sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

properly parse filter, update deps

Browse Source 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
Jörn Friedrich Dreyer
2020-06-18 16:02:31 +02:00
parent 0d71588498
commit 9c1fb51906
4 changed files with 245 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/server/glauth/handler.go
+125 -51
View File
@@ -2,7 +2,6 @@ package glauth
import (
"context"
"crypto/sha256"
"errors"
"fmt"
"net"
@@ -12,6 +11,7 @@ import (
"github.com/glauth/glauth/pkg/config"
"github.com/glauth/glauth/pkg/handler"
"github.com/glauth/glauth/pkg/stats"
ber "github.com/nmcclain/asn1-ber"
"github.com/nmcclain/ldap"
accounts "github.com/owncloud/ocis-accounts/pkg/proto/v0"
"github.com/owncloud/ocis-pkg/v2/log"
@@ -78,53 +78,32 @@ func (h ocisHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn ne
if !strings.HasSuffix(searchBaseDN, h.cfg.Backend.BaseDN) {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultInsufficientAccessRights}, fmt.Errorf("search error: search BaseDN %s is not in our BaseDN %s", searchBaseDN, h.cfg.Backend.BaseDN)
}
// return all users in the config file - the LDAP library will filter results for us
entries := []*ldap.Entry{}
filterEntity, err := ldap.GetFilterObjectClass(searchReq.Filter)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("search error: error parsing filter: %s", searchReq.Filter)
qtype := ""
query := ""
var err error
if searchReq.Filter == "(&)" { // see Absolute True and False Filters in https://tools.ietf.org/html/rfc4526#section-2
query = ""
} else {
var cf *ber.Packet
cf, err = ldap.CompileFilter(searchReq.Filter)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", searchReq.Filter)
}
qtype, query, err = parseFilter(cf)
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("Search Error: error parsing filter: %s", searchReq.Filter)
}
}
switch filterEntity {
default:
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, fmt.Errorf("search error: unhandled filter type: %s [%s]", filterEntity, searchReq.Filter)
case "posixgroup":
/*
groups, err := session.getGroups()
if err != nil {
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("search error: error getting groups")
}
for _, g := range groups {
attrs := []*ldap.EntryAttribute{}
attrs = append(attrs, &ldap.EntryAttribute{Name: "cn", Values: []string{*g.ID}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "description", Values: []string{fmt.Sprintf("%s from ownCloud", *g.ID)}})
// attrs = append(attrs, &ldap.EntryAttribute{"gidNumber", []string{fmt.Sprintf("%d", g.UnixID)}})
attrs = append(attrs, &ldap.EntryAttribute{Name: "objectClass", Values: []string{"posixGroup"}})
if g.Members != nil {
members := make([]string, len(g.Members))
for i, v := range g.Members {
members[i] = *v.ID
}
attrs = append(attrs, &ldap.EntryAttribute{Name: "memberUid", Values: members})
}
dn := fmt.Sprintf("cn=%s,%s=groups,%s", *g.ID, h.cfg.Backend.GroupFormat, h.cfg.Backend.BaseDN)
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
}
*/
case "posixaccount", "":
userName := ""
if searchBaseDN != strings.ToLower(h.cfg.Backend.BaseDN) {
parts := strings.Split(strings.TrimSuffix(searchBaseDN, baseDN), ",")
if len(parts) >= 1 {
userName = strings.TrimPrefix(parts[0], "cn=")
}
}
entries := []*ldap.Entry{}
h.log.Debug().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Str("filter", searchReq.Filter).Str("qtype", qtype).Str("query", query).Msg("parsed query")
if qtype == "users" {
accounts, err := h.as.ListAccounts(context.TODO(), &accounts.ListAccountsRequest{
Query: fmt.Sprintf("preferred_name eq '%s'", strings.ReplaceAll(userName, "'", "''")),
Query: query,
})
if err != nil {
h.log.Error().Err(err).Str("username", userName).Interface("src", conn.RemoteAddr()).Msg("Could not list accounts")
h.log.Error().Err(err).Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Str("filter", searchReq.Filter).Str("query", query).Interface("src", conn.RemoteAddr()).Msg("Could not list accounts")
return ldap.ServerSearchResult{ResultCode: ldap.LDAPResultOperationsError}, errors.New("search error: error getting users")
}
for i := range accounts.Accounts {
@@ -154,24 +133,119 @@ func (h ocisHandler) Search(bindDN string, searchReq ldap.SearchRequest, conn ne
entries = append(entries, &ldap.Entry{DN: dn, Attributes: attrs})
}
}
stats.Frontend.Add("search_successes", 1)
h.log.Debug().Str("binddn", bindDN).Str("basedn", h.cfg.Backend.BaseDN).Str("filter", searchReq.Filter).Interface("src", conn.RemoteAddr()).Msg("AP: Search OK")
return ldap.ServerSearchResult{Entries: entries, Referrals: []string{}, Controls: []ldap.Control{}, ResultCode: ldap.LDAPResultSuccess}, nil
}
// LDAP filters might ask for grouips and users at the same time, eg.
