masks-server 0.7.0

data/app/jobs/masks/server/saml_logout_job.rb

@@ -0,0 +1,38 @@
+module Masks
+  module Server
+    class SamlLogoutJob < ApplicationJob
+      queue_as :logout
+
+      retry_on BackchannelLogout::Refused, wait: :polynomially_longer, attempts: 5 do |job, error|
+        job.gave_up!(error)
+      end
+
+      def perform(client_id:, name_id:, name_id_format:, session_index:, origin:, actor: nil)
+        client = Client.speaking(SamlIdentity::PROTOCOL).find_by(client_id: client_id)
+
+        return if client.nil? || client.saml_slo_url.blank?
+
+        BackchannelLogout.deliver_saml!(
+          SamlIdentity::SignOff.new(
+            issuer: Issuer.new(Current.tenant, origin), client: client,
+            name_id: name_id, name_id_format: name_id_format, session_index: session_index
+          )
+        )
+      end
+
+      def gave_up!(error)
+        held = arguments.first.to_h.symbolize_keys
+
+        Tenant.switch(held_tenant) do
+          Event.record!(
+            Event::LOGOUT_UNDELIVERED,
+            actor: Subjects.locate(held[:actor]), by: nil,
+            client: Client.find_by(client_id: held[:client_id]),
+            device: nil, ip_address: nil, user_agent: nil,
+            said: error.message
+          )
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/signal_job.rb

@@ -0,0 +1,45 @@
+module Masks
+  module Server
+    class SignalJob < ApplicationJob
+      queue_as :streams
+
+      retry_on SignalStream::Refused, wait: :polynomially_longer, attempts: SignalStream::ATTEMPTS do |job, error|
+        job.gave_up!(error)
+      end
+
+      def perform(stream_id, event_id: nil, state: nil)
+        stream = SignalStream.includes(:client).find_by(id: stream_id)
+
+        return if stream.nil? || stream.status == SignalStream::DISABLED || !stream.receiving?
+
+        if event_id
+          event = Event.includes(:actor).find_by(id: event_id)
+
+          return if event&.actor.nil? || stream.status != SignalStream::ENABLED
+
+          stream.deliver!(stream.security_event_token(event))
+        else
+          stream.deliver!(stream.verification_token(state))
+        end
+      rescue SignalStream::Refused => error
+        stream&.failed!(error.message)
+
+        raise
+      end
+
+      def gave_up!(error)
+        stream_id, = arguments
+
+        Tenant.switch(held_tenant) do
+          stream = SignalStream.find_by(id: stream_id)
+
+          Event.record!(
+            Event::SIGNAL_UNDELIVERED,
+            actor: nil, by: nil, client: stream&.client, device: nil, ip_address: nil, user_agent: nil,
+            said: error.message
+          )
+        end
+      end
+    end
+  end
+end

data/app/jobs/masks/server/text_job.rb

@@ -0,0 +1,17 @@
+module Masks
+  module Server
+    class TextJob < ApplicationJob
+      queue_as :mailers
+
+      retry_on Sender::Failed, wait: :polynomially_longer, attempts: 3
+
+      def perform(to, body)
+        sender = Current.tenant&.sms_sender
+
+        return if sender.nil?
+
+        sender.deliver(to: to, body: body)
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/ber.rb

@@ -0,0 +1,202 @@
+module Masks
+  module Server
+    module Ldap
+      module Ber
+        class Error < StandardError; end
+
+        BOOLEAN = 0x01
+        INTEGER = 0x02
+        OCTET_STRING = 0x04
+        NULL = 0x05
+        ENUMERATED = 0x0a
+        SEQUENCE = 0x30
+        SET = 0x31
+
+        CONSTRUCTED = 0x20
+        DEEPEST = 32
+
+        Element = Data.define(:tag, :value) do
+          def constructed?
+            tag.anybits?(CONSTRUCTED)
+          end
+
+          def children
+            raise Error, "element #{format('%#04x', tag)} is primitive" unless constructed?
+
+            value
+          end
+
+          def string
+            raise Error, "element #{format('%#04x', tag)} is constructed" if constructed?
