forked from TrueCloudLab/distribution
127 lines
3.1 KiB
Go
127 lines
3.1 KiB
Go
package basic
|
|
|
|
import (
|
|
"crypto/sha1"
|
|
"encoding/base64"
|
|
"encoding/csv"
|
|
"errors"
|
|
"os"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
)
|
|
|
|
// AuthenticationFailureErr - a generic error message for authentication failure to be presented to agent.
|
|
var AuthenticationFailureErr = errors.New("Bad username or password")
|
|
|
|
// HTPasswd - holds a path to a system .htpasswd file and the machinery to parse it.
|
|
type HTPasswd struct {
|
|
path string
|
|
reader *csv.Reader
|
|
}
|
|
|
|
// AuthType represents a particular hash function used in the htpasswd file.
|
|
type AuthType int
|
|
const (
|
|
PlainText AuthType = iota
|
|
SHA1
|
|
ApacheMD5
|
|
BCrypt
|
|
Crypt
|
|
)
|
|
|
|
// String returns a text representation of the AuthType
|
|
func (at AuthType) String() string {
|
|
switch(at) {
|
|
case PlainText: return "plaintext"
|
|
case SHA1: return "sha1"
|
|
case ApacheMD5: return "md5"
|
|
case BCrypt: return "bcrypt"
|
|
case Crypt: return "system crypt"
|
|
}
|
|
return "unknown"
|
|
}
|
|
|
|
|
|
// NewHTPasswd - Create a new HTPasswd with the given path to .htpasswd file.
|
|
func NewHTPasswd(htpath string) *HTPasswd {
|
|
return &HTPasswd{path: htpath}
|
|
}
|
|
|
|
var bcryptPrefixRegexp *regexp.Regexp = regexp.MustCompile(`^\$2[ab]?y\$`)
|
|
|
|
// GetAuthCredentialType - Inspect an htpasswd file credential and guess the encryption algorithm used.
|
|
func GetAuthCredentialType(cred string) AuthType {
|
|
if strings.HasPrefix(cred, "{SHA}") {
|
|
return SHA1
|
|
}
|
|
if strings.HasPrefix(cred, "$apr1$") {
|
|
return ApacheMD5
|
|
}
|
|
if bcryptPrefixRegexp.MatchString(cred) {
|
|
return BCrypt
|
|
}
|
|
// There's just not a great way to distinguish between these next two...
|
|
if len(cred) == 13 {
|
|
return Crypt
|
|
}
|
|
return PlainText
|
|
}
|
|
|
|
// AuthenticateUser - Check a given user:password credential against the receiving HTPasswd's file.
|
|
func (htpasswd *HTPasswd) AuthenticateUser(user string, pwd string) (bool, error) {
|
|
|
|
|
|
// Open the file.
|
|
in, err := os.Open(htpasswd.path)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
// Parse the contents of the standard .htpasswd until we hit the end or find a match.
|
|
reader := csv.NewReader(in)
|
|
reader.Comma = ':'
|
|
reader.Comment = '#'
|
|
reader.TrimLeadingSpace = true
|
|
for entry, readerr := reader.Read(); entry != nil || readerr != nil; entry, readerr = reader.Read() {
|
|
if readerr != nil {
|
|
return false, readerr
|
|
}
|
|
if len(entry) == 0 {
|
|
continue
|
|
}
|
|
if entry[0] == user {
|
|
credential := entry[1]
|
|
credType := GetAuthCredentialType(credential)
|
|
switch(credType) {
|
|
case SHA1: {
|
|
sha := sha1.New()
|
|
sha.Write([]byte(pwd))
|
|
hash := base64.StdEncoding.EncodeToString(sha.Sum(nil))
|
|
return entry[1][5:] == hash, nil
|
|
}
|
|
case ApacheMD5: {
|
|
return false, errors.New(ApacheMD5.String()+" htpasswd hash function not yet supported")
|
|
}
|
|
case BCrypt: {
|
|
err := bcrypt.CompareHashAndPassword([]byte(credential),[]byte(pwd))
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
return true, nil
|
|
}
|
|
case Crypt: {
|
|
return false, errors.New(Crypt.String()+" htpasswd hash function not yet supported")
|
|
}
|
|
case PlainText: {
|
|
if pwd == credential {
|
|
return true, nil
|
|
}
|
|
return false, AuthenticationFailureErr
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return false, AuthenticationFailureErr
|
|
}
|