Begin Go reimplementation of Bottin

.gitignore

@@ -0,0 +1 @@
+gobottin

main.go

@@ -0,0 +1,212 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+	"strings"
+	"encoding/json"
+	"encoding/base64"
+	"math/rand"
+
+	consul "github.com/hashicorp/consul/api"
+	ldap "github.com/vjeantet/ldapserver"
+	message "github.com/vjeantet/goldap/message"
+)
+
+func dnToConsul(dn string) string {
+	rdns := strings.Split(dn, ",")
+
+	// Reverse rdns
+	for i, j := 0, len(rdns)-1; i < j; i, j = i+1, j-1 {
+		rdns[i], rdns[j] = rdns[j], rdns[i]
+	}
+
+	return strings.Join(rdns, "/")
+}
+
+type DNComponent struct {
+	Type string
+	Value string
+}
+
+func parseDN(dn string) ([]DNComponent, error) {
+	rdns := strings.Split(dn, ",")
+
+	ret := []DNComponent{}
+
+	for _, rdn := range rdns {
+		splits := strings.Split(rdn, "=")
+		if len(splits) != 2 {
+			return nil, fmt.Errorf("Wrong DN component: %s (expected type=value)", rdn)
+		}
+		ret = append(ret, DNComponent{
+			Type: splits[0],
+			Value: splits[1],
+		})
+	}
+	return ret, nil
+}
+
+type Config struct {
+	Suffix string
+}
+
+type Server struct {
+	config Config
+	kv *consul.KV
+}
+
+type Attributes map[string]interface{}
+
+func main() {
+	//ldap logger
+	ldap.Logger = log.New(os.Stdout, "[server] ", log.LstdFlags)
+
+	// Connect to Consul
+	client, err := consul.NewClient(consul.DefaultConfig())
+	if err != nil {
+		panic(err)
+	}
+	kv := client.KV()
+
+	// TODO read config from somewhere
+	config := Config {
+		Suffix: "dc=gobottin,dc=eu",
+	}
+
+	gobottin := Server{config: config, kv: kv}
+	err = gobottin.init()
+	if err != nil {
+		panic(err)
+	}
+
+	//Create a new LDAP Server
+	ldapserver := ldap.NewServer()
+
+	routes := ldap.NewRouteMux()
+	routes.Bind(gobottin.handleBind)
+	ldapserver.Handle(routes)
+
+	// listen on 10389
+	go ldapserver.ListenAndServe("127.0.0.1:10389")
+
+	// When CTRL+C, SIGINT and SIGTERM signal occurs
+	// Then stop server gracefully
+	ch := make(chan os.Signal)
+	signal.Notify(ch, syscall.SIGINT, syscall.SIGTERM)
+	<-ch
+	close(ch)
+
+	ldapserver.Stop()
+}
+
+func (server *Server) init() error {
+	pair, _, err := server.kv.Get(dnToConsul(server.config.Suffix) + "/attribute=objectClass", nil)
+	if err != nil {
+		return err
+	}
+
+	if pair != nil {
+		return nil
+	}
+
+	base_attributes := Attributes{
+		"objectClass": []string{"top", "dcObject", "organization"},
+		"structuralObjectClass": "Organization",
+	}
+	suffix_dn, err := parseDN(server.config.Suffix)
+	if err != nil {
+		return err
+	}
+	base_attributes[suffix_dn[0].Type] = suffix_dn[0].Value
+
+	err = server.addElements(server.config.Suffix, base_attributes)
+	if err != nil {
+		return err
+	}
+
+	admin_pass := make([]byte, 8)
+	rand.Read(admin_pass)
+	admin_pass_str := base64.RawURLEncoding.EncodeToString(admin_pass)
+	admin_pass_hash := SSHAEncode([]byte(admin_pass_str))
+
+	admin_dn := "cn=admin," + server.config.Suffix
+	admin_attributes := Attributes{
+		"objectClass": []string{"simpleSecurityObject", "organizationalRole"},
+		"description": "LDAP administrator",
+		"cn": "admin",
+		"userpassword": admin_pass_hash,
+		"structuralObjectClass": "organizationalRole",
+		"permissions": []string{"read", "write"},
+	}
+
+	err = server.addElements(admin_dn, admin_attributes)
+	if err != nil {
+		return err
+	}
+
+	log.Printf(
+		"It seems to be a new installation, we created a default user for you:\n\n    dn:          %s\n    password:    %s\n\nWe didn't use true random, you should replace it as soon as possible.",
+		admin_dn,
+		admin_pass_str,
+	)
+
+	return nil
+}
+
+func (server *Server) addElements(dn string, attrs Attributes) error {
+	prefix := dnToConsul(dn)
+	for k, v := range attrs {
+		json, err := json.Marshal(v)
+		if err != nil {
+			return err
+		}
+		pair := &consul.KVPair{Key: prefix + "/attribute=" + k, Value: json}
+		_, err = server.kv.Put(pair, nil)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (server *Server) handleBind(w ldap.ResponseWriter, m *ldap.Message) {
+	r := m.GetBindRequest()
+
+	result_code, err := server.handleBindInternal(w, r)
+
+	res := ldap.NewBindResponse(result_code)
+	if err != nil {
+		res.SetDiagnosticMessage(err.Error())
+		log.Printf("Failed bind for %s: %s", string(r.Name()), err.Error())
+	}
+	w.Write(res)
+}
+
+func (server *Server) handleBindInternal(w ldap.ResponseWriter, r message.BindRequest) (int, error) {
+
+	pair, _, err := server.kv.Get(dnToConsul(string(r.Name())) + "/attribute=userpassword", nil)
+	if err != nil {
+		return ldap.LDAPResultOperationsError, err
+	}
+
+	if pair == nil {
+		return ldap.LDAPResultNoSuchObject, nil
+	}
+
+	hash := ""
+	err = json.Unmarshal(pair.Value, &hash)
+	if err != nil {
+		return ldap.LDAPResultOperationsError, err
+	}
+
+	valid := SSHAMatches(hash, []byte(r.AuthenticationSimple()))
+	if valid {
+		return ldap.LDAPResultSuccess, nil
+	} else {
+		return ldap.LDAPResultInvalidCredentials, nil
+	}
+}