+
+            value
+          end
+
+          def integer
+            Ber.integer_from(string)
+          end
+
+          def boolean
+            string.bytes.any?(&:nonzero?)
+          end
+
+          def child(index, tag = nil)
+            found = children[index] || raise(Error, "element #{format('%#04x', self.tag)} has no part #{index}")
+            raise Error, "expected #{format('%#04x', tag)}, got #{format('%#04x', found.tag)}" if tag && found.tag != tag
+
+            found
+          end
+        end
+
+        module_function
+
+        def read(io, limit:)
+          first = io.read(1)
+          return nil if first.nil?
+
+          tag = first.ord
+          raise Error, "high tag numbers are not supported" if tag & 0x1f == 0x1f
+
+          head = io.read(1) || raise(Error, "the stream ended inside a length")
+          size = head.ord
+          header = first + head
+
+          if size.anybits?(0x80)
+            count = size & 0x7f
+            raise Error, "indefinite and oversized lengths are not supported" if count.zero? || count > 4
+
+            more = io.read(count)
+            raise Error, "the stream ended inside a length" if more.nil? || more.bytesize < count
+
+            header += more
+            size = more.bytes.inject(0) { |sum, byte| (sum << 8) | byte }
+          end
+
+          raise Error, "a message of #{size} bytes is larger than #{limit}" if size > limit
+
+          body = size.zero? ? "".b : io.read(size)
+          raise Error, "the stream ended inside a message" if body.nil? || body.bytesize < size
+
+          decode(header + body)
+        end
+
+        def decode(bytes)
+          bytes = bytes.b
+          element, finish = element_at(bytes, 0, 0)
+          raise Error, "#{bytes.bytesize - finish} bytes follow the element" if finish != bytes.bytesize
+
+          element
+        end
+
+        def element_at(bytes, start, depth)
+          raise Error, "elements nest deeper than #{DEEPEST}" if depth > DEEPEST
+          raise Error, "the input ended before a tag" if start >= bytes.bytesize
+
+          tag = bytes.getbyte(start)
+          raise Error, "high tag numbers are not supported" if tag & 0x1f == 0x1f
+
+          size, offset = length_at(bytes, start + 1)
+          finish = offset + size
+          raise Error, "an element runs past the end of the input" if finish > bytes.bytesize
+
+          content = bytes.byteslice(offset, size)
+
+          value = if tag.anybits?(CONSTRUCTED)
+            parts_of(content, depth + 1)
+          else
+            content
+          end
+
+          [ Element.new(tag: tag, value: value), finish ]
+        end
+
+        def parts_of(content, depth)
+          found = []
+          position = 0
+
+          while position < content.bytesize
+            element, position = element_at(content, position, depth)
+            found << element
+          end
+
+          found
+        end
+
+        def length_at(bytes, position)
+          first = bytes.getbyte(position) || raise(Error, "the input ended before a length")
+          return [ first, position + 1 ] if first < 0x80
+
+          count = first & 0x7f
+          raise Error, "indefinite and oversized lengths are not supported" if count.zero? || count > 4
+          raise Error, "the input ended inside a length" if position + count >= bytes.bytesize
+
+          size = 0
+          count.times { |index| size = (size << 8) | bytes.getbyte(position + 1 + index) }
+
+          [ size, position + 1 + count ]
+        end
+
+        def integer_from(bytes)
+          raise Error, "an integer has no content" if bytes.empty?
+          raise Error, "an integer is longer than eight bytes" if bytes.bytesize > 8
+
+          number = bytes.bytes.inject(0) { |sum, byte| (sum << 8) | byte }
+          bytes.getbyte(0) >= 0x80 ? number - (1 << (8 * bytes.bytesize)) : number
+        end
+
+        def length(size)
+          return size.chr.b if size < 0x80
+
+          bytes = []
+          while size.positive?
