||
| return nil | ||
| } | ||
| info, err := os.Stat(p.Path) | ||
| if err != nil { | ||
| logger.Debug(logSender, "", "unable to stat basic auth users file: %v", err) | ||
| return err | ||
| } | ||
| if p.isReloadNeeded(info) { | ||
| r, err := os.Open(p.Path) | ||
| if err != nil { | ||
| logger.Debug(logSender, "", "unable to open basic auth users file: %v", err) | ||
| return err | ||
| } | ||
| defer r.Close() | ||
| reader := csv.NewReader(r) | ||
| reader.Comma = ':' | ||
| reader.Comment = '#' | ||
| reader.TrimLeadingSpace = true | ||
| records, err := reader.ReadAll() | ||
| if err != nil { | ||
| logger.Debug(logSender, "", "unable to parse basic auth users file: %v", err) | ||
| return err | ||
| } | ||
| p.Lock() | ||
| defer p.Unlock() | ||
|
|
||
| p.Users = make(map[string]string) | ||
| for _, record := range records { | ||
| if len(record) == 2 { | ||
| p.Users[record[0]] = record[1] | ||
| } | ||
| } | ||
| logger.Debug(logSender, "", "number of users loaded for httpd basic auth: %v", len(p.Users)) | ||
| p.Info = info | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| func (p *basicAuthProvider) getHashedPassword(username string) (string, bool) { | ||
| err := p.loadUsers() | ||
| if err != nil { | ||
| return "", false | ||
| } | ||
| p.RLock() | ||
| defer p.RUnlock() | ||
|
|
||
| pwd, ok := p.Users[username] | ||
| return pwd, ok | ||
| } | ||
|
|
||
| // ValidateCredentials returns true if the credentials are valid | ||
| func (p *basicAuthProvider) ValidateCredentials(username, password string) bool { | ||
| if hashedPwd, ok := p.getHashedPassword(username); ok { | ||
| if utils.IsStringPrefixInSlice(hashedPwd, bcryptPwdPrefixes) { | ||
| err := bcrypt.CompareHashAndPassword([]byte(hashedPwd), []byte(password)) | ||
| return err == nil | ||
| } | ||
| if strings.HasPrefix(hashedPwd, md5CryptPwdPrefix) { | ||
| crypter := md5_crypt.New() | ||
| err := crypter.Verify(hashedPwd, []byte(password)) | ||
| return err == nil | ||
| } | ||
| if strings.HasPrefix(hashedPwd, apr1CryptPwdPrefix) { | ||
| crypter := apr1_crypt.New() | ||
| err := crypter.Verify(hashedPwd, []byte(password)) | ||
| return err == nil | ||
| } | ||
| } | ||
|
|
||
| return false | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| package common | ||
|
|
||
| import ( | ||
| "io/ioutil" | ||
| "os" | ||
| "path/filepath" | ||
| "runtime" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestBasicAuth(t *testing.T) { | ||
| httpAuth, err := NewBasicAuthProvider("") | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.IsEnabled()) | ||
|
|
||
| _, err = NewBasicAuthProvider("missing path") | ||
| require.Error(t, err) | ||
|
|
||
| authUserFile := filepath.Join(os.TempDir(), "http_users.txt") | ||
| authUserData := []byte("test1:$2y$05$bcHSED7aO1cfLto6ZdDBOOKzlwftslVhtpIkRhAtSa4GuLmk5mola\n") | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
|
|
||
| httpAuth, err = NewBasicAuthProvider(authUserFile) | ||
| require.NoError(t, err) | ||
| require.True(t, httpAuth.IsEnabled()) | ||
| require.False(t, httpAuth.ValidateCredentials("test1", "wrong1")) | ||
| require.False(t, httpAuth.ValidateCredentials("test2", "password2")) | ||
| require.True(t, httpAuth.ValidateCredentials("test1", "password1")) | ||
|
|
||
| authUserData = append(authUserData, []byte("test2:$1$OtSSTL8b$bmaCqEksI1e7rnZSjsIDR1\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test2", "wrong2")) | ||
| require.True(t, httpAuth.ValidateCredentials("test2", "password2")) | ||
|
|
||
| authUserData = append(authUserData, []byte("test2:$apr1$gLnIkRIf$Xr/6aJfmIrihP4b2N2tcs/\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test2", "wrong2")) | ||
| require.True(t, httpAuth.ValidateCredentials("test2", "password2")) | ||
|
|
||
| authUserData = append(authUserData, []byte("test3:$apr1$gLnIkRIf$Xr/6aJfmIrihP4b2N2tcs/\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test3", "password3")) | ||
|
|
||
| authUserData = append(authUserData, []byte("test4:$invalid$gLnIkRIf$Xr/6$aJfmIr$ihP4b2N2tcs/\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test4", "password3")) | ||
|
|
||
| if runtime.GOOS != "windows" { | ||
| authUserData = append(authUserData, []byte("test5:$apr1$gLnIkRIf$Xr/6aJfmIrihP4b2N2tcs/\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| err = os.Chmod(authUserFile, 0001) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test5", "password2")) | ||
| err = os.Chmod(authUserFile, os.ModePerm) | ||
| require.NoError(t, err) | ||
| } | ||
| authUserData = append(authUserData, []byte("\"foo\"bar\"\r\n")...) | ||
| err = ioutil.WriteFile(authUserFile, authUserData, os.ModePerm) | ||
| require.NoError(t, err) | ||
| require.False(t, httpAuth.ValidateCredentials("test2", "password2")) | ||
|
|
||
| err = os.Remove(authUserFile) | ||
| require.NoError(t, err) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.