2014-11-16 20:13:20 +00:00
|
|
|
// Copyright (C) 2014 The Syncthing Authors.
|
2014-09-29 19:43:32 +00:00
|
|
|
//
|
2015-03-07 20:36:35 +00:00
|
|
|
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this file,
|
2017-02-09 06:52:18 +00:00
|
|
|
// You can obtain one at https://mozilla.org/MPL/2.0/.
|
2014-09-01 20:51:44 +00:00
|
|
|
|
2019-03-26 19:53:58 +00:00
|
|
|
package api
|
2014-09-01 20:51:44 +00:00
|
|
|
|
|
|
|
import (
|
2018-09-11 21:25:24 +00:00
|
|
|
"crypto/tls"
|
|
|
|
"fmt"
|
2020-03-24 11:56:43 +00:00
|
|
|
"net"
|
2014-09-01 20:51:44 +00:00
|
|
|
"net/http"
|
|
|
|
"strings"
|
|
|
|
"time"
|
|
|
|
|
2020-03-31 07:56:04 +00:00
|
|
|
ldap "github.com/go-ldap/ldap/v3"
|
2015-08-06 09:29:25 +00:00
|
|
|
"github.com/syncthing/syncthing/lib/config"
|
2015-11-08 20:05:36 +00:00
|
|
|
"github.com/syncthing/syncthing/lib/events"
|
2016-05-26 07:02:56 +00:00
|
|
|
"github.com/syncthing/syncthing/lib/rand"
|
2015-08-06 09:29:25 +00:00
|
|
|
"github.com/syncthing/syncthing/lib/sync"
|
2014-09-01 20:51:44 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
2015-04-28 20:32:10 +00:00
|
|
|
sessions = make(map[string]bool)
|
|
|
|
sessionsMut = sync.NewMutex()
|
2014-09-01 20:51:44 +00:00
|
|
|
)
|
|
|
|
|
2021-04-13 08:14:44 +00:00
|
|
|
func emitLoginAttempt(success bool, username, address string, evLogger events.Logger) {
|
2019-08-15 14:29:37 +00:00
|
|
|
evLogger.Log(events.LoginAttempt, map[string]interface{}{
|
2021-04-13 08:14:44 +00:00
|
|
|
"success": success,
|
|
|
|
"username": username,
|
|
|
|
"remoteAddress": address,
|
2015-11-08 20:05:36 +00:00
|
|
|
})
|
2021-04-15 05:33:02 +00:00
|
|
|
if !success {
|
|
|
|
l.Infof("Wrong credentials supplied during API authorization from %s", address)
|
|
|
|
}
|
2015-11-08 20:05:36 +00:00
|
|
|
}
|
|
|
|
|
2019-08-15 14:29:37 +00:00
|
|
|
func basicAuthAndSessionMiddleware(cookieName string, guiCfg config.GUIConfiguration, ldapCfg config.LDAPConfiguration, next http.Handler, evLogger events.Logger) http.Handler {
|
2014-09-01 20:51:44 +00:00
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
2023-06-29 12:36:55 +00:00
|
|
|
if hasValidAPIKeyHeader(r, guiCfg) {
|
2014-09-01 20:51:44 +00:00
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2022-10-06 19:28:49 +00:00
|
|
|
// Exception for REST calls that don't require authentication.
|
|
|
|
if strings.HasPrefix(r.URL.Path, "/rest/noauth") {
|
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2015-06-22 15:57:08 +00:00
|
|
|
cookie, err := r.Cookie(cookieName)
|
2014-09-01 20:51:44 +00:00
|
|
|
if err == nil && cookie != nil {
|
|
|
|
sessionsMut.Lock()
|
|
|
|
_, ok := sessions[cookie.Value]
|
|
|
|
sessionsMut.Unlock()
|
|
|
|
if ok {
|
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-03-26 19:53:58 +00:00
|
|
|
l.Debugln("Sessionless HTTP request with authentication; this is expensive.")