+            bytes.unshift(size & 0xff)
+            size >>= 8
+          end
+
+          [ 0x80 | bytes.size, *bytes ].pack("C*")
+        end
+
+        def tlv(tag, content)
+          content = content.b
+          tag.chr.b + length(content.bytesize) + content
+        end
+
+        def integer(number, tag = INTEGER)
+          bytes = []
+
+          loop do
+            bytes.unshift(number & 0xff)
+            number >>= 8
+            break if (number.zero? && bytes.first < 0x80) || (number == -1 && bytes.first >= 0x80)
+          end
+
+          tlv(tag, bytes.pack("C*"))
+        end
+
+        def enumerated(number, tag = ENUMERATED)
+          integer(number, tag)
+        end
+
+        def boolean(value, tag = BOOLEAN)
+          tlv(tag, value ? "\xff".b : "\x00".b)
+        end
+
+        def octets(value, tag = OCTET_STRING)
+          tlv(tag, value.to_s.dup.force_encoding(Encoding::BINARY))
+        end
+
+        def null(tag = NULL)
+          tlv(tag, "")
+        end
+
+        def sequence(parts, tag = SEQUENCE)
+          tlv(tag, parts.join.b)
+        end
+
+        def set(parts, tag = SET)
+          sequence(parts, tag)
+        end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/connection.rb

@@ -0,0 +1,149 @@
+module Masks
+  module Server
+    module Ldap
+      class Connection
+        LARGEST_MESSAGE = 64.kilobytes
+        MOST_ENTRIES = 10_000
+        AGENT = "LDAP".freeze
+
+        def initialize(socket, ip_address:, logger: ::Rails.logger)
+          @socket = socket
+          @ip_address = ip_address
+          @logger = logger
+          @bound = nil
+        end
+
+        def run
+          loop do
+            element = Ber.read(@socket, limit: LARGEST_MESSAGE)
+            break if element.nil?
+
+            break if answer(Protocol.message(element)) == :close
+          end
+        rescue Protocol::Invalid, Ber::Error => e
+          @logger.info("masks ldap: #{@ip_address} sent something unreadable: #{e.message}")
+          write(Protocol.disconnection(Protocol::PROTOCOL_ERROR, e.message))
+        rescue IOError, SystemCallError, OpenSSL::SSL::SSLError
+          nil
+        end
+
+        private
+
+          def answer(message)
+            case message.operation
+            when Protocol::Unbind then :close
+            when Protocol::Abandon then nil
+            when Protocol::Bind then within { bind(message) }
+            when Protocol::Search then within { search(message) }
+            when Protocol::WhoAmI then write(Protocol.who_am_i(message.id, @bound ? "dn:#{@bound.dn}" : ""))
+            when Protocol::Unsupported then unsupported(message)
+            end
+          end
+
+          def within(&block)
+            ::Rails.application.executor.wrap do
+              Current.set(ip_address: @ip_address, user_agent: AGENT, &block)
+            end
+          end
+
+          def unsupported(message)
+            unless Protocol::ANSWERS.key?(message.operation.tag)
+              write(Protocol.disconnection(Protocol::PROTOCOL_ERROR, "unknown operation"))
+              return :close
+            end
+
+            write(Protocol.refusal(message.id, message.operation.tag, "this directory is read-only"))
+            nil
+          end
+
+          def bind(message)
+            request = message.operation
+            @bound = nil
+
+            if request.version != 3
+              return write(Protocol.bind_response(message.id, Protocol::PROTOCOL_ERROR, "only LDAPv3 is spoken here"))
+            end
+
+            unless request.simple
+              return write(Protocol.bind_response(message.id, Protocol::AUTH_METHOD_NOT_SUPPORTED, "only simple binds are supported"))
+            end
+
+            outcome = Gate.new(ip_address: @ip_address).bind(request.name, request.password)
+            @bound = outcome.bound
+
+            write(Protocol.bind_response(message.id, outcome.code, outcome.message))
+          end
+
+          def search(message)
+            request = message.operation
+
+            return root(message) if request.base.empty? && request.scope == Directory::BASE
+
+            unless @bound&.service?
