From 5ddbd4f6103fb19f4c0e9eb141ec92118b258a9b Mon Sep 17 00:00:00 2001 From: Alessandro Cabbia Date: Sun, 5 Nov 2023 09:13:49 +0200 Subject: [PATCH 1/3] docs: fix type on url link for last-commit badge (#358) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5f103a6..f86d411 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Go-lang LDAP Authentication (GLAuth) is a secure, easy-to-use, LDAP server w/ co ![GitHub all releases](https://img.shields.io/github/downloads/glauth/glauth/total) ![Docker pulls](https://badgen.net/docker/pulls/glauth/glauth) -![GitHub last commit (branch)](https://img.shields.io/github/last-commit/glauth/glauth/maaster) +![GitHub last commit (branch)](https://img.shields.io/github/last-commit/glauth/glauth/master) ![Code Climate maintainability](https://img.shields.io/codeclimate/maintainability-percentage/glauth/glauth) * Centrally manage accounts across your infrastructure From 7174aba5abc7a81bdc23dfea72d7b26756e3d7b1 Mon Sep 17 00:00:00 2001 From: Chris F Ravenscroft Date: Sun, 19 Nov 2023 17:43:40 -0800 Subject: [PATCH 2/3] chore: fix wrong goconvey hierarchy (#361) --- v2/glauth_test.go | 94 +++++++++++++++++++--------------- v2/go.mod | 7 +++ v2/go.sum | 13 +++++ v2/pkg/plugins/glauth-mysql | 1 + v2/pkg/plugins/glauth-pam | 1 + v2/pkg/plugins/glauth-postgres | 1 + v2/pkg/plugins/glauth-sqlite | 1 + 7 files changed, 77 insertions(+), 41 deletions(-) create mode 160000 v2/pkg/plugins/glauth-mysql create mode 160000 v2/pkg/plugins/glauth-pam create mode 160000 v2/pkg/plugins/glauth-postgres create mode 160000 v2/pkg/plugins/glauth-sqlite diff --git a/v2/glauth_test.go b/v2/glauth_test.go index 5703b01..e8d8e1b 100644 --- a/v2/glauth_test.go +++ b/v2/glauth_test.go @@ -1,6 +1,7 @@ package main import ( + "os" "os/exec" "strings" "testing" @@ -26,50 +27,61 @@ type testEnv struct { func TestIntegerStuff(t *testing.T) { - Convey("Testing sample-simple local file-based LDAP server", t, func() { - svc := startSvc(SD, "bin/glauth", "-c", "sample-simple.cfg") - batteryOfTests( - t, - svc, testEnv{ - checkanonymousrootDSE: true, - checkTOTP: true, - checkbindUPN: true, - expectedinfo: "supportedLDAPVersion: 3", - svcdn: "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com", - svcdnnogroup: "cn=serviceuser,dc=glauth,dc=com", - otpdn: "cn=otpuser,ou=superheros,dc=glauth,dc=com", - expectedaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", - scopedaccount: "dn: cn=hackers,ou=superheros,dc=glauth,dc=com", - expectedfirstaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", - expectedgroup: "dn: ou=superheros,ou=users,dc=glauth,dc=com", - checkemployeetype: "cn=hackers", - }) - stopSvc(svc) - }) + Convey("Preflight: Testing pre-requisites", t, func() { + Convey("bin/glauth should exist", func() { + info, err := os.Stat("bin/glauth") + So(err, ShouldEqual, nil) + Convey("bin/glauth should be executable", func() { + mode := uint32(info.Mode()) + So(mode&0b001001001, ShouldNotEqual, 0) - matchingLibrary := doRunGetFirst(RD, "ls", "bin/sqlite.so") - if matchingLibrary == "bin/sqlite.so" { - Convey("Testing sample-database LDAP server", t, func() { - svc := startSvc(SD, "bin/glauth", "-c", "pkg/plugins/sample-database.cfg") - batteryOfTests( - t, - svc, testEnv{ - checkanonymousrootDSE: true, - checkTOTP: false, - checkbindUPN: true, - expectedinfo: "supportedLDAPVersion: 3", - svcdn: "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com", - svcdnnogroup: "cn=serviceuser,dc=glauth,dc=com", - otpdn: "cn=otpuser,ou=superheros,dc=glauth,dc=com", - expectedaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", - scopedaccount: "dn: cn=hackers,ou=superheros,dc=glauth,dc=com", - expectedfirstaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", - expectedgroup: "dn: ou=superheros,ou=users,dc=glauth,dc=com", - checkemployeetype: "", + Convey("Testing sample-simple local file-based LDAP server", func() { + svc := startSvc(SD, "bin/glauth", "-c", "sample-simple.cfg") + batteryOfTests( + t, + svc, testEnv{ + checkanonymousrootDSE: true, + checkTOTP: true, + checkbindUPN: true, + expectedinfo: "supportedLDAPVersion: 3", + svcdn: "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com", + svcdnnogroup: "cn=serviceuser,dc=glauth,dc=com", + otpdn: "cn=otpuser,ou=superheros,dc=glauth,dc=com", + expectedaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", + scopedaccount: "dn: cn=hackers,ou=superheros,dc=glauth,dc=com", + expectedfirstaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", + expectedgroup: "dn: ou=superheros,ou=users,dc=glauth,dc=com", + checkemployeetype: "cn=hackers", + }) + stopSvc(svc) }) - stopSvc(svc) + + matchingLibrary := doRunGetFirst(RD, "ls", "bin/sqlite.so") + if matchingLibrary == "bin/sqlite.so" { + Convey("Testing sample-database LDAP server", func() { + svc := startSvc(SD, "bin/glauth", "-c", "pkg/plugins/sample-database.cfg") + batteryOfTests( + t, + svc, testEnv{ + checkanonymousrootDSE: true, + checkTOTP: false, + checkbindUPN: true, + expectedinfo: "supportedLDAPVersion: 3", + svcdn: "cn=serviceuser,ou=svcaccts,dc=glauth,dc=com", + svcdnnogroup: "cn=serviceuser,dc=glauth,dc=com", + otpdn: "cn=otpuser,ou=superheros,dc=glauth,dc=com", + expectedaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", + scopedaccount: "dn: cn=hackers,ou=superheros,dc=glauth,dc=com", + expectedfirstaccount: "dn: cn=hackers,ou=superheros,ou=users,dc=glauth,dc=com", + expectedgroup: "dn: ou=superheros,ou=users,dc=glauth,dc=com", + checkemployeetype: "", + }) + stopSvc(svc) + }) + } + }) }) - } + }) matchingContainers := doRunGetFirst(RD, "sh", "-c", "docker ps | grep openldap-service | wc -l") if matchingContainers == "1" { diff --git a/v2/go.mod b/v2/go.mod index d294d48..83860d5 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -25,20 +25,27 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/boombuler/barcode v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect + github.com/go-logr/logr v1.3.0 // indirect + github.com/go-sql-driver/mysql v1.7.1 // indirect github.com/golang/protobuf v1.5.3 // indirect github.com/gopherjs/gopherjs v1.17.2 // indirect github.com/gorilla/websocket v1.5.0 // indirect github.com/jtolds/gls v4.20.0+incompatible // indirect github.com/kr/text v0.1.0 // indirect + github.com/lib/pq v1.10.9 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.19 // indirect + github.com/mattn/go-sqlite3 v1.14.18 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect + github.com/msteinert/pam v1.2.0 // indirect github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect github.com/prometheus/common v0.44.0 // indirect github.com/prometheus/procfs v0.12.0 // indirect github.com/rickb777/date v1.20.5 // indirect github.com/rickb777/plural v1.4.1 // indirect github.com/smarty/assertions v1.15.0 // indirect + golang.org/x/mod v0.12.0 // indirect golang.org/x/sys v0.13.0 // indirect + golang.org/x/tools v0.13.0 // indirect google.golang.org/protobuf v1.31.0 // indirect ) diff --git a/v2/go.sum b/v2/go.sum index 739906f..380f5e4 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -19,6 +19,10 @@ github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= +github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY= +github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= +github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= @@ -39,13 +43,19 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= +github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA= github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-sqlite3 