|
2015-04-20 05:29:38 +00:00
|
|
|
|
2014-09-01 20:51:44 +00:00
|
|
|
error := func() {
|
|
|
|
time.Sleep(time.Duration(rand.Intn(100)+100) * time.Millisecond)
|
|
|
|
w.Header().Set("WWW-Authenticate", "Basic realm=\"Authorization Required\"")
|
|
|
|
http.Error(w, "Not Authorized", http.StatusUnauthorized)
|
|
|
|
}
|
|
|
|
|
2021-11-06 11:38:08 +00:00
|
|
|
username, password, ok := r.BasicAuth()
|
|
|
|
if !ok {
|
2014-09-01 20:51:44 +00:00
|
|
|
error()
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-02-02 09:11:42 +00:00
|
|
|
authOk := auth(username, password, guiCfg, ldapCfg)
|
2018-09-11 21:25:24 +00:00
|
|
|
if !authOk {
|
|
|
|
usernameIso := string(iso88591ToUTF8([]byte(username)))
|
|
|
|
passwordIso := string(iso88591ToUTF8([]byte(password)))
|
|
|
|
authOk = auth(usernameIso, passwordIso, guiCfg, ldapCfg)
|
|
|
|
if authOk {
|
|
|
|
username = usernameIso
|
|
|
|
}
|
2016-04-18 20:24:38 +00:00
|
|
|
}
|
|
|
|
|
2018-09-11 21:25:24 +00:00
|
|
|
if !authOk {
|
2021-04-13 08:14:44 +00:00
|
|
|
emitLoginAttempt(false, username, r.RemoteAddr, evLogger)
|
2018-09-11 21:25:24 +00:00
|
|
|
error()
|
|
|
|
return
|
2014-09-01 20:51:44 +00:00
|
|
|
}
|
|
|
|
|
2016-05-26 07:02:56 +00:00
|
|
|
sessionid := rand.String(32)
|
2014-09-01 20:51:44 +00:00
|
|
|
sessionsMut.Lock()
|
|
|
|
sessions[sessionid] = true
|
|
|
|
sessionsMut.Unlock()
|
2021-08-27 15:56:54 +00:00
|
|
|
|
|
|
|
// Best effort detection of whether the connection is HTTPS --
|
|
|
|
// either directly to us, or as used by the client towards a reverse
|
|
|
|
// proxy who sends us headers.
|
|
|
|
connectionIsHTTPS := r.TLS != nil ||
|
|
|
|
strings.ToLower(r.Header.Get("x-forwarded-proto")) == "https" ||
|
|
|
|
strings.Contains(strings.ToLower(r.Header.Get("forwarded")), "proto=https")
|
|
|
|
// If the connection is HTTPS, or *should* be HTTPS, set the Secure
|
|
|
|
// bit in cookies.
|
|
|
|
useSecureCookie := connectionIsHTTPS || guiCfg.UseTLS()
|
|
|
|
|
2014-09-01 20:51:44 +00:00
|
|
|
http.SetCookie(w, &http.Cookie{
|
2015-06-22 15:57:08 +00:00
|
|
|
Name: cookieName,
|
2014-09-01 20:51:44 +00:00
|
|
|
Value: sessionid,
|
|
|
|
MaxAge: 0,
|
2021-08-27 15:56:54 +00:00
|
|
|
Secure: useSecureCookie,
|
2014-09-01 20:51:44 +00:00
|
|
|
})
|
|
|
|
|
2021-04-13 08:14:44 +00:00
|
|
|
emitLoginAttempt(true, username, r.RemoteAddr, evLogger)
|
2014-09-01 20:51:44 +00:00
|
|
|
next.ServeHTTP(w, r)
|
|
|
|
})
|
|
|
|
}
|
2016-04-18 20:24:38 +00:00
|
|
|
|
2018-09-11 21:25:24 +00:00
|
|
|
func auth(username string, password string, guiCfg config.GUIConfiguration, ldapCfg config.LDAPConfiguration) bool {
|
|
|
|
if guiCfg.AuthMode == config.AuthModeLDAP {
|
|
|
|
return authLDAP(username, password, ldapCfg)
|
|
|
|
} else {
|
2021-11-08 12:32:04 +00:00
|
|
|
return authStatic(username, password, guiCfg)
|
2018-09-11 21:25:24 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-11-08 12:32:04 +00:00
|
|
|
func authStatic(username string, password string, guiCfg config.GUIConfiguration) bool {
|
|
|
|
return guiCfg.CompareHashedPassword(password) == nil && username == guiCfg.User
|
2018-09-11 21:25:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func authLDAP(username string, password string, cfg config.LDAPConfiguration) bool {
|
|
|
|
address := cfg.Address
|
2020-03-24 11:56:43 +00:00
|
|
|
hostname, _, err := net.SplitHostPort(address)
|
|
|
|
if err != nil {
|
|
|
|
hostname = address
|
|
|
|
}
|
2018-09-11 21:25:24 +00:00
|
|
|
var connection *ldap.Conn
|
|
|
|
if cfg.Transport == config.LDAPTransportTLS {
|
2020-03-24 11:56:43 +00:00
|
|
|
connection, err = ldap.DialTLS("tcp", address, &tls.Config{
|
|
|
|
ServerName: hostname,
|
|
|
|
InsecureSkipVerify: cfg.InsecureSkipVerify,
|
|
|
|
})
|
2018-09-11 21:25:24 +00:00
|
|
|
} else {
|
|
|
|
connection, err = ldap.Dial("tcp", address)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
