mirror of
https://github.com/Li4n0/revsuit.git
synced 2026-09-26 00:21:54 +08:00
feat(ldap): add ldap protocol support (#50)
Co-authored-by: tardc <[email protected]> Co-authored-by: E99p1ant <[email protected]>
This commit is contained in:
Li4n0
@@ -0,0 +1,6 @@
|
||||
package ldap
|
||||
|
||||
type Config struct {
|
||||
Enable bool
|
||||
Addr string
|
||||
}
|
||||
@@ -0,0 +1,197 @@
|
||||
package ldap
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"net"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/ipinfo"
|
||||
"github.com/li4n0/revsuit/internal/recycler"
|
||||
"github.com/pkg/errors"
|
||||
log "unknwon.dev/clog/v2"
|
||||
)
|
||||
|
||||
type Server struct {
|
||||
Config
|
||||
rules []*Rule
|
||||
rulesLock sync.RWMutex
|
||||
livingLock sync.Mutex
|
||||
}
|
||||
|
||||
var (
|
||||
server *Server
|
||||
once sync.Once
|
||||
)
|
||||
|
||||
func GetServer() *Server {
|
||||
once.Do(func() {
|
||||
server = &Server{rulesLock: sync.RWMutex{}, livingLock: sync.Mutex{}}
|
||||
})
|
||||
return server
|
||||
}
|
||||
|
||||
func (s *Server) getRules() []*Rule {
|
||||
defer s.rulesLock.RUnlock()
|
||||
s.rulesLock.RLock()
|
||||
return s.rules
|
||||
}
|
||||
|
||||
func (s *Server) UpdateRules() error {
|
||||
db := database.DB.Model(new(Rule))
|
||||
defer s.rulesLock.Unlock()
|
||||
s.rulesLock.Lock()
|
||||
return errors.Wrap(db.Order("base_rank desc").Find(&s.rules).Error, "LDAP update rules error")
|
||||
}
|
||||
|
||||
func (s *Server) handleConnection(conn net.Conn) {
|
||||
defer func() {
|
||||
_ = conn.Close()
|
||||
if err := recover(); err != nil {
|
||||
recycler.Recycle(err)
|
||||
}
|
||||
}()
|
||||
|
||||
if err := conn.SetDeadline(time.Now().Add(time.Second * 30)); err != nil {
|
||||
log.Warn("LDAP set connection deadline error:%v", err)
|
||||
return
|
||||
}
|
||||
|
||||
ip, _, _ := net.SplitHostPort(conn.RemoteAddr().String())
|
||||
|
||||
buf := make([]byte, 1024)
|
||||
_, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
log.Warn("LDAP read connection error:%v", err)
|
||||
return
|
||||
}
|
||||
|
||||
if !bytes.Contains(buf, []byte{
|
||||
0x30, 0x0c, 0x02, 0x01, 0x01, 0x60, 0x07,
|
||||
0x02, 0x01, 0x03, 0x04, 0x00, 0x80, 0x00}) {
|
||||
return
|
||||
}
|
||||
|
||||
send := []byte{
|
||||
0x30, 0x0c, 0x02, 0x01, 0x01, 0x61, 0x07,
|
||||
0x0a, 0x01, 0x00, 0x04, 0x00, 0x04, 0x00,
|
||||
}
|
||||
_, err = conn.Write(send)
|
||||
if err != nil {
|
||||
log.Warn("LDAP write connection error: %v", err)
|
||||
return
|
||||
}
|
||||
_, err = conn.Read(buf)
|
||||
if err != nil {
|
||||
log.Warn("LDAP read connection error:%v", err)
|
||||
return
|
||||
}
|
||||
|
||||
length := buf[8]
|
||||
pathBytes := bytes.Buffer{}
|
||||
for i := 1; i <= int(length); i++ {
|
||||
temp := []byte{buf[8+i]}
|
||||
pathBytes.Write(temp)
|
||||
}
|
||||
path := pathBytes.String()
|
||||
|
||||
for _, _rule := range s.getRules() {
|
||||
flag, flagGroup, _ := _rule.Match(path)
|
||||
if flag == "" {
|
||||
continue
|
||||
}
|
||||
|
||||
area := ipinfo.Area(ip)
|
||||
|
||||
// create new record
|
||||
r, err := NewRecord(_rule, flag, path, ip, area)
|
||||
if err != nil {
|
||||
log.Warn("LDAP record[rule_id:%d] created failed :%s", _rule.ID, err)
|
||||
return
|
||||
}
|
||||
log.Info("LDAP record[id:%d rule:%s remote_ip:%s] has been created", r.ID, _rule.Name, ip)
|
||||
|
||||
//only send to client when this connection recorded first time.