+              return write(Protocol.search_done(message.id, Protocol::INSUFFICIENT_ACCESS_RIGHTS, "bind with an LDAP credential to search"))
+            end
+
+            Tenant.switch(@bound.tenant) { search_within(message, request) }
+          end
+
+          def search_within(message, request)
+            unless Tenant.ldap.exists?(id: @bound.tenant.id)
+              @bound = nil
+              return write(Protocol.search_done(message.id, Protocol::INSUFFICIENT_ACCESS_RIGHTS, "this tenant's directory is closed"))
+            end
+
+            unless LdapCredential.live.exists?(id: @bound.subject)
+              @bound = nil
+              return write(Protocol.search_done(message.id, Protocol::INSUFFICIENT_ACCESS_RIGHTS, "the LDAP credential was revoked"))
+            end
+
+            directory = Directory.new(@bound.tenant)
+            base = Dn.parse(request.base)
+            entries = directory.search(base, request.scope, uid: Filter.pinned(request.filter, "uid"))
+            limit = [ request.size_limit, MOST_ENTRIES ].select(&:positive?).min
+            sent = 0
+
+            entries.each do |entry|
+              next unless request.filter.match(entry) == true
+
+              if sent >= limit
+                return write(Protocol.search_done(message.id, Protocol::SIZE_LIMIT_EXCEEDED, "more than #{limit} entries match"))
+              end
+
+              write(Protocol.search_entry(message.id, entry.dn, entry.selected(request.attributes), types_only: request.types_only))
+              sent += 1
+            end
+
+            write(Protocol.search_done(message.id, Protocol::SUCCESS))
+          rescue Dn::Invalid => e
+            write(Protocol.search_done(message.id, Protocol::INVALID_DN_SYNTAX, e.message))
+          rescue Directory::NoSuchObject => e
+            write(Protocol.search_done(message.id, Protocol::NO_SUCH_OBJECT, "no such entry", matched: e.matched.to_s))
+          end
+
+          def root(message)
+            request = message.operation
+            attributes = {
+              "objectClass" => %w[top extensibleObject],
+              "supportedLDAPVersion" => [ "3" ],
+              "vendorName" => [ "masks" ],
+              "vendorVersion" => [ Masks::Server::VERSION ],
+              "namingContexts" => @bound ? [ Directory.base_for(@bound.tenant).to_s ] : []
+            }
+            entry = Entry.new(Dn.new([]), attributes)
+
+            if request.filter.match(entry) == true
+              write(Protocol.search_entry(message.id, "", entry.selected(request.attributes), types_only: request.types_only))
+            end
+
+            write(Protocol.search_done(message.id, Protocol::SUCCESS))
+          end
+
+          def write(bytes)
+            @socket.write(bytes)
+            nil
+          end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/directory.rb

@@ -0,0 +1,175 @@
+module Masks
+  module Server
+    module Ldap
+      class Directory
+        class NoSuchObject < StandardError
+          attr_reader :matched
+
+          def initialize(matched)
+            @matched = matched
+            super("no such entry")
+          end
+        end
+
+        BASE = 0
+        ONE = 1
+        SUBTREE = 2
+        SCOPES = [ BASE, ONE, SUBTREE ].freeze
+
+        SUFFIX = "masks".freeze
+
+        class << self
+          def base_for(tenant)
+            Dn.build([ :dc, tenant.subdomain ], [ :dc, SUFFIX ])
+          end
+
+          def tenant_for(dn)
+            return nil if dn.depth < 2
+
+            named, suffix = dn.rdns.last(2).map { |rdn| rdn.size == 1 && rdn.first.first == "dc" ? rdn.first.last.downcase : nil }
+            return nil unless suffix == SUFFIX && named.present?