ssha.go

@@ -0,0 +1,53 @@
+package main
+
+import (
+	"fmt"
+	"bytes"
+	"math/rand"
+	"encoding/base64"
+	"crypto/sha1"
+)
+
+// Encode encodes the []byte of raw password
+func SSHAEncode(rawPassPhrase []byte) string {
+	hash := makeSSHAHash(rawPassPhrase, makeSalt())
+	b64 := base64.StdEncoding.EncodeToString(hash)
+	return fmt.Sprintf("{ssha}%s", b64)
+}
+
+// Matches matches the encoded password and the raw password
+func SSHAMatches(encodedPassPhrase string, rawPassPhrase []byte) bool {
+	if encodedPassPhrase[:6] != "{ssha}" {
+		return false
+	}
+
+	bhash, err := base64.StdEncoding.DecodeString(encodedPassPhrase[6:])
+	if err != nil {
+		return false
+	}
+	salt := bhash[20:]
+
+	newssha := makeSSHAHash(rawPassPhrase, salt)
+
+	if bytes.Compare(newssha, bhash) != 0 {
+		return false
+	}
+	return true
+}
+
+// makeSalt make a 32 byte array containing random bytes.
+func makeSalt() []byte {
+	sbytes := make([]byte, 32)
+	rand.Read(sbytes)
+	return sbytes
+}
+
+// makeSSHAHash make hasing using SHA-1 with salt. This is not the final output though. You need to append {SSHA} string with base64 of this hash.
+func makeSSHAHash(passphrase, salt []byte) []byte {
+	sha := sha1.New()
+	sha.Write(passphrase)
+	sha.Write(salt)
+
+	h := sha.Sum(nil)
+	return append(h, salt...)
+}