|
||||
if _rule.PushToClient {
|
||||
if flagGroup != "" {
|
||||
var count int64
|
||||
database.DB.Where("rule_name=? and path like ?", _rule.Name, "%"+flagGroup+"%").Model(&Record{}).Count(&count)
|
||||
if count <= 1 {
|
||||
r.PushToClient()
|
||||
log.Trace("LDAP record[id:%d, flagGroup:%s] has been put to client message queue", r.ID, flagGroup)
|
||||
}
|
||||
} else {
|
||||
r.PushToClient()
|
||||
log.Trace("LDAP record[id:%d, flag:%s] has been put to client message queue", r.ID, flag)
|
||||
}
|
||||
}
|
||||
|
||||
//send notice
|
||||
if _rule.Notice {
|
||||
go func() {
|
||||
r.Notice()
|
||||
log.Trace("LDAP record[id:%d] notice has been sent", r.ID)
|
||||
}()
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
func (s *Server) Stop() {
|
||||
log.Info("LDAP Server is stopping...")
|
||||
s.Enable = false
|
||||
s.livingLock.Unlock()
|
||||
}
|
||||
|
||||
func (s *Server) Restart() {
|
||||
s.Stop()
|
||||
time.Sleep(time.Second * 2)
|
||||
go s.Run()
|
||||
}
|
||||
|
||||
func (s *Server) Run() {
|
||||
s.Enable = true
|
||||
s.livingLock.Lock()
|
||||
defer func() {
|
||||
if s.Enable {
|
||||
log.Error("LDAP Server exited unexpectedly")
|
||||
}
|
||||
s.Enable = false
|
||||
s.livingLock.Unlock()
|
||||
}()
|
||||
|
||||
if err := s.UpdateRules(); err != nil {
|
||||
log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
// run server
|
||||
log.Info("Starting LDAP Server at %v", s.Addr)
|
||||
|
||||
listener, err := net.Listen("tcp", s.Addr)
|
||||
if err != nil {
|
||||
log.Error(err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
go func() {
|
||||
s.livingLock.Lock()
|
||||
if !s.Enable {
|
||||
_ = listener.Close()
|
||||
}
|
||||
}()
|
||||
|
||||
for {
|
||||
tcpConn, err := listener.Accept()
|
||||
if err != nil {
|
||||
if !errors.Is(err, net.ErrClosed) {
|
||||
log.Warn("LDAP accept connection error: %v", err)
|
||||
} else {
|
||||
break
|
||||
}
|
||||
continue
|
||||
}
|
||||
go s.handleConnection(tcpConn)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,139 @@
|
||||
package ldap
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/notice"
|
||||
"github.com/li4n0/revsuit/internal/record"
|
||||
"gorm.io/gorm"
|
||||
log "unknwon.dev/clog/v2"
|
||||
)
|
||||
|
||||
var _ record.Record = (*Record)(nil)
|
||||
|
||||
type Record struct {
|
||||
Path string `form:"path" json:"path"`
|
||||
record.BaseRecord
|
||||
Rule Rule `gorm:"foreignKey:RuleName;references:Name;constraint:OnUpdate:CASCADE,OnDelete:SET NULL;" form:"-" json:"-" notice:"-"`
|
||||
}
|
||||
|
||||
func (Record) TableName() string {
|
||||
return "ldap_records"
|
||||
}
|
||||
|
||||
func (r Record) Notice() {
|
||||
notice.Notice(r)
|
||||
}
|
||||
|
||||
func NewRecord(rule *Rule, flag, path, ip, area string) (r *Record, err error) {
|
||||
r = &Record{
|
||||
BaseRecord: record.BaseRecord{
|
||||
Flag: flag,
|
||||
RemoteIP: ip,
|
||||
IpArea: area,
|
||||
RequestTime: time.Now(),
|
||||
},
|
||||
Path: path,
|
||||
Rule: *rule,
|
||||
}
|
||||
return r, database.DB.Create(r).Error
|
||||
}
|
||||
|
||||
func Records(c *gin.Context) {
|
||||
var (
|
||||
ldapRecord Record
|
||||
res []Record
|
||||
count int64
|
||||
order = c.Query("order")
|
||||
pageSize = 10
|
||||
)
|
||||
|
||||
if c.Query("pageSize") != "" {
|
||||
if n, err := strconv.Atoi(c.Query("pageSize")); err == nil {
|
||||
if n > 0 && n < 100 {
|
||||
pageSize = n
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if err := c.ShouldBind(&ldapRecord); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
db := database.DB.Model(&ldapRecord)
|
||||
if ldapRecord.Flag != "" {
|
||||
db.Where("flag = ?", ldapRecord.Flag)
|
||||
}
|
||||
if ldapRecord.Path != "" {
|
||||
db.Where("path like ?", "%"+ldapRecord.Path+"%")
|
||||
}
|
||||
if ldapRecord.RemoteIP != "" {
|
||||
db.Where("remote_ip = ?", ldapRecord.RemoteIP)
|
||||
}
|
||||
if ldapRecord.RuleName != "" {
|
||||
db.Where("rule_name = ?", ldapRecord.RuleName)
|
||||
}
|
||||
|
||||
//Delete records
|
||||
if c.Request.Method == http.MethodDelete {
|
||||
if err := db.Session(&gorm.Session{AllowGlobalUpdate: true}).Delete(&res).Error; err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if database.Driver == database.Sqlite {
|
||||
db.Exec("VACUUM")
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
})
|
||||
|
||||
log.Info("%d ldap records deleted by %s", db.RowsAffected, c.Request.RemoteAddr)
|
||||
return
|
||||
}
|
||||