+
+            Tenant.ldap.find_by(subdomain: named)
+          end
+
+          def uid_for(actor)
+            actor.nickname.presence || actor.email
+          end
+        end
+
+        attr_reader :tenant, :base
+
+        def initialize(tenant)
+          @tenant = tenant
+          @base = self.class.base_for(tenant)
+        end
+
+        def people_dn
+          base.child(:ou, "people")
+        end
+
+        def groups_dn
+          base.child(:ou, "groups")
+        end
+
+        def services_dn
+          base.child(:ou, "services")
+        end
+
+        def person_dn(actor)
+          people_dn.child(:uid, self.class.uid_for(actor))
+        end
+
+        def group_dn(group)
+          groups_dn.child(:cn, group.key)
+        end
+
+        def service_dn(label)
+          services_dn.child(:cn, label)
+        end
+
+        def search(from, scope, uid: nil)
+          raise NoSuchObject.new(nil) unless from.under?(base)
+
+          uid = from.first_value if from.parent == people_dn && from.first_type == "uid"
+          entries = containers
+          entries += people(uid) if reaches?(people_dn, from, scope)
+          entries += groups if reaches?(groups_dn, from, scope)
+
+          raise NoSuchObject.new(matched(from, entries)) unless entries.any? { |entry| entry.dn == from }
+
+          entries.select { |entry| within?(entry.dn, from, scope) }
+        end
+
+        def listed
+          Actor.where(suspended_at: nil, pending_approval_at: nil).where.not(activated_at: nil)
+        end
+
+        private
+
+          def containers
+            [
+              Entry.new(base, "objectClass" => %w[top dcObject organization], "dc" => tenant.subdomain, "o" => tenant.name),
+              Entry.new(people_dn, "objectClass" => %w[top organizationalUnit], "ou" => "people"),
+              Entry.new(groups_dn, "objectClass" => %w[top organizationalUnit], "ou" => "groups")
+            ]
+          end
+
+          def people(uid)
+            actors = listed
+            if uid
+              wanted = uid.to_s.downcase
+              actors = actors.where("LOWER(nickname) = :uid OR (nickname IS NULL AND LOWER(email) = :uid)", uid: wanted)
+            end
+
+            actors = actors.order(:id).to_a
+            joined = GroupMember.where(actor_id: actors.map(&:id)).pluck(:actor_id, :group_id).group_by(&:first)
+            keys = Group.where(id: joined.values.flatten(1).map(&:last)).pluck(:id, :key).to_h
+
+            actors.map { |actor| person(actor, joined.fetch(actor.id, []).filter_map { |_actor, group| keys[group] }) }
+          end
+
+          def person(actor, group_keys)
+            uid = self.class.uid_for(actor)
+            cn = actor.name.presence || uid
+
+            Entry.new(
+              person_dn(actor),
+              "objectClass" => %w[top person organizationalPerson inetOrgPerson],
+              "uid" => uid,
+              "cn" => cn,
+              "sn" => actor.family_name.presence || cn,
+              "givenName" => actor.given_name,
+              "displayName" => cn,
+              "mail" => (actor.email if actor.email.present? && actor.email_verified_at.present?),
+              "memberOf" => group_keys.sort.map { |key| groups_dn.child(:cn, key).to_s },
+              "entryUUID" => actor.uuid
+            )
+          end
+
+          def groups
+            held = Group.order(:key).to_a
+            members = GroupMember.where(group_id: held.map(&:id), actor_id: listed.select(:id))
+                                 .joins(:actor).pluck(:group_id, "actors.nickname", "actors.email")
+                                 .group_by(&:first)
+
+            held.map do |group|
+              dns = members.fetch(group.id, []).map { |_group, nickname, email| people_dn.child(:uid, nickname.presence || email).to_s }
+
+              Entry.new(
+                group_dn(group),
+                "objectClass" => %w[top groupOfNames],
+                "cn" => group.key,
+                "description" => group.name,
+                "member" => dns.sort
+              )
+            end
+          end
+
+          def reaches?(container, from, scope)
+            case scope
+            when BASE then from.parent == container
+            when ONE then from == container
+            else container.under?(from) || from.under?(container)
+            end
+          end
+
+          def within?(dn, from, scope)
+            case scope
+            when BASE then dn == from
+            when ONE then dn.parent == from
+            else dn.under?(from)
+            end
+          end
+
+          def matched(from, entries)
+            known = entries.map(&:dn)
+            ancestor = from.parent
+
+            ancestor = ancestor.parent until ancestor.root? || known.include?(ancestor)
+            ancestor.root? ? nil : ancestor
+          end
+      end
+    end
+  end
+end