l.Warnln("LDAP Dial:", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if cfg.Transport == config.LDAPTransportStartTLS {
|
|
|
|
err = connection.StartTLS(&tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify})
|
|
|
|
if err != nil {
|
|
|
|
l.Warnln("LDAP Start TLS:", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
defer connection.Close()
|
|
|
|
|
2023-05-10 05:52:02 +00:00
|
|
|
err = connection.Bind(ldapTemplateBindDN(cfg.BindDN, username), password)
|
2018-09-11 21:25:24 +00:00
|
|
|
if err != nil {
|
|
|
|
l.Warnln("LDAP Bind:", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
lib/api: Add LDAP search filters (fixes #5376) (#6488)
This adds the functionality to run a user search with a filter for LDAP
authentication. The search is done after successful bind, as the binding
user. The typical use case is to limit authentication to users who are
member of a group or under a certain OU. For example, to only match
users in the "Syncthing" group in otherwise default Active Directory
set up for example.com:
<searchBaseDN>CN=Users,DC=example,DC=com</searchBaseDN>
<searchFilter>(&(sAMAccountName=%s)(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com))</searchFilter>
The search filter is an "and" of two criteria (with the ampersand being
XML quoted),
- "(sAMAccountName=%s)" matches the user logging in
- "(memberOf=CN=Syncthing,CN=Users,DC=example,DC=com)" matches members
of the group in question.
Authentication will only proceed if the search filter matches precisely
one user.
2020-04-04 09:33:43 +00:00
|
|
|
if cfg.SearchFilter == "" && cfg.SearchBaseDN == "" {
|
|
|
|
// We're done here.
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
if cfg.SearchFilter == "" || cfg.SearchBaseDN == "" {
|
|
|
|
l.Warnln("LDAP configuration: both searchFilter and searchBaseDN must be set, or neither.")
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// If a search filter and search base is set we do an LDAP search for
|
|
|
|
// the user. If this matches precisely one user then we are good to go.
|
|
|
|
// The search filter uses the same %s interpolation as the bind DN.
|
|
|
|
|
|
|
|
searchString := fmt.Sprintf(cfg.SearchFilter, username)
|
|
|
|
const sizeLimit = 2 // we search for up to two users -- we only want to match one, so getting any number >1 is a failure.
|
|
|
|
const timeLimit = 60 // Search for up to a minute...
|
|
|
|
searchReq := ldap.NewSearchRequest(cfg.SearchBaseDN, ldap.ScopeWholeSubtree, ldap.DerefFindingBaseObj, sizeLimit, timeLimit, false, searchString, nil, nil)
|
|
|
|
|
|
|
|
res, err := connection.Search(searchReq)
|
|
|
|
if err != nil {
|
|
|
|
l.Warnln("LDAP Search:", err)
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
if len(res.Entries) != 1 {
|
|
|
|
l.Infof("Wrong number of LDAP search results, %d != 1", len(res.Entries))
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2018-09-11 21:25:24 +00:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2023-05-10 05:52:02 +00:00
|
|
|
func ldapTemplateBindDN(bindDN string, username string) string {
|
|
|
|
// Check if formatting directives are included in the ldapTemplateBindDN - if so add username.
|
|
|
|
// (%%s is a literal %s - unlikely for LDAP, but easy to handle here).
|
|
|
|
if strings.Count(bindDN, "%s") != strings.Count(bindDN, "%%s") {
|
|
|
|
bindDN = fmt.Sprintf(bindDN, username)
|
|
|
|
}
|
|
|
|
return bindDN
|
|
|
|
}
|
|
|
|
|
2016-04-18 20:24:38 +00:00
|
|
|
// Convert an ISO-8859-1 encoded byte string to UTF-8. Works by the
|
|
|
|
// principle that ISO-8859-1 bytes are equivalent to unicode code points,
|
|
|
|
// that a rune slice is a list of code points, and that stringifying a slice
|
|
|
|
// of runes generates UTF-8 in Go.
|
|
|
|
func iso88591ToUTF8(s []byte) []byte {
|
|
|
|
runes := make([]rune, len(s))
|
|
|
|
for i := range s {
|
|
|
|
runes[i] = rune(s[i])
|
|
|
|
}
|
|
|
|
return []byte(string(runes))
|
|
|
|
}
|