masks-server 0.7.0

data/app/ldap/masks/server/ldap/dn.rb

@@ -0,0 +1,185 @@
+module Masks
+  module Server
+    module Ldap
+      class Dn
+        class Invalid < StandardError; end
+
+        SPECIAL = [ ",", "+", "\"", "\\", "<", ">", ";", "=" ].freeze
+        LONGEST = 1024
+
+        attr_reader :rdns
+
+        class << self
+          def parse(text)
+            text = text.to_s.dup.force_encoding(Encoding::UTF_8)
+            raise Invalid, "a DN is longer than #{LONGEST} bytes" if text.bytesize > LONGEST
+            raise Invalid, "a DN is not UTF-8" unless text.valid_encoding?
+            return new([]) if text.strip.empty?
+
+            new(split(text, ",").map { |rdn| split(rdn, "+").map { |pair| assertion(pair) }.sort })
+          end
+
+          def build(*pairs)
+            new(pairs.map { |type, value| [ [ type.to_s.downcase, value.to_s ] ] })
+          end
+
+          def escape(value)
+            escaped = value.to_s.gsub(/[,+"\\<>;=\x00]/) do |char|
+              char == "\x00" ? "\\00" : "\\#{char}"
+            end
+
+            escaped = "\\#{escaped}" if escaped.start_with?(" ", "#")
+            escaped = "#{escaped[0..-2]}\\ " if escaped.end_with?(" ") && !escaped.end_with?("\\ ")
+            escaped
+          end
+
+          private
+
+            def split(text, separator)
+              parts = []
+              current = +""
+              index = 0
+
+              while index < text.length
+                char = text[index]
+
+                if char == "\\"
+                  current << char << text[index + 1].to_s
+                  index += 2
+                  next
+                end
+
+                if char == separator
+                  parts << current
+                  current = +""
+                else
+                  current << char
+                end
+
+                index += 1
+              end
+
+              parts << current
+              raise Invalid, "a DN has an empty part" if parts.any? { |part| part.strip.empty? }
+
+              parts
+            end
+
+            def assertion(pair)
+              type, value = pair.split("=", 2)
+              raise Invalid, "#{pair.strip} has no value" if value.nil?
+
+              type = type.strip.downcase
+              raise Invalid, "#{type} is not an attribute type" unless type.match?(/\A([a-z][a-z0-9-]*|\d+(\.\d+)*)\z/)
+
+              [ type, unescape(trimmed(value)) ]
+            end
+
+            def trimmed(value)
+              leading = value.lstrip
+              trailing = leading.rstrip
+              escaped_space = trailing != leading && trailing[/\\+\z/].to_s.length.odd?
+
+              escaped_space ? "#{trailing} " : trailing
+            end
+
+            def unescape(value)
+              raise Invalid, "hex-encoded values are not supported" if value.start_with?("#")
+
+              bytes = +"".b
+              index = 0
+
+              while index < value.length
+                char = value[index]
+
+                if char != "\\"
+                  bytes << char.b
+                  index += 1
+                  next
+                end
+
+                following = value[index + 1, 2].to_s
+
+                if following.match?(/\A\h\h\z/)
+                  bytes << following.to_i(16).chr
+                  index += 3
+                elsif following.empty?
+                  raise Invalid, "a DN ends inside an escape"
+                else
+                  bytes << following[0].b
+                  index += 2
+                end
+              end
+
+              decoded = bytes.force_encoding(Encoding::UTF_8)
+              raise Invalid, "a DN value is not UTF-8" unless decoded.valid_encoding?
+
+              decoded
+            end
+        end
+
+        def initialize(rdns)
+          @rdns = rdns.freeze
+        end
+
+        def root?
+          rdns.empty?
+        end
+
+        def parent
+          Dn.new(rdns.drop(1))
+        end
+
+        def child(type, value)
+          Dn.new([ [ [ type.to_s.downcase, value.to_s ] ] ] + rdns)
+        end
+
+        def depth
+          rdns.size
+        end
+
+        def first
+          rdns.first&.first
+        end
+
+        def first_type
+          first&.first
+        end
+
+        def first_value
+          first&.last
+        end
+
+        def under?(other)
+          return true if other.root?
+          return false if other.depth > depth
+
+          normal_rdns.last(other.depth) == other.normal_rdns
+        end
+
+        def ==(other)
+          other.is_a?(Dn) && normal_rdns == other.normal_rdns
+        end
+        alias eql? ==
+
+        def hash
+          normal_rdns.hash
+        end
+
+        def to_s
+          rdns.map { |rdn| rdn.map { |type, value| "#{type}=#{Dn.escape(value)}" }.join("+") }.join(",")
+        end
+
+        def normal
+          normal_rdns.map { |rdn| rdn.map { |type, value| "#{type}=#{Dn.escape(value)}" }.join("+") }.join(",")
+        end
+
+        protected
+
+          def normal_rdns
+            @normal_rdns ||= rdns.map { |rdn| rdn.map { |type, value| [ type, value.unicode_normalize(:nfkc).downcase ] }.sort }
+          end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/entry.rb

@@ -0,0 +1,30 @@
+module Masks
+  module Server
+    module Ldap
+      class Entry
+        attr_reader :dn, :attributes
+
+        def initialize(dn, attributes)
+          @dn = dn
+          @attributes = attributes.transform_values { |values| Array(values).compact.map(&:to_s).reject(&:empty?) }
+                                  .reject { |_name, values| values.empty? }
+        end
+
+        def values(name)
+          wanted = name.to_s.downcase
+          found = attributes.find { |held, _values| held.downcase == wanted }
+
+          found ? found.last : []
+        end
+
+        def selected(requested)
+          wanted = requested.map(&:downcase)
+          return [] if wanted == [ "1.1" ]
+          return attributes.to_a if wanted.empty? || wanted.include?("*") || wanted.include?("+")
+
+          attributes.select { |name, _values| wanted.include?(name.downcase) }.to_a
+        end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/filter.rb

@@ -0,0 +1,239 @@
+module Masks
+  module Server
+    module Ldap
+      module Filter
+        class Invalid < StandardError; end
+
+        AND = 0xa0
+        OR = 0xa1
+        NOT = 0xa2
+        EQUALITY = 0xa3
+        SUBSTRINGS = 0xa4
+        GREATER_OR_EQUAL = 0xa5
+        LESS_OR_EQUAL = 0xa6
+        PRESENT = 0x87
+        APPROXIMATE = 0xa8
+        EXTENSIBLE = 0xa9
+
+        INITIAL = 0x80
+        ANY = 0x81
+        FINAL = 0x82
+
+        DISTINGUISHED = %w[member memberof].freeze
+
+        All = Data.define(:filters) do
+          def match(entry)
+            results = filters.map { |filter| filter.match(entry) }
+            return false if results.include?(false)
+
+            results.include?(nil) ? nil : true
+          end
+        end
+
+        Any = Data.define(:filters) do
+          def match(entry)
+            results = filters.map { |filter| filter.match(entry) }
+            return true if results.include?(true)
+
+            results.include?(nil) ? nil : false
+          end
+        end
+
+        Negated = Data.define(:filter) do
+          def match(entry)
+            result = filter.match(entry)
+
+            result.nil? ? nil : !result
+          end
+        end
+
+        Equal = Data.define(:attribute, :value) do
+          def match(entry)
+            wanted = Filter.comparable(attribute, value)
+
+            entry.values(attribute).any? { |held| Filter.comparable(attribute, held) == wanted }
+          end
+        end
+
+        Present = Data.define(:attribute) do
+          def match(entry)
+            entry.values(attribute).any?
+          end
+        end
+
+        Substrings = Data.define(:attribute, :initial, :middle, :final) do
+          def match(entry)
+            entry.values(attribute).any? { |held| fits?(held.to_s.downcase) }
+          end
+
+          private
+
+            def fits?(held)
+              position = 0
+
+              if initial
+                return false unless held.start_with?(initial.downcase)
+
+                position = initial.length
+              end
+
+              middle.each do |part|
+                found = held.index(part.downcase, position)
+                return false if found.nil?
+
+                position = found + part.length
+              end
+
+              return true unless final
+
+              held.length - final.length >= position && held.end_with?(final.downcase)
+            end
+        end
+
+        Ordered = Data.define(:attribute, :value, :direction) do
+          def match(entry)
+            wanted = value.downcase
+
+            entry.values(attribute).any? do |held|
+              compared = held.to_s.downcase <=> wanted
+              direction == :greater ? compared >= 0 : compared <= 0
+            end
+          end
+        end
+
+        Unknown = Data.define do
+          def match(_entry)
+            nil
+          end
+        end
+
+        module_function
+
+        def from(element, depth = 0)
+          raise Invalid, "a filter nests deeper than #{Ber::DEEPEST}" if depth > Ber::DEEPEST
+
+          case element.tag
+          when AND then All.new(filters: element.children.map { |part| from(part, depth + 1) })
+          when OR then Any.new(filters: element.children.map { |part| from(part, depth + 1) })
+          when NOT then Negated.new(filter: from(element.child(0), depth + 1))
+          when EQUALITY, APPROXIMATE then Equal.new(**assertion(element))
+          when GREATER_OR_EQUAL then Ordered.new(**assertion(element), direction: :greater)
+          when LESS_OR_EQUAL then Ordered.new(**assertion(element), direction: :less)
+          when PRESENT then Present.new(attribute: attribute(element.string))
+          when SUBSTRINGS then substrings(element)
+          when EXTENSIBLE then Unknown.new
+          else raise Invalid, "#{format('%#04x', element.tag)} is not a filter"
+          end
+        rescue Ber::Error => e
+          raise Invalid, e.message
+        end
+
+        def parse(text)
+          filter, rest = parse_at(text.to_s.strip, 0)
+          raise Invalid, "#{text} has more after the filter" unless rest == text.to_s.strip.length
+
+          filter
+        end
+
+        def pinned(filter, attribute)
+          case filter
+          when Equal then filter.value if filter.attribute == attribute
+          when All then filter.filters.lazy.filter_map { |part| pinned(part, attribute) }.first
+          end
+        end
+
+        def comparable(attribute, value)
+          return value.to_s.downcase unless DISTINGUISHED.include?(attribute.to_s.downcase)
+
+          Dn.parse(value).normal
+        rescue Dn::Invalid
+          value.to_s.downcase
+        end
+
+        def attribute(description)
+          description.to_s.split(";").first.to_s.downcase
+        end
+
+        def assertion(element)
+          { attribute: attribute(element.child(0).string), value: utf8(element.child(1).string) }
+        end
+
+        def substrings(element)
+          initial = nil
+          final = nil
+          middle = []
+
+          element.child(1).children.each do |part|
+            case part.tag
+            when INITIAL then initial = utf8(part.string)
+            when ANY then middle << utf8(part.string)
+            when FINAL then final = utf8(part.string)
+            end
+          end
+
+          Substrings.new(attribute: attribute(element.child(0).string), initial: initial, middle: middle, final: final)
+        end
+
+        def utf8(bytes)
+          bytes.dup.force_encoding(Encoding::UTF_8).scrub
+        end
+
+        def parse_at(text, position)
+          raise Invalid, "a filter starts with (" unless text[position] == "("
+
+          position += 1
+
+          case text[position]
+          when "&", "|"
+            kind = text[position]
+            filters = []
+            position += 1
+
+            while text[position] == "("
+              filter, position = parse_at(text, position)
+              filters << filter
+            end
+
+            [ kind == "&" ? All.new(filters: filters) : Any.new(filters: filters), closing(text, position) ]
+          when "!"
+            filter, position = parse_at(text, position + 1)
+
+            [ Negated.new(filter: filter), closing(text, position) ]
+          else
+            finish = text.index(")", position) || raise(Invalid, "a filter never closes")
+            [ simple(text[position...finish]), finish + 1 ]
+          end
+        end
+
+        def closing(text, position)
+          raise Invalid, "a filter never closes" unless text[position] == ")"
+
+          position + 1
+        end
+
+        def simple(item)
+          type, operator, value = item.match(/\A([^=<>~]+)(=|>=|<=|~=)(.*)\z/m)&.captures
+          raise Invalid, "#{item} is not a filter" if type.nil?
+
+          type = attribute(type.strip)
+
+          case operator
+          when ">=" then Ordered.new(attribute: type, value: unescaped(value), direction: :greater)
+          when "<=" then Ordered.new(attribute: type, value: unescaped(value), direction: :less)
+          else
+            return Present.new(attribute: type) if value == "*"
+            return Equal.new(attribute: type, value: unescaped(value)) unless value.include?("*")
+
+            parts = value.split("*", -1).map { |part| unescaped(part) }
+            Substrings.new(attribute: type, initial: parts.first.presence, middle: parts[1..-2].compact_blank,
+                           final: parts.last.presence)
+          end
+        end
+
+        def unescaped(value)
+          value.b.gsub(/\\(\h\h)/n) { ::Regexp.last_match(1).to_i(16).chr }.force_encoding(Encoding::UTF_8).scrub
+        end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/gate.rb

@@ -0,0 +1,169 @@
+module Masks
+  module Server
+    module Ldap
+      class Gate
+        WINDOW = 3.minutes
+        VIA = "ldap".freeze
+
+        Bound = Data.define(:kind, :tenant, :dn, :subject) do
+          def service?
+            kind == :service
+          end
+
+          def person?
+            kind == :person
+          end
+        end
+
+        Outcome = Data.define(:code, :message, :bound)
+
+        def initialize(ip_address:)
+          @ip_address = ip_address
+        end
+
+        def bind(name, password)
+          password = password.to_s
+          return anonymous if name.blank? && password.empty?
+          return refused(Protocol::UNWILLING_TO_PERFORM, "unauthenticated binds are refused") if password.empty?
+          return throttled if failures(ip_key) >= ::Rails.configuration.masks.attempt_limit
+
+          dn = parse(name)
+          tenant = dn && Directory.tenant_for(dn)
+
+          return decoy(password) if tenant.nil?
+
+          Tenant.switch(tenant) { bind_within(tenant, Directory.new(tenant), dn, password) }
+        end
+
+        private
+
+          def anonymous
+            Outcome.new(code: Protocol::SUCCESS, message: "", bound: nil)
+          end
+
+          def parse(name)
+            return Dn.parse(name) if name.include?("=")
+
+            tenant = single_tenant
+            tenant && Directory.new(tenant).people_dn.child(:uid, name.strip)
+          rescue Dn::Invalid
+            nil
+          end
+
+          def single_tenant
+            return Tenant.active.find_by(subdomain: Tenant.pinned) if Tenant.pinned
+
+            held = Tenant.active.limit(2).to_a
+            held.first if held.one?
+          end
+
+          def bind_within(tenant, directory, dn, password)
+            if dn.parent == directory.services_dn && dn.first_type == "cn"
+              service(tenant, directory, dn, password)
+            elsif dn.parent == directory.people_dn && dn.first_type == "uid"
+              person(tenant, directory, dn.first_value, password)
+            else
+              decoy(password)
+            end
+          end
+
+          def service(tenant, directory, dn, password)
+            credential = LdapCredential.check(dn.first_value, password)
+
+            if credential.nil?
+              failed!(ip_key)
+              Event.record!(Event::LOGIN_REFUSED, by: nil, factor: "ldap_service", identifier: dn.first_value, via: VIA)
+              return invalid
+            end
+
+            credential.used!
+
+            Outcome.new(
+              code: Protocol::SUCCESS, message: "",
+              bound: Bound.new(kind: :service, tenant: tenant, dn: directory.service_dn(credential.label), subject: credential.id)
+            )
+          end
+
+          def person(tenant, directory, uid, password)
+            account = account_key(tenant, uid)
+
+            if failures(account) >= ::Rails.configuration.masks.account_attempt_limit
+              Event.record!(Event::LOGIN_THROTTLED, actor: Actor.locate(uid), by: nil, identifier: uid, via: VIA)
+              return throttled
+            end
+
+            actor = Actor.authenticate(uid, password)
+
+            if actor.nil?
+              failed!(ip_key, account)
+              return refuse(uid, "password")
+            end
+
+            reason = obstacle(tenant, actor)
+            return refuse(uid, reason, actor) if reason
+
+            actor.active!
+            dn = directory.person_dn(actor)
+            Event.record!(Event::LDAP_BOUND, actor: actor, dn: dn.to_s)
+
+            Outcome.new(code: Protocol::SUCCESS, message: "", bound: Bound.new(kind: :person, tenant: tenant, dn: dn, subject: actor.id))
+          end
+
+          def obstacle(tenant, actor)
+            return "suspended" if actor.suspended?
+            return "pending_approval" if actor.pending_approval_at.present?
+
+            policy = SignInPolicy.for(tenant: tenant)
+            return "factor-not-offered" unless policy.first_factor?(:password)
+            return nil if tenant.ldap_password_only?
+
+            "second_factor" if second_factor?(policy, actor)
+          end
+
+          def second_factor?(policy, actor)
+            policy.second_factor_required || policy.apps_require_second_factor ||
+              actor.second_factor? || actor.email_factor? || actor.phone_factor?
+          end
+
+          def refuse(uid, factor, actor = nil)
+            Event.record!(Event::LOGIN_REFUSED, actor: actor || Actor.locate(uid), by: nil, factor: factor, identifier: uid, via: VIA)
+            invalid
+          end
+
+          def decoy(password)
+            BCrypt::Password.new(Actor.decoy_digest) == password
+            failed!(ip_key)
+            invalid
+          end
+
+          def invalid
+            refused(Protocol::INVALID_CREDENTIALS, "invalid credentials")
+          end
+
+          def throttled
+            refused(Protocol::UNWILLING_TO_PERFORM, "too many attempts; wait a few minutes")
+          end
+
+          def refused(code, message)
+            Outcome.new(code: code, message: message, bound: nil)
+          end
+
+          def ip_key
+            "ldap-attempts:ip:#{@ip_address}"
+          end
+
+          def account_key(tenant, uid)
+            "ldap-attempts:#{tenant.id}:#{Digest::SHA256.hexdigest(uid.to_s.strip.downcase)}"
+          end
+
+          def failures(key)
+            ::Rails.cache.read(key).to_i
+          end
+
+          def failed!(*keys)
+            keys.each { |key| ::Rails.cache.increment(key, 1, expires_in: WINDOW) }
+          end
+      end
+    end
+  end
+end