2018-02-10 13:37:23 +00:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2018-02-21 23:17:07 +00:00
|
|
|
"bytes"
|
2018-02-18 16:37:16 +00:00
|
|
|
"crypto/hmac"
|
|
|
|
"crypto/sha512"
|
2018-02-18 13:41:06 +00:00
|
|
|
"crypto/tls"
|
2018-02-21 23:17:07 +00:00
|
|
|
"encoding/base64"
|
2018-02-10 13:37:23 +00:00
|
|
|
"encoding/json"
|
2018-02-18 13:41:06 +00:00
|
|
|
"errors"
|
|
|
|
"fmt"
|
2019-02-26 22:48:01 +00:00
|
|
|
"io/ioutil"
|
2018-02-10 13:37:23 +00:00
|
|
|
"log"
|
2018-02-18 13:41:06 +00:00
|
|
|
"net"
|
2018-02-10 13:37:23 +00:00
|
|
|
"net/http"
|
2018-02-18 13:41:06 +00:00
|
|
|
"strings"
|
2018-02-21 23:17:07 +00:00
|
|
|
"time"
|
2018-02-18 13:41:06 +00:00
|
|
|
|
|
|
|
"gopkg.in/ldap.v2"
|
2018-02-10 13:37:23 +00:00
|
|
|
)
|
|
|
|
|
2018-02-18 16:37:16 +00:00
|
|
|
var loginSalt string
|
|
|
|
|
2018-02-18 13:41:06 +00:00
|
|
|
type loginChecker struct {
|
|
|
|
students []Student
|
2018-02-21 23:16:26 +00:00
|
|
|
noAuth bool
|
2018-02-18 13:41:06 +00:00
|
|
|
ldapAddr string
|
|
|
|
ldapPort int
|
|
|
|
ldapIsTLS bool
|
|
|
|
ldapBase string
|
|
|
|
ldapBindUsername string
|
|
|
|
ldapBindPassword string
|
2018-02-10 13:37:23 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type loginUpload struct {
|
|
|
|
Username string
|
|
|
|
Password string
|
|
|
|
}
|
|
|
|
|
2018-02-18 13:41:06 +00:00
|
|
|
func (l loginChecker) ldapAuth(username, password string) (res bool, err error) {
|
|
|
|
tlsCnf := tls.Config{InsecureSkipVerify: true}
|
|
|
|
|
|
|
|
var c *ldap.Conn
|
|
|
|
|
|
|
|
if l.ldapIsTLS {
|
|
|
|
c, err = ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", l.ldapAddr, l.ldapPort), &tlsCnf)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
c, err = ldap.Dial("tcp", fmt.Sprintf("%s:%d", l.ldapAddr, l.ldapPort))
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// Reconnect with TLS
|
|
|
|
err = c.StartTLS(&tlsCnf)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
defer c.Close()
|
|
|
|
|
|
|
|
if l.ldapBindUsername != "" {
|
|
|
|
err = c.Bind(l.ldapBindUsername, l.ldapBindPassword)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Search for the given username
|
|
|
|
searchRequest := ldap.NewSearchRequest(
|
|
|
|
l.ldapBase,
|
|
|
|
ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
|
|
|
|
fmt.Sprintf("(&(objectClass=person)(uid=%s))", username),
|
|
|
|
[]string{"dn"},
|
|
|
|
nil,
|
|
|
|
)
|
|
|
|
|
|
|
|
sr, err := c.Search(searchRequest)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(sr.Entries) != 1 {
|
|
|
|
return false, errors.New("User does not exist or too many entries returned")
|
|
|
|
}
|
|
|
|
|
|
|
|
userdn := sr.Entries[0].DN
|
|
|
|
|
|
|
|
err = c.Bind(userdn, password)
|
|
|
|
if err != nil {
|
|
|
|
return false, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2018-02-10 13:37:23 +00:00
|
|
|
func (l loginChecker) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