v1.14.18 h1:JL0eqdCOq6DJVNPSvArO/bIV9/P7fbGrV00LZHc+5aI= +github.com/mattn/go-sqlite3 v1.14.18/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg= github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo= github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4= +github.com/msteinert/pam v1.2.0 h1:mYfjlvN2KYs2Pb9G6nb/1f/nPfAttT/Jee5Sq9r3bGE= +github.com/msteinert/pam v1.2.0/go.mod h1:d2n0DCUK8rGecChV3JzvmsDjOY4R7AYbsNxAT+ftQl0= github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaDr2CRKN++7HbSXbefUNDrPq60T+g24s= github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA= github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E= @@ -95,6 +105,8 @@ golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= +golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -124,6 +136,7 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20200529172331-a64b76657301/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20200731060945-b5fad4ed8dd6/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ= +golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/v2/pkg/plugins/glauth-mysql b/v2/pkg/plugins/glauth-mysql new file mode 160000 index 0000000..8379828 --- /dev/null +++ b/v2/pkg/plugins/glauth-mysql @@ -0,0 +1 @@ +Subproject commit 8379828f13fb0b31a41f3e5f6bf5bc6a3c8d6e1a diff --git a/v2/pkg/plugins/glauth-pam b/v2/pkg/plugins/glauth-pam new file mode 160000 index 0000000..0e6e424 --- /dev/null +++ b/v2/pkg/plugins/glauth-pam @@ -0,0 +1 @@ +Subproject commit 0e6e4240ef72ffc6d09b3aba9aa130b70ae13d92 diff --git a/v2/pkg/plugins/glauth-postgres b/v2/pkg/plugins/glauth-postgres new file mode 160000 index 0000000..61fa8ee --- /dev/null +++ b/v2/pkg/plugins/glauth-postgres @@ -0,0 +1 @@ +Subproject commit 61fa8ee872e932052fbdb0d7b5dd22e53310f8f3 diff --git a/v2/pkg/plugins/glauth-sqlite b/v2/pkg/plugins/glauth-sqlite new file mode 160000 index 0000000..e8b3b6a --- /dev/null +++ b/v2/pkg/plugins/glauth-sqlite @@ -0,0 +1 @@ +Subproject commit e8b3b6a8b0541d72dacfd4678273f7c86382ef00 From 01bdb7148e8ed440e3efaab7f3e5ed1b85c42252 Mon Sep 17 00:00:00 2001 From: Alessandro Cabbia Date: Sun, 10 Dec 2023 23:20:29 +0000 Subject: [PATCH 3/3] startTLS: ldap over TLS functionality (#364) * feat: introduce tls parameters in config to allow startTLS * feat: pass tls config for startTLS to ldap server * build: update libs to use newer ldap * feat: allow tls config for startTLS --- v2/glauth.go | 14 +++++ v2/go.mod | 13 ++--- v2/go.sum | 21 ++------ v2/internal/tls/tls.go | 81 ++++++++++++++++++++++++++++ v2/internal/toml/config.go | 19 +++++++ v2/pkg/config/config.go | 6 +++ v2/pkg/frontend/options.go | 1 + v2/pkg/logging/loghandler_other.go | 3 +- v2/pkg/logging/loghandler_windows.go | 3 +- v2/pkg/server/options.go | 17 ++++-- v2/pkg/server/server.go | 6 +++ v2/sample-simple.cfg | 3 ++ 12 files changed, 156 insertions(+), 31 deletions(-) create mode 100644 v2/internal/tls/tls.go diff --git a/v2/glauth.go b/v2/glauth.go index d0275b9..75e3498 100644 --- a/v2/glauth.go +++ b/v2/glauth.go @@ -1,6 +1,7 @@ package main import ( + "crypto/tls" "fmt" "net/http" "os" @@ -14,6 +15,7 @@ import ( docopt "github.com/docopt/docopt-go" "github.com/fsnotify/fsnotify" "github.com/glauth/glauth/v2/internal/monitoring" + _tls "github.com/glauth/glauth/v2/internal/tls" "github.com/glauth/glauth/v2/internal/toml" "github.com/glauth/glauth/v2/internal/version" "github.com/glauth/glauth/v2/pkg/config" @@ -131,10 +133,22 @@ func startService() { startConfigWatcher() + var err error + var tlsConfig *tls.Config + if c := activeConfig.LDAP; c.Enabled && c.TLS { + // TODO check if tls params are string or bytes and change config accordingly + tlsConfig, err = _tls.MakeTLS([]byte(c.TLSCert), []byte(c.TLSKey)) + + if err != nil { + log.Warn().Err(err).Msg("unable to configure TLS, proceeding without....StartTLS won't be supported") + } + } + s, err := server.NewServer( server.Logger(log), server.Config(activeConfig), server.Monitor(monitor), + server.TLSConfig(tlsConfig), ) if err != nil { diff --git a/v2/go.mod b/v2/go.mod index 83860d5..0a4d7b3 100644 --- a/v2/go.mod +++ b/v2/go.mod @@ -25,27 +25,24 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/boombuler/barcode v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect - github.com/go-logr/logr v1.3.0 // indirect - github.com/go-sql-driver/mysql v1.7.1 // indirect + github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect github.com/golang/protobuf v1.5.3 // indirect github.com/gopherjs/gopherjs v1.17.2 // indirect github.com/gorilla/websocket v1.5.0 // indirect github.com/jtolds/gls v4.20.0+incompatible // indirect github.com/kr/text v0.1.0 // indirect - github.com/lib/pq v1.10.9 // indirect github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.19 // indirect - github.com/mattn/go-sqlite3 v1.14.18 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect - github.com/msteinert/pam v1.2.0 // indirect - github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect github.com/prometheus/common v0.44.0 // indirect github.com/prometheus/procfs v0.12.0 // indirect github.com/rickb777/date v1.20.5 // indirect github.com/rickb777/plural v1.4.1 // indirect github.com/smarty/assertions v1.15.0 // indirect - golang.org/x/mod v0.12.0 // indirect golang.org/x/sys v0.13.0 // indirect - golang.org/x/tools v0.13.0 // indirect google.golang.org/protobuf v1.31.0 // indirect ) + +replace github.com/nmcclain/ldap => github.com/shipperizer/ldap v0.0.0-20231117095347-c1d6afe484ca + +// replace github.com/nmcclain/ldap => ../../../ldap diff --git a/v2/go.sum b/v2/go.sum index 380f5e4..b85bef8 100644 --- a/v2/go.sum +++ b/v2/go.sum @@ -19,10 +19,8 @@ github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= -github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY= -github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= -github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= -github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= +github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A= +github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= @@ -43,23 +41,13 @@ github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= -github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw= -github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA= github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= -github.com/mattn/go-sqlite3 v1.14.18 h1:JL0eqdCOq6DJVNPSvArO/bIV9/P7fbGrV00LZHc+5aI= -github.com/mattn/go-sqlite3 v1.14.18/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg= github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo= github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4= -github.com/msteinert/pam v1.2.0 h1:mYfjlvN2KYs2Pb9G6nb/1f/nPfAttT/Jee5Sq9r3bGE= -github.com/msteinert/pam v1.2.0/go.mod h1:d2n0DCUK8rGecChV3JzvmsDjOY4R7AYbsNxAT+ftQl0= -github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 h1:D9EvfGQvlkKaDr2CRKN++7HbSXbefUNDrPq60T+g24s= -github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484/go.mod h1:O1EljZ+oHprtxDDPHiMWVo/5dBT6PlvWX5PSwj80aBA= -github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba h1:DO8NFYdcRv1dnyAINJIBm6Bw2XibtLvQniNFGzf2W8E= -github.com/nmcclain/ldap v0.0.0-20210720162743-7f8d1e44eeba/go.mod h1:4S0XndRL8HNOaQBfdViJ2F/GPCgL524xlXRuXFH12/U= github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -84,6 +72,8 @@ github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDN github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A= github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss= +github.com/shipperizer/ldap v0.0.0-20231117095347-c1d6afe484ca h1:KSpZYIDb2ei4d+AxsFmC9KJaTNlmSiONSl6hLd5Qmfg= +github.com/shipperizer/ldap v0.0.0-20231117095347-c1d6afe484ca/go.mod h1:/KinL0zHM54Sk4gMgvODL26YGG7u4SFBOAKNpJmsJvc= github.com/smarty/assertions v1.15.0 h1:cR//PqUBUiQRakZWqBiFFQ9wb8emQGDb0HeGdqGByCY= github.com/smarty/assertions v1.15.0/go.mod h1:yABtdzeQs6l1brC900WlRNwj6ZR55d7B+E8C6HtKdec= github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY= @@ -105,8 +95,6 @@ golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= -golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= @@ -136,7 +124,6 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn golang.org/x/tools v0.0.0-20200529172331-a64b76657301/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20200731060945-b5fad4ed8dd6/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ= -golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff --git a/v2/internal/tls/tls.go b/v2/internal/tls/tls.go new file mode 100644 index 0000000..df7f7d5 --- /dev/null +++ b/v2/internal/tls/tls.go @@ -0,0 +1,81 @@ +package tls + +import ( + tls "crypto/tls" + "crypto/x509" + "encoding/pem" + + "github.com/rs/zerolog" +) + +var ( + log zerolog.Logger +) + +// MakeTLS generates a tls.Config +func MakeTLS(clientCert, key []byte) (*tls.Config, error) { + if clientCert == nil && key == nil { + return new(tls.Config), nil + } + + var err error + + cert, err := tls.X509KeyPair(clientCert, key) + + if err != nil { + return nil, err + } + + log.Debug().Str("key", string(key)) + log.Debug().Str("client.certificate", string(clientCert)) + log.Debug().Interface("certificate", cert) + + if err != nil { + return nil, err + } + + // Get the SystemCertPool, continue with an empty pool on error + rootCAs, err := x509.SystemCertPool() + + if rootCAs == nil { + rootCAs = x509.NewCertPool() + log.Warn().Err(err).Msg("Using empty cert-pool") + } else { + log.Info().Msg("Using system cert-pool") + } + + for _, cert := range DecodePEM(clientCert).Certificate { + x509Cert, err := x509.ParseCertificate(cert) + if err != nil { + log.Error().Err(err).Msg("issue parsing cert PEM") + } + rootCAs.AddCert(x509Cert) + } + + log.Debug().Interface("root.ca", rootCAs) + log.Debug().Interface("certificates", []tls.Certificate{cert}) + + return &tls.Config{ + RootCAs: rootCAs, + MinVersion: tls.VersionTLS10, + MaxVersion: tls.VersionTLS13, + Certificates: []tls.Certificate{cert}, + }, nil +} + +// DecodePEM builds a PEM certificate object +func DecodePEM(certPEM []byte) tls.Certificate { + var cert tls.Certificate + var certDER *pem.Block + for { + certDER, certPEM = pem.Decode(certPEM) + if certDER == nil { + break + } + if certDER.Type == "CERTIFICATE" { + cert.Certificate = append(cert.Certificate, certDER.Bytes) + } + } + + return cert +} diff --git a/v2/internal/toml/config.go b/v2/internal/toml/config.go index 8b8dc69..4a0f101 100644 --- a/v2/internal/toml/config.go +++ b/v2/internal/toml/config.go @@ -400,6 +400,25 @@ func validateConfig(cfg *config.Config) (*config.Config, error) { if len(cfg.LDAP.Listen) == 0 { return cfg, fmt.Errorf("no LDAP bind address was specified: please disable LDAP or use the 'listen' option") } + + if cfg.LDAP.TLS && cfg.LDAP.TLSCert == "" && cfg.LDAP.TLSCertPath != "" { + byteData, err := os.ReadFile(cfg.LDAP.TLSCertPath) + cfg.LDAP.TLSCert = string(byteData) + + if err != nil { + return cfg, fmt.Errorf("unable to read TLS certificate file") + } + } + + if cfg.LDAP.TLS && cfg.LDAP.TLSKey == "" && cfg.LDAP.TLSKeyPath != "" { + byteData, err := os.ReadFile(cfg.LDAP.TLSKeyPath) + cfg.LDAP.TLSKey = string(byteData) + + if err != nil { + return cfg, fmt.Errorf("unable to read TLS key file") + } + } + } //spew.Dump(cfg) diff --git a/v2/pkg/config/config.go b/v2/pkg/config/config.go index 88bc5ae..be7989a 100644 --- a/v2/pkg/config/config.go +++ b/v2/pkg/config/config.go @@ -36,6 +36,12 @@ type Frontend struct { type LDAP struct { Enabled bool Listen string + // StartTLS parameters + TLS bool + TLSCert string + TLSKey string + TLSCertPath string + TLSKeyPath string } type LDAPS struct { Enabled bool diff --git a/v2/pkg/frontend/options.go b/v2/pkg/frontend/options.go index 2d731e7..1904d74 100644 --- a/v2/pkg/frontend/options.go +++ b/v2/pkg/frontend/options.go @@ -2,6 +2,7 @@ package frontend import ( "context" + "github.com/rs/zerolog" "github.com/glauth/glauth/v2/pkg/config" diff --git a/v2/pkg/logging/loghandler_other.go b/v2/pkg/logging/loghandler_other.go index 79b50d2..e2a3d2a 100644 --- a/v2/pkg/logging/loghandler_other.go +++ b/v2/pkg/logging/loghandler_other.go @@ -5,7 +5,6 @@ package logging import ( "fmt" - "github.com/rs/zerolog" "io" "log" "log/syslog" @@ -13,6 +12,8 @@ import ( "regexp" "strings" "time" + + "github.com/rs/zerolog" ) // We will use this package to wrap log messages coming from libraries who have no interest diff --git a/v2/pkg/logging/loghandler_windows.go b/v2/pkg/logging/loghandler_windows.go index b538cc0..9bd6363 100644 --- a/v2/pkg/logging/loghandler_windows.go +++ b/v2/pkg/logging/loghandler_windows.go @@ -5,13 +5,14 @@ package logging import ( "fmt" - "github.com/rs/zerolog" "io" "log" "os" "regexp" "strings" "time" + + "github.com/rs/zerolog" ) // We will use this package to wrap log messages coming from libraries who have no interest diff --git a/v2/pkg/server/options.go b/v2/pkg/server/options.go index 9ce0f35..14af9a7 100644 --- a/v2/pkg/server/options.go +++ b/v2/pkg/server/options.go @@ -2,6 +2,7 @@ package server import ( "context" + "crypto/tls" "github.com/rs/zerolog" @@ -14,10 +15,11 @@ type Option func(o *Options) // Options defines the available options for this package. type Options struct { - Logger zerolog.Logger - Config *config.Config - Monitor monitoring.MonitorInterface - Context context.Context + Logger zerolog.Logger + Config *config.Config + Monitor monitoring.MonitorInterface + TLSConfig *tls.Config + Context context.Context } // newOptions initializes the available default options. @@ -52,6 +54,13 @@ func Context(val context.Context) Option { } } +// TLSConfig provides a function to set the TLS config option. +func TLSConfig(val *tls.Config) Option { + return func(o *Options) { + o.TLSConfig = val + } +} + // Monitor provides a function to set the monitor option. func Monitor(val monitoring.MonitorInterface) Option { return func(o *Options) { diff --git a/v2/pkg/server/server.go b/v2/pkg/server/server.go index 60dd521..aa8794e 100644 --- a/v2/pkg/server/server.go +++ b/v2/pkg/server/server.go @@ -90,6 +90,12 @@ func NewServer(opts ...Option) (*LdapSvc, error) { // configure the backends s.l = ldap.NewServer() s.l.EnforceLDAP = true + + if tlsConfig := options.TLSConfig; tlsConfig != nil { + s.l.TLSConfig = tlsConfig + s.log.Info().Interface("tls.certificates", tlsConfig.Certificates).Msg("enabling LDAP over TLS") + } + for i, backend := range s.c.Backends { var h handler.Handler switch backend.Datastore { diff --git a/v2/sample-simple.cfg b/v2/sample-simple.cfg index 07574e2..c3420c5 100644 --- a/v2/sample-simple.cfg +++ b/v2/sample-simple.cfg @@ -21,6 +21,9 @@ debug = true enabled = true # run on a non privileged port listen = "0.0.0.0:3893" + tls = false # enable StartTLS support + tlsCertPath = "glauth.crt" + tlsKeyPath = "glauth.key" [ldaps] # to enable ldaps generate a certificate, eg. with: