masks-server 0.7.0

data/app/ldap/masks/server/ldap/listener.rb

@@ -0,0 +1,113 @@
+module Masks
+  module Server
+    module Ldap
+      class Listener
+        MOST_CONNECTIONS = 256
+        IDLE = 5.minutes
+        HANDSHAKE = 10.seconds
+
+        attr_reader :port
+
+        class << self
+          def from_configuration(config = ::Rails.configuration.masks)
+            new(host: "0.0.0.0", port: config.ldap_port, tls: tls(config.ldap_cert, config.ldap_key))
+          end
+
+          def tls(cert, key)
+            return nil if cert.blank? && key.blank?
+            raise "MASKS_LDAP_CERT and MASKS_LDAP_KEY are set together or not at all" if cert.blank? || key.blank?
+
+            context = OpenSSL::SSL::SSLContext.new
+            chain = File.read(cert).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m)
+            context.cert = OpenSSL::X509::Certificate.new(chain.first)
+            context.extra_chain_cert = chain.drop(1).map { |one| OpenSSL::X509::Certificate.new(one) }
+            context.key = OpenSSL::PKey.read(File.read(key))
+            context.min_version = OpenSSL::SSL::TLS1_2_VERSION
+            context
+          end
+        end
+
+        def initialize(host:, port:, tls: nil, logger: ::Rails.logger, idle: IDLE)
+          @host = host
+          @wanted_port = port
+          @tls = tls
+          @logger = logger
+          @idle = idle
+          @open = Concurrent::AtomicFixnum.new(0)
+          @threads = Concurrent::Set.new
+        end
+
+        def start
+          @server = TCPServer.new(@host, @wanted_port)
+          @port = @server.local_address.ip_port
+          @logger.info("masks ldap: listening on #{@host}:#{@port}#{' with TLS' if @tls}")
+          @acceptor = Thread.new { accept_loop }
+          self
+        end
+
+        def stop
+          @server&.close
+          @acceptor&.join(1)
+          @threads.each(&:kill)
+        rescue IOError
+          nil
+        end
+
+        private
+
+          def accept_loop
+            loop do
+              socket = @server.accept
+              next refuse(socket) if @open.value >= MOST_CONNECTIONS
+
+              @open.increment
+              thread = Thread.new(socket) { |held| serve(held) }
+              @threads << thread
+            end
+          rescue IOError, Errno::EBADF
+            nil
+          end
+
+          def refuse(socket)
+            socket.write(Protocol.disconnection(Protocol::BUSY, "too many connections"))
+          rescue IOError, SystemCallError
+            nil
+          ensure
+            socket.close
+          end
+
+          def serve(socket)
+            socket.timeout = @idle
+            return unless offered?
+
+            ip_address = socket.remote_address.ip_address
+            stream = @tls ? secured(socket) : socket
+
+            Connection.new(stream, ip_address: ip_address, logger: @logger).run if stream
+          rescue StandardError => e
+            @logger.error("masks ldap: #{e.class}: #{e.message}")
+          ensure
+            stream&.close unless stream.equal?(socket)
+            socket.close unless socket.closed?
+            @open.decrement
+            @threads.delete(Thread.current)
+          end
+
+          def offered?
+            ::Rails.application.executor.wrap { Tenant.ldap.exists? }
+          end
+
+          def secured(socket)
+            stream = OpenSSL::SSL::SSLSocket.new(socket, @tls)
+            stream.sync_close = true
+            socket.timeout = HANDSHAKE
+            stream.accept
+            socket.timeout = @idle
+            stream
+          rescue OpenSSL::SSL::SSLError, IOError, SystemCallError
+            nil
+          end
+      end
+    end
+  end
+end

data/app/ldap/masks/server/ldap/protocol.rb

@@ -0,0 +1,174 @@
+module Masks
+  module Server
+    module Ldap
+      module Protocol
+        class Invalid < StandardError; end
+
+        BIND_REQUEST = 0x60
+        BIND_RESPONSE = 0x61
+        UNBIND_REQUEST = 0x42
+        SEARCH_REQUEST = 0x63
+        SEARCH_RESULT_ENTRY = 0x64
+        SEARCH_RESULT_DONE = 0x65
+        MODIFY_REQUEST = 0x66
+        ADD_REQUEST = 0x68
+        DELETE_REQUEST = 0x4a
+        MODIFY_DN_REQUEST = 0x6c
+        COMPARE_REQUEST = 0x6e
+        ABANDON_REQUEST = 0x50
+        EXTENDED_REQUEST = 0x77
+        EXTENDED_RESPONSE = 0x78
+
+        SIMPLE = 0x80
+        CONTROLS = 0xa0
+        RESPONSE_NAME = 0x8a
+
+        ANSWERS = {
+          MODIFY_REQUEST => 0x67,
+          ADD_REQUEST => 0x69,
+          DELETE_REQUEST => 0x6b,
+          MODIFY_DN_REQUEST => 0x6d,
+          COMPARE_REQUEST => 0x6f,
+          EXTENDED_REQUEST => EXTENDED_RESPONSE
+        }.freeze
+
+        DISCONNECTION = "1.3.6.1.4.1.1466.20036".freeze
+        WHO_AM_I = "1.3.6.1.4.1.4203.1.11.3".freeze
+        REQUEST_NAME = 0x80
+        RESPONSE_VALUE = 0x8b
+
+        SUCCESS = 0
+        OPERATIONS_ERROR = 1
+        PROTOCOL_ERROR = 2
+        SIZE_LIMIT_EXCEEDED = 4
+        AUTH_METHOD_NOT_SUPPORTED = 7
+        NO_SUCH_OBJECT = 32
+        INVALID_DN_SYNTAX = 34
+        INVALID_CREDENTIALS = 49
+        INSUFFICIENT_ACCESS_RIGHTS = 50
+        BUSY = 51
+        UNAVAILABLE = 52
+        UNWILLING_TO_PERFORM = 53
+        OTHER = 80
+
+        Message = Data.define(:id, :operation)
+        Bind = Data.define(:version, :name, :password, :simple)
+        Search = Data.define(:base, :scope, :size_limit, :types_only, :filter, :attributes)
+        Unbind = Data.define
+        Abandon = Data.define
+        WhoAmI = Data.define
+        Unsupported = Data.define(:tag)
+
+        module_function
+
+        def message(element)
+          raise Invalid, "a message is a sequence" unless element.tag == Ber::SEQUENCE
+
+          id = element.child(0, Ber::INTEGER).integer
+          raise Invalid, "message ID #{id} is out of range" unless (0..(2**31 - 1)).cover?(id)
+
+          Message.new(id: id, operation: operation(element.child(1)))
+        rescue Ber::Error, Filter::Invalid => e
+          raise Invalid, e.message
+        end
+
+        def operation(element)
+          case element.tag
+          when BIND_REQUEST then bind(element)
+          when SEARCH_REQUEST then search(element)
+          when UNBIND_REQUEST then Unbind.new
+          when ABANDON_REQUEST then Abandon.new
+          when EXTENDED_REQUEST then extended(element)
+          else Unsupported.new(tag: element.tag)
+          end
+        end
+
+        def extended(element)
+          name = element.children.find { |part| part.tag == REQUEST_NAME }&.string
+
+          name == WHO_AM_I ? WhoAmI.new : Unsupported.new(tag: EXTENDED_REQUEST)
+        end
+
+        def who_am_i(id, identity)
+          envelope(id, result(EXTENDED_RESPONSE, SUCCESS, extra: [ Ber.octets(identity, RESPONSE_VALUE) ]))
+        end
+
+        def bind(element)
+          authentication = element.child(2)
+
+          Bind.new(
+            version: element.child(0, Ber::INTEGER).integer,
+            name: text(element.child(1, Ber::OCTET_STRING).string),
+            password: authentication.tag == SIMPLE ? authentication.string.dup.force_encoding(Encoding::UTF_8) : nil,
+            simple: authentication.tag == SIMPLE
+          )
+        end
+
+        def search(element)
+          scope = element.child(1, Ber::ENUMERATED).integer
+          raise Invalid, "scope #{scope} is not base, one, or subtree" unless Directory::SCOPES.include?(scope)
+
+          Search.new(
+            base: text(element.child(0, Ber::OCTET_STRING).string),
+            scope: scope,
+            size_limit: element.child(3, Ber::INTEGER).integer,
+            types_only: element.child(5, Ber::BOOLEAN).boolean,
+            filter: Filter.from(element.child(6)),
+            attributes: element.child(7, Ber::SEQUENCE).children.map { |attribute| text(attribute.string) }
+          )
+        end
+
+        def text(bytes)
+          decoded = bytes.dup.force_encoding(Encoding::UTF_8)
+          raise Invalid, "a string is not UTF-8" unless decoded.valid_encoding?
+
+          decoded
+        end
+
+        def result(tag, code, message: "", matched: "", extra: [])
+          Ber.sequence(
+            [ Ber.enumerated(code), Ber.octets(matched.to_s), Ber.octets(message.to_s), *extra ],
+            tag
+          )
+        end
+
+        def envelope(id, operation)
+          Ber.sequence([ Ber.integer(id), operation ])
+        end
+
+        def bind_response(id, code, message = "")
+          envelope(id, result(BIND_RESPONSE, code, message: message))
+        end
+
+        def search_done(id, code, message = "", matched: "")
+          envelope(id, result(SEARCH_RESULT_DONE, code, message: message, matched: matched))
+        end
+
+        def search_entry(id, dn, attributes, types_only: false)
+          envelope(
+            id,
+            Ber.sequence(
+              [
+                Ber.octets(dn.to_s),
+                Ber.sequence(
+                  attributes.map do |name, values|
+                    Ber.sequence([ Ber.octets(name), Ber.set(types_only ? [] : values.map { |value| Ber.octets(value) }) ])
+                  end
+                )
+              ],
+              SEARCH_RESULT_ENTRY
+            )
+          )
+        end
+
+        def refusal(id, tag, message)
+          envelope(id, result(ANSWERS.fetch(tag), UNWILLING_TO_PERFORM, message: message))
+        end
+
+        def disconnection(code, message)
+          envelope(0, result(EXTENDED_RESPONSE, code, message: message, extra: [ Ber.octets(DISCONNECTION, RESPONSE_NAME) ]))
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_state.rb

@@ -0,0 +1,153 @@
+module Masks
+  module Server
+    class LoginState
+      class PromptRequired < StandardError
+        attr_reader :prompt
+
+        def initialize(prompt)
+          super(prompt.to_s)
+
+          @prompt = prompt.to_s
+        end
+      end
+
+      class Refused < StandardError
+        attr_reader :error, :description
+
+        def initialize(error, description)
+          super("#{error}: #{description}")
+
+          @error = error.to_s
+          @description = description.to_s
+        end
+      end
+
+      class << self
+        def key
+          name.demodulize.underscore.dasherize
+        end
+
+        def prompts(name, &condition)
+          declared_prompts << [ name.to_s, condition ]
+          self
+        end
+
+        def handles(*names, limit: nil, &handler)
+          names.each do |name|
+            declared_events << [ name.to_s, handler ]
+            declared_limits[name.to_s] = limit if limit
+          end
+
+          self
+        end
+
+        def accepts(*names)
+          declared_updates.concat(names.map(&:to_sym))
+          self
+        end
+
+        def declared_prompts
+          @declared_prompts ||= inherited_from(:declared_prompts)
+        end
+
+        def declared_events
+          @declared_events ||= inherited_from(:declared_events)
+        end
+
+        def declared_updates
+          @declared_updates ||= inherited_from(:declared_updates)
+        end
+
+        def declared_limits
+          @declared_limits ||= {}
+        end
+
+        private
+
+          def inherited_from(name)
+            superclass.respond_to?(name) ? superclass.public_send(name).dup : []
+          end
+      end
+
+      attr_reader :login
+
+      delegate :actor, :client, :identifier, :warn!, :touched?, :factored!, :expire!,
+               :updates, :tenant, :request, :session, :device, :remembered?, :remember!, to: :login
+
+      def initialize(login)
+        @login = login
+      end
+
+      def key
+        self.class.key
+      end
+
+      def enabled?
+        true
+      end
+
+      def as_json
+        {}
+      end
+
+      def reload!
+      end
+
+      def cleanup!
+      end
+
+      def start_over!
+      end
+
+      def event!(name)
+        return unless enabled?
+
+        self.class.declared_events.each do |event, handler|
+          instance_exec(&handler) if event == name
+        end
+      end
+
+      def factor!
+        return unless enabled?
+
+        self.class.declared_prompts.each do |prompt, condition|
+          prompt!(prompt) if instance_exec(&condition)
+        end
+      end
+
+      def update(name)
+        updates[name.to_s] if self.class.declared_updates.include?(name.to_sym)
+      end
+
+      SECOND_FACTOR_EXPIRY = 12.hours
+
+      def remembering?
+        device.present? && ActiveModel::Type::Boolean.new.cast(update(:remember))
+      end
+
+      def second_factored!(*methods, expiry: SECOND_FACTOR_EXPIRY)
+        factored! :second_factor, expiry: expiry
+        remember! DeviceFactor::SECOND_FACTOR if remembering?
+        login.noted!(*methods, "mfa")
+      end
+
+      def prompt!(name)
+        raise PromptRequired, name
+      end
+
+      def refuse!(error, description)
+        raise Refused.new(error, description)
+      end
+
+      def refused!(factor)
+        Event.record!(
+          Event::LOGIN_REFUSED,
+          actor: actor || (identifier.present? && Actor.locate(identifier)) || nil,
+          by: nil,
+          factor: factor,
+          identifier: identifier.presence
+        )
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/app_access.rb