|
|
if addr := r.Header.Get("X-Forwarded-For"); addr != "" {
|
|
|
|
r.RemoteAddr = addr
|
|
|
|
}
|
|
|
|
log.Printf("%s \"%s %s\" [%s]\n", r.RemoteAddr, r.Method, r.URL.Path, r.UserAgent())
|
|
|
|
|
|
|
|
w.Header().Set("Content-Type", "text/plain")
|
|
|
|
|
|
|
|
// Check request type and size
|
|
|
|
if r.Method != "POST" {
|
|
|
|
http.Error(w,
|
|
|
|
"Invalid request",
|
|
|
|
http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
} else if r.ContentLength < 0 || r.ContentLength > 1023 {
|
|
|
|
http.Error(w,
|
|
|
|
"Request entity too large",
|
|
|
|
http.StatusRequestEntityTooLarge)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
dec := json.NewDecoder(r.Body)
|
|
|
|
var lu loginUpload
|
|
|
|
if err := dec.Decode(&lu); err != nil {
|
|
|
|
http.Error(w,
|
|
|
|
err.Error(),
|
|
|
|
http.StatusBadRequest)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Perform login check
|
|
|
|
canContinue := false
|
|
|
|
for _, std := range l.students {
|
|
|
|
if std.Login == lu.Username {
|
|
|
|
canContinue = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if !canContinue {
|
2018-02-12 10:39:44 +00:00
|
|
|
log.Println("Login not found:", lu.Username, "at", r.RemoteAddr)
|
2018-02-10 13:37:23 +00:00
|
|
|
http.Error(w, "Login not found in whitelist.", http.StatusUnauthorized)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2018-02-21 23:16:26 +00:00
|
|
|
if ! l.noAuth {
|
|
|
|
if ok, err := l.ldapAuth(lu.Username, lu.Password); err != nil {
|
|
|
|
log.Println("Unable to perform authentication for", lu.Username, ":", err, "at", r.RemoteAddr)
|
|
|
|
http.Error(w, err.Error(), http.StatusUnauthorized)
|
|
|
|
return
|
|
|
|
} else if !ok {
|
|
|
|
log.Println("Login failed:", lu.Username, "at", r.RemoteAddr)
|
|
|
|
http.Error(w, "Invalid password", http.StatusUnauthorized)
|
|
|
|
return
|
|
|
|
}
|
2018-02-18 13:41:06 +00:00
|
|
|
}
|
|
|
|
|
2018-03-05 16:36:25 +00:00
|
|
|
// Find corresponding MAC
|
2019-02-26 11:34:31 +00:00
|
|
|
var ip net.IP
|
2019-02-22 00:55:02 +00:00
|
|
|
spl := strings.SplitN(r.RemoteAddr, ":", 2)
|
2019-02-26 11:34:31 +00:00
|
|
|
if ip = net.ParseIP(spl[0]); ip == nil {
|
2019-02-22 00:55:02 +00:00
|
|
|
http.Error(w, "Unable to parse given IPv4: " + spl[0], http.StatusInternalServerError)
|
|
|
|
return
|
2019-02-26 11:34:31 +00:00
|
|
|
}
|
|
|
|
var mac *ARPEntry
|
|
|
|
if tab, err := ARPAnalyze(); err != nil {
|
|
|
|
log.Println("Error on ARPAnalyze:", err)
|
|
|
|
http.Error(w, "Internal server error. Please retry in a few minutes", http.StatusInternalServerError)
|
2019-02-22 00:55:02 +00:00
|
|
|
return
|
2018-03-05 16:36:25 +00:00
|
|
|
} else {
|
2019-02-26 11:34:31 +00:00
|
|
|
mac = ARPContainsIP(tab, ip)
|
|
|
|
}
|
|
|
|
|
|
|
|
if mac == nil {
|
|
|
|
log.Printf("Unable to find MAC address for given IP (%s)\n", ip)
|
|
|
|
http.Error(w, "Internal server error. Please retry in a few minutes", http.StatusInternalServerError)
