Drop the pwauth

Real Cross-Platform.
Avoid exposing system usernames and passwords.

Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>

config.go

@@ -33,6 +33,8 @@ func parseConfig() *RttysConfig {
 	flag.StringVar(&cfg.addrUser, "addr-user", ":5913", "address to listen user")
 	flag.StringVar(&cfg.sslCert, "ssl-cert", "./rttys.crt", "certFile Path")
 	flag.StringVar(&cfg.sslKey, "ssl-key", "./rttys.key", "keyFile Path")
+	flag.StringVar(&cfg.httpUsername, "http-username", "", "username for http auth")
+	flag.StringVar(&cfg.httpPassword, "http-password", "", "password for http auth")
 	flag.StringVar(&cfg.token, "token", "", "token to use")
 	flag.StringVar(&cfg.baseURL, "base-url", "/", "base url to serve on")
 	conf := flag.String("conf", "./rttys.conf", "config file to load")

http.go

@@ -6,7 +6,6 @@ import (
 	"github.com/rakyll/statik/fs"
 	log "github.com/sirupsen/logrus"
 	"github.com/zhaojh329/rttys/cache"
-	"github.com/zhaojh329/rttys/pwauth"
 	_ "github.com/zhaojh329/rttys/statik"
 	"io/ioutil"
 	"net/http"
@@ -47,23 +46,15 @@ func httpAuth(w http.ResponseWriter, r *http.Request) bool {
 }
 
 func httpLogin(cfg *RttysConfig, creds *Credentials) bool {
-	if err := pwauth.Auth(creds.Username, creds.Password); err == nil {
-		return true
+	if cfg.httpUsername != creds.Username {
+		return false
 	}
 
-	if cfg.httpUsername != "" {
-		if cfg.httpUsername != creds.Username {
-			return false
-		}
-
-		if cfg.httpPassword != "" {
-			return cfg.httpPassword == creds.Password
-		}
-
-		return true
+	if cfg.httpPassword != "" {
+		return cfg.httpPassword == creds.Password
 	}
 
-	return false
+	return true
 }
 
 func httpStart(br *Broker, cfg *RttysConfig) {

main.go

@@ -21,6 +21,10 @@ func init() {
 func main() {
 	cfg := parseConfig()
 
+	if cfg.httpUsername == "" {
+		log.Fatal("You must configure the http username by commandline or config file")
+	}
+
 	log.Info("Go Version: ", runtime.Version())
 	log.Info("Go OS/Arch: ", runtime.GOOS, "/", runtime.GOARCH)
 

pwauth/auth_darwin.go

@@ -1,10 +0,0 @@
-package pwauth
-
-import (
-	"errors"
-)
-
-// Need to be implemented
-func auth(username, password string) error {
-	return errors.New("not implemented")
-}

pwauth/auth_freebsd.go

@@ -1,10 +0,0 @@
-package pwauth
-
-import (
-	"errors"
-)
-
-// Need to be implemented
-func auth(username, password string) error {
-	return errors.New("not implemented")
-}

pwauth/auth_linux.go

@@ -1,35 +0,0 @@
-package pwauth
-
-import (
-	"errors"
-	"fmt"
-	"github.com/msteinert/pam"
-)
-
-func auth(username, password string) error {
-	t, err := pam.StartFunc("rttys", username, func(s pam.Style, msg string) (string, error) {
-		switch s {
-		case pam.PromptEchoOff:
-			return password, nil
-		case pam.PromptEchoOn:
-			return password, nil
-		case pam.ErrorMsg:
-			fmt.Print(msg)
-			return "", nil
-		case pam.TextInfo:
-			fmt.Println(msg)
-			return "", nil
-		}
-		return "", errors.New("Unrecognized message style")
-	})
-	if err != nil {
-		return err
-	}
-
-	err = t.Authenticate(0)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}

pwauth/auth_windows.go

@@ -1,51 +0,0 @@
-package pwauth
-
-import (
-	"os/user"
-	"syscall"
-	"unsafe"
-)
-
-const (
-	LOGON32_LOGON_INTERACTIVE = 2
-	LOGON32_PROVIDER_DEFAULT  = 0
-)
-
-var errERROR_ACCOUNT_RESTRICTION error = syscall.Errno(1327)
-
-var (
-	advapi32       = syscall.NewLazyDLL("advapi32.dll")
-	procLogonUserW = advapi32.NewProc("LogonUserW")
-)
-
-func LogonUserW(username, domain, password *uint16, logonType, logonProvider uint32) (token syscall.Handle, err error) {
-	r1, _, e1 := procLogonUserW.Call(
-		uintptr(unsafe.Pointer(username)),
-		uintptr(unsafe.Pointer(domain)),
-		uintptr(unsafe.Pointer(password)),
-		uintptr(logonType),
-		uintptr(logonProvider),
-		uintptr(unsafe.Pointer(&token)))
-	if int(r1) == 0 {
-		return syscall.InvalidHandle, e1
-	}
-	return token, nil
-}
-
-func auth(username, password string) error {
-	if _, err := user.Lookup(username); err != nil {
-		return err
-	}
-
-	pUsername, _ := syscall.UTF16PtrFromString(username)
-	pDomain, _ := syscall.UTF16PtrFromString(".")
-	pPassword, _ := syscall.UTF16PtrFromString(password)
-
-	_, err := LogonUserW(pUsername, pDomain, pPassword, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT)
-
-	if err == errERROR_ACCOUNT_RESTRICTION {
-		return nil
-	}
-
-	return err
-}

pwauth/pwauth.go

@@ -1,7 +0,0 @@
-package pwauth
-
-// Auth check the validity of the username/password pair.If the
-// credentials are not valid, this function will return an error.
-func Auth(username, password string) error {
-	return auth(username, password)
-}

rttys.conf

@@ -1,9 +1,9 @@
 #addr-dev: :5912
 #addr-user: :5913
 
-# default from system
-#http-username: rttys
-#http-password: rttys
+# Auth for http
+http-username: rttys
+http-password: rttys
 
 #ssl-cert: /etc/rttys/rttys.crt
 #ssl-key: /etc/rttys/rttys.key