@@ -0,0 +1,18 @@
+module Masks
+  module Server
+    module LoginStates
+      class AppAccess < LoginState
+        def enabled?
+          actor.present? && client.present? && login.first_factored?
+        end
+
+        def factor!
+          return unless enabled? && !client.admits?(actor)
+
+          refused!("not_admitted")
+          refuse!("access_denied", "#{actor.identifier} is not in a group that may use #{client.name}")
+        end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/backup_code.rb

@@ -0,0 +1,69 @@
+module Masks
+  module Server
+    module LoginStates
+      class BackupCode < LoginState
+        accepts :backup_code
+
+        def enabled?
+          actor&.backup_codes?
+        end
+
+        prompts "backup-code" do
+          login.first_factored? && !login.second_factored? && requested?
+        end
+
+        handles "backup", limit: :verifying do
+          verify
+        end
+
+        handles "use-backup-code" do
+          request!
+          false
+        end
+
+        handles "use-authenticator" do
+          forget!
+          false
+        end
+
+        def verify
+          return warn!("missing-first-factor") unless login.first_factored?
+
+          if actor.verify_backup_code(update(:backup_code))
+            forget!
+            second_factored! "otp"
+
+            Event.record!(
+              Event::BACKUP_CODE_SPENT,
+              actor: actor, remaining: actor.backup_codes_remaining
+            )
+
+            true
+          else
+            refused! "backup_code"
+            warn! "invalid-backup-code"
+            false
+          end
+        end
+
+        def as_json
+          { "backupCodes" => { "remaining" => actor&.backup_codes_remaining } }
+        end
+
+        private
+
+          def requested?
+            login.store["backup_code"].present?
+          end
+
+          def request!
+            login.store["backup_code"] = "1"
+          end
+
+          def forget!
+            login.store.delete("backup_code")
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/code_factor.rb