|
2018-03-05 16:36:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Register the user remotely
|
2019-02-26 22:48:01 +00:00
|
|
|
if ip, err := l.registerUser(lu.Username, r.RemoteAddr, *mac); err != nil {
|
2018-02-21 23:17:07 +00:00
|
|
|
log.Println("Error on remote registration:", err)
|
|
|
|
http.Error(w, "Internal server error. Please retry in a few minutes", http.StatusInternalServerError)
|
|
|
|
return
|
2019-02-26 22:48:01 +00:00
|
|
|
} else if err := l.lateLoginAction(lu.Username, r.RemoteAddr, *mac); err != nil {
|
2018-02-12 10:39:44 +00:00
|
|
|
log.Println("Error on late login action:", err)
|
|
|
|
http.Error(w, "Internal server error. Please retry in a few minutes", http.StatusInternalServerError)
|
|
|
|
return
|
2019-02-26 22:48:01 +00:00
|
|
|
} else {
|
|
|
|
log.Println("Successful login of", lu.Username, "at", r.RemoteAddr)
|
|
|
|
http.Error(w, fmt.Sprintf("Use the following IP: %s", ip), http.StatusOK)
|
2018-02-12 10:39:44 +00:00
|
|
|
}
|
2018-02-10 13:37:23 +00:00
|
|
|
}
|
2018-02-12 10:39:44 +00:00
|
|
|
|
2019-02-26 22:48:01 +00:00
|
|
|
func (l loginChecker) registerUser(username, remoteAddr string, ent ARPEntry) ([]byte, error) {
|
2019-02-26 11:34:31 +00:00
|
|
|
bts, err := json.Marshal(map[string]interface{}{"login": username, "ip": remoteAddr, "mac": fmt.Sprintf("%02x:%02x:%02x:%02x:%02x:%02x", ent.HWAddress[0], ent.HWAddress[1], ent.HWAddress[2], ent.HWAddress[3], ent.HWAddress[4], ent.HWAddress[5])})
|
2018-02-21 23:17:07 +00:00
|
|
|
if err != nil {
|
2019-02-26 22:48:01 +00:00
|
|
|
return nil, nil
|
2018-02-21 23:17:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
req, err := http.NewRequest("POST", "https://adlin.nemunai.re/api/students/", bytes.NewReader(bts))
|
|
|
|
if err != nil {
|
2019-02-26 22:48:01 +00:00
|
|
|
return nil, err
|
2018-02-21 23:17:07 +00:00
|
|
|
}
|
|
|
|
req.Header.Add("X-ADLIN-Authentication", base64.StdEncoding.EncodeToString(hmac.New(sha512.New, []byte(loginSalt)).Sum([]byte(fmt.Sprintf("%d", time.Now().Unix()/10)))))
|
|
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
|
|
|
|
client := &http.Client{}
|
|
|
|
resp, err := client.Do(req)
|
|
|
|
if err != nil {
|
2019-02-26 22:48:01 +00:00
|
|
|
return nil, err
|
2018-02-21 23:17:07 +00:00
|
|
|
}
|
2019-02-26 22:48:01 +00:00
|
|
|
defer resp.Body.Close()
|
2018-02-21 23:17:07 +00:00
|
|
|
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
2019-02-26 22:48:01 +00:00
|
|
|
return nil, errors.New(resp.Status)
|
2018-02-21 23:17:07 +00:00
|
|
|
} else {
|
2019-02-26 22:48:01 +00:00
|
|
|
return ioutil.ReadAll(resp.Body)
|
2018-02-21 23:17:07 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-02-26 11:34:31 +00:00
|
|
|
func (l loginChecker) lateLoginAction(username, remoteAddr string, mac ARPEntry) error {
|
|
|
|
return RegisterUserMAC(mac, username)
|
2018-02-12 10:39:44 +00:00
|
|
|
}
|