|
||||
//List records
|
||||
page, err := strconv.Atoi(c.Query("page"))
|
||||
if err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if order != "asc" {
|
||||
order = "desc"
|
||||
}
|
||||
|
||||
if err := db.Order("id" + " " + order).Count(&count).Offset((page - 1) * pageSize).Limit(pageSize).Find(&res).Error; err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": gin.H{"count": count, "data": res},
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
package ldap
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/li4n0/revsuit/internal/database"
|
||||
"github.com/li4n0/revsuit/internal/rule"
|
||||
"gorm.io/gorm/clause"
|
||||
log "unknwon.dev/clog/v2"
|
||||
)
|
||||
|
||||
// Rule LDAP rule struct
|
||||
type Rule struct {
|
||||
rule.BaseRule `yaml:",inline"`
|
||||
}
|
||||
|
||||
func (Rule) TableName() string {
|
||||
return "ldap_rules"
|
||||
}
|
||||
|
||||
// NewRule new ldap rule struct
|
||||
func NewRule(name, flagFormat string, pushToClient, notice bool) *Rule {
|
||||
return &Rule{
|
||||
BaseRule: rule.BaseRule{
|
||||
Name: name,
|
||||
FlagFormat: flagFormat,
|
||||
PushToClient: pushToClient,
|
||||
Notice: notice,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
// CreateOrUpdate creates or updates the ldap rule in database and ruleSet
|
||||
func (r *Rule) CreateOrUpdate() (err error) {
|
||||
db := database.DB.Model(r)
|
||||
err = db.Clauses(clause.OnConflict{
|
||||
Columns: []clause.Column{{Name: "id"}},
|
||||
DoUpdates: clause.AssignmentColumns(
|
||||
[]string{
|
||||
"name",
|
||||
"flag_format",
|
||||
"base_rank",
|
||||
"push_to_client",
|
||||
"notice",
|
||||
}),
|
||||
}).Create(r).Error
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
err = GetServer().UpdateRules()
|
||||
return err
|
||||
}
|
||||
|
||||
// Delete deletes the ldap rule in database and ruleSet
|
||||
func (r *Rule) Delete() (err error) {
|
||||
db := database.DB.Model(r)
|
||||
err = db.Delete(r).Error
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
|
||||
err = GetServer().UpdateRules()
|
||||
return err
|
||||
}
|
||||
|
||||
// ListRules lists all ldap rules those satisfy the filter
|
||||
func ListRules(c *gin.Context) {
|
||||
var (
|
||||
ldapRule Rule
|
||||
res []Rule
|
||||
count int64
|
||||
order = c.Query("order")
|
||||
pageSize = 10
|
||||
)
|
||||
|
||||
if c.Query("pageSize") != "" {
|
||||
if n, err := strconv.Atoi(c.Query("pageSize")); err == nil {
|
||||
if n > 0 && n < 100 {
|
||||
pageSize = n
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if err := c.ShouldBind(&ldapRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
db := database.DB.Model(&ldapRule)
|
||||
db.Where(&ldapRule).Count(&count)
|
||||
|
||||
page, err := strconv.Atoi(c.Query("page"))
|
||||
if err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if order != "asc" {
|
||||
order = "desc"
|
||||
}
|
||||
|
||||
if err := db.Order("base_rank desc").Order("id" + " " + order).Count(&count).Offset((page - 1) * pageSize).Limit(pageSize).Find(&res).Error; err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": gin.H{"count": count, "data": res},
|
||||
})
|
||||
}
|
||||
|
||||
// UpsertRules creates or updates ldap rule from user submit
|
||||
func UpsertRules(c *gin.Context) {
|
||||
var ldapRule Rule
|
||||
|
||||
if err := c.ShouldBind(&ldapRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if err := ldapRule.CreateOrUpdate(); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"result": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if ldapRule.ID != 0 {
|
||||
log.Trace("LDAP rule[id:%d] has been updated", ldapRule.ID)
|
||||
} else {
|
||||
log.Trace("LDAP rule[id:%d] has been created", ldapRule.ID)
|
||||
}
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"result": nil,
|
||||
})
|
||||
}
|
||||
|
||||
// DeleteRules deletes ldap rule from user submit
|
||||
func DeleteRules(c *gin.Context) {
|
||||
var ldapRule Rule
|
||||
|
||||
if err := c.ShouldBind(&ldapRule); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
if err := ldapRule.Delete(); err != nil {
|
||||
c.JSON(400, gin.H{
|
||||
"status": "failed",
|
||||
"error": err.Error(),
|
||||
"data": nil,
|
||||
})
|
||||
return
|
||||
}
|
||||
|
||||
log.Trace("LDAP rule[id:%d] has been deleted", ldapRule.ID)
|
||||
|
||||
c.JSON(200, gin.H{
|
||||
"status": "succeed",
|
||||
"error": nil,
|
||||
"data": nil,
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user