@@ -0,0 +1,100 @@
+module Masks
+  module Server
+    module LoginStates
+      class CodeFactor < LoginState
+        HELD = "code_factor".freeze
+
+        accepts :factor, :code, :remember
+
+        handles "code:send", limit: :sending do
+          send_code
+        end
+
+        handles "code:verify", limit: :verifying do
+          verify
+        end
+
+        def enabled?
+          actor.present? && held_factors.any?
+        end
+
+        def held_factors
+          CodeFactors::FACTORS.select { |factor| CodeFactors.held?(actor, factor) }
+        end
+
+        def usable_factors(held = held_factors)
+          held.select { |factor| CodeFactors.deliverable?(factor) && !withheld?(factor) }
+        end
+
+        def as_json
+          held = held_factors
+
+          {
+            "codeFactors" => usable_factors(held).to_h { |factor| [ factor, CodeFactors.masked(actor, factor) ] },
+            "codeSent" => sent_json,
+            "codesWithheld" => held.select { |factor| withheld?(factor) }.presence
+          }.compact
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def withheld?(factor)
+            factor == "email" && !login.amr.intersect?(CodeFactors::INDEPENDENT_OF_THE_INBOX)
+          end
+
+          def held
+            stored = login.store[HELD]
+
+            stored.present? && stored["actor_id"] == actor.id ? stored : {}
+          end
+
+          def token
+            return @token if defined?(@token)
+
+            @token = CodeFactors.sent(actor, held["factor"], held["token_id"])
+          end
+
+          def sent_json
+            return nil if token.nil?
+
+            { "factor" => held["factor"], "to" => CodeFactors.masked(actor, held["factor"]),
+              "resendable" => token.resendable? }
+          end
+
+          def send_code
+            return warn!("missing-first-factor") unless login.first_factored?
+
+            factor = update(:factor).to_s
+            return warn!("factor-not-offered") unless usable_factors.include?(factor)
+            return if held["factor"] == factor && token && !token.resendable?
+
+            sent = CodeFactors.send!(actor, factor, journey: Masks::Server::Journey.sign_in(login))
+
+            remove_instance_variable(:@token) if defined?(@token)
+            login.store[HELD] = { "actor_id" => actor.id, "factor" => factor, "token_id" => sent.id }
+          end
+
+          def verify
+            return warn!("missing-first-factor") unless login.first_factored?
+
+            factor = held["factor"]
+            return warn!("confirmation-expired") if token.nil? || !usable_factors.include?(factor)
+
+            if token.verify(update(:code))
+              login.store.delete(HELD)
+              remove_instance_variable(:@token)
+              second_factored! CodeFactors.amr(factor)
+            else
+              remove_instance_variable(:@token)
+              refused! "#{factor}_code"
+              warn! "invalid-code"
+            end
+          end
+      end
+    end
+  end
+end

data/app/logins/masks/server/login_states/configure.rb

@@ -0,0 +1,43 @@
+module Masks
+  module Server
+    module LoginStates
+      class Configure < LoginState
+        HELD = "configuring".freeze
+
+        accepts :called
+
+        handles "setup-configure" do
+          configure
+        end
+
+        prompts "setup-configure" do
+          true
+        end
+
+        def enabled?
+          login.store[HELD].present? && actor.present? && login.first_factored? && actor.second_factor?
+        end
+
+        def as_json
+          { "configure" => { "called" => tenant&.name } }
+        end
+
+        def start_over!
+          login.store.delete(HELD)
+        end
+
+        private
+
+          def configure
+            called = update(:called).to_s.strip
+
+            tenant.name = called if called.present?
+
+            return warn!("invalid-configuration") unless tenant.save
+
+            login.store.delete(HELD)
+          end
+      end
+    end
+  end
+end