// (|
// (&(objectClass=posixaccount)(cn=einstein))
// (&(objectClass=posixgroup)(cn=users))
// )
// (&(objectClass=posixaccount)(objectClass=posixgroup))
// qtype is one of
// "" not determined
// "users"
// "groups"
func parseFilter(f *ber.Packet) (qtype string, q string, err error) {
switch ldap.FilterMap[f.Tag] {
case "Equality Match":
if len(f.Children) != 2 {
return "", "", errors.New("equality match must have only two children")
}
attribute := strings.ToLower(f.Children[0].Value.(string))
value := f.Children[1].Value.(string)
// replace attributes
switch attribute {
case "objectclass":
switch value {
case "posixaccount", "shadowaccount", "users", "person", "inetorgperson", "organizationalperson":
qtype = "users"
case "posixgroup", "groups":
qtype = "groups"
default:
qtype = ""
}
return qtype, "", nil
case "cn", "uid":
return "", fmt.Sprintf("preferred_name eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
case "mail":
return "", fmt.Sprintf("mail eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
case "displayname":
return "", fmt.Sprintf("display_name eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
case "uidnumber":
return "", fmt.Sprintf("uid_number eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
case "gidnumber":
return "", fmt.Sprintf("gid_number eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
case "description":
return "", fmt.Sprintf("description eq '%s'", strings.ReplaceAll(value, "'", "''")), nil
}
return "", "", fmt.Errorf("filter by %s not implmented", attribute)
case "And":
subQueries := []string{}
for _, child := range f.Children {
var subQuery string
var qt string
qt, subQuery, err = parseFilter(child)
if err != nil {
return "", "", err
}
if qtype == "" {
qtype = qt
} else if qt != "" && qt != qtype {
return "", "", fmt.Errorf("mixing user and group filters not supported")
}
if subQuery != "" {
subQueries = append(subQueries, subQuery)
}
}
return qtype, strings.Join(subQueries, " and "), nil
case "Or":
subQueries := []string{}
for _, child := range f.Children {
var subQuery string
var qt string
qt, subQuery, err = parseFilter(child)
if err != nil {
return "", "", err
}
if qtype == "" {
qtype = qt
} else if qt != "" && qt != qtype {
return "", "", fmt.Errorf("mixing user and group filters not supported")
}
if subQuery != "" {
subQueries = append(subQueries, subQuery)
}
}
return qtype, strings.Join(subQueries, " or "), nil
case "Not":
if len(f.Children) != 1 {
return "", "", errors.New("not filter must have only one child")
}
qtype, subQuery, err := parseFilter(f.Children[0])
if err != nil {
return "", "", err
}
if subQuery != "" {
q = fmt.Sprintf("not %s", subQuery)
}
return qtype, q, nil
}
return
}
func (h ocisHandler) Close(boundDN string, conn net.Conn) error {
stats.Frontend.Add("closes", 1)
return nil
}
// helper functions
func connID(conn net.Conn) string {
h := sha256.New()
h.Write([]byte(conn.LocalAddr().String() + conn.RemoteAddr().String()))
sha := fmt.Sprintf("% x", h.Sum(nil))
return string(sha)
}
// NewOCISHandler implements a glauth backend with ocis-accounts as tdhe datasource
func NewOCISHandler(opts ...Option) handler.Handler {
options := newOptions(opts...)
pkg/server/glauth/server.go
+2 -4
View File
@@ -5,7 +5,6 @@ import (
"github.com/GeertJohan/yubigo"
"github.com/glauth/glauth/pkg/config"
"github.com/glauth/glauth/pkg/handler"
"github.com/go-logr/logr"
"github.com/nmcclain/ldap"
"github.com/owncloud/ocis-glauth/pkg/mlogr"
@@ -34,15 +33,14 @@ func Server(opts ...Option) (*LdapSvc, error) {
s.yubiAuth, err = yubigo.NewYubiAuth(s.c.YubikeyClientID, s.c.YubikeySecret)
if err != nil {
return nil, errors.New("Yubikey Auth failed")
return nil, errors.New("yubikey auth failed")
}
}
// configure the backend
s.l = ldap.NewServer()
s.l.EnforceLDAP = true
var h handler.Handler
h = NewOCISHandler(
h := NewOCISHandler(
AccountsService(options.AccountsService),
Logger(options.Logger),
Config(s.c),