From 1a9f501383c78a8bc757fb1a7687bde6a5d73cac Mon Sep 17 00:00:00 2001 From: Shivaram Lingamneni Date: Wed, 23 Sep 2020 02:23:35 -0400 Subject: [PATCH] fix #414 --- irc/accounts.go | 5 +++-- irc/authscript.go | 18 +++++++++++++++--- irc/client.go | 4 +++- irc/gateways.go | 1 + irc/handlers.go | 2 +- irc/nickserv.go | 2 +- irc/utils/crypto.go | 15 ++++++++------- 7 files changed, 32 insertions(+), 15 deletions(-) diff --git a/irc/accounts.go b/irc/accounts.go index 7a408658..fb35c1de 100644 --- a/irc/accounts.go +++ b/irc/accounts.go @@ -5,6 +5,7 @@ package irc import ( "bytes" + "crypto/x509" "encoding/json" "fmt" "sort" @@ -1466,7 +1467,7 @@ func (am *AccountManager) ChannelsForAccount(account string) (channels []string) return unmarshalRegisteredChannels(channelStr) } -func (am *AccountManager) AuthenticateByCertFP(client *Client, certfp, authzid string) (err error) { +func (am *AccountManager) AuthenticateByCertificate(client *Client, certfp string, peerCerts []*x509.Certificate, authzid string) (err error) { if certfp == "" { return errAccountInvalidCredentials } @@ -1495,7 +1496,7 @@ func (am *AccountManager) AuthenticateByCertFP(client *Client, certfp, authzid s if config.Accounts.AuthScript.Enabled { var output AuthScriptOutput output, err = CheckAuthScript(am.server.semaphores.AuthScript, config.Accounts.AuthScript.ScriptConfig, - AuthScriptInput{Certfp: certfp, IP: client.IP().String()}) + AuthScriptInput{Certfp: certfp, IP: client.IP().String(), peerCerts: peerCerts}) if err != nil { am.server.logger.Error("internal", "failed shell auth invocation", err.Error()) } else if output.Success && output.AccountName != "" { diff --git a/irc/authscript.go b/irc/authscript.go index 38083a6e..80e7e304 100644 --- a/irc/authscript.go +++ b/irc/authscript.go @@ -4,7 +4,9 @@ package irc import ( + "crypto/x509" "encoding/json" + "encoding/pem" "fmt" "net" @@ -13,9 +15,11 @@ import ( // JSON-serializable input and output types for the script type AuthScriptInput struct { - AccountName string `json:"accountName,omitempty"` - Passphrase string `json:"passphrase,omitempty"` - Certfp string `json:"certfp,omitempty"` + AccountName string `json:"accountName,omitempty"` + Passphrase string `json:"passphrase,omitempty"` + Certfp string `json:"certfp,omitempty"` + PeerCerts []string `json:"peerCerts,omitempty"` + peerCerts []*x509.Certificate IP string `json:"ip,omitempty"` } @@ -31,6 +35,14 @@ func CheckAuthScript(sem utils.Semaphore, config ScriptConfig, input AuthScriptI defer sem.Release() } + // PEM-encode the peer certificates before applying JSON + if len(input.peerCerts) != 0 { + input.PeerCerts = make([]string, len(input.peerCerts)) + for i, cert := range input.peerCerts { + input.PeerCerts[i] = string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})) + } + } + inputBytes, err := json.Marshal(input) if err != nil { return diff --git a/irc/client.go b/irc/client.go index 70e6628d..da4829e5 100644 --- a/irc/client.go +++ b/irc/client.go @@ -6,6 +6,7 @@ package irc import ( + "crypto/x509" "fmt" "net" "runtime/debug" @@ -163,6 +164,7 @@ type Session struct { destroyed uint32 certfp string + peerCerts []*x509.Certificate sasl saslStatus passStatus serverPassStatus @@ -384,7 +386,7 @@ func (server *Server) RunClient(conn IRCConn) { if wConn.Config.TLSConfig != nil { // error is not useful to us here anyways so we can ignore it - session.certfp, _ = utils.GetCertFP(wConn.Conn, RegisterTimeout) + session.certfp, session.peerCerts, _ = utils.GetCertFP(wConn.Conn, RegisterTimeout) } if session.isTor { diff --git a/irc/gateways.go b/irc/gateways.go index 0acbe5e7..841adf60 100644 --- a/irc/gateways.go +++ b/irc/gateways.go @@ -99,6 +99,7 @@ func (client *Client) ApplyProxiedIP(session *Session, proxiedIP net.IP, tls boo // nickmask will be updated when the client completes registration // set tls info session.certfp = "" + session.peerCerts = nil client.SetMode(modes.TLS, tls) return nil, "" diff --git a/irc/handlers.go b/irc/handlers.go index 585c2387..bd81da88 100644 --- a/irc/handlers.go +++ b/irc/handlers.go @@ -303,7 +303,7 @@ func authExternalHandler(server *Server, client *Client, mechanism string, value rb.session.deviceID = deviceID } } - err = server.accounts.AuthenticateByCertFP(client, rb.session.certfp, authzid) + err = server.accounts.AuthenticateByCertificate(client, rb.session.certfp, rb.session.peerCerts, authzid) } if err != nil { diff --git a/irc/nickserv.go b/irc/nickserv.go index e7d49a15..6e97c702 100644 --- a/irc/nickserv.go +++ b/irc/nickserv.go @@ -721,7 +721,7 @@ func nsIdentifyHandler(server *Server, client *Client, command string, params [] // try certfp if !loginSuccessful && rb.session.certfp != "" { - err = server.accounts.AuthenticateByCertFP(client, rb.session.certfp, "") + err = server.accounts.AuthenticateByCertificate(client, rb.session.certfp, rb.session.peerCerts, "") loginSuccessful = (err == nil) } diff --git a/irc/utils/crypto.go b/irc/utils/crypto.go index 624d1488..fe4a389c 100644 --- a/irc/utils/crypto.go +++ b/irc/utils/crypto.go @@ -8,6 +8,7 @@ import ( "crypto/sha256" "crypto/subtle" "crypto/tls" + "crypto/x509" "encoding/base32" "encoding/base64" "encoding/hex" @@ -92,10 +93,10 @@ func NormalizeCertfp(certfp string) (result string, err error) { return } -func GetCertFP(conn net.Conn, handshakeTimeout time.Duration) (result string, err error) { +func GetCertFP(conn net.Conn, handshakeTimeout time.Duration) (fingerprint string, peerCerts []*x509.Certificate, err error) { tlsConn, isTLS := conn.(*tls.Conn) if !isTLS { - return "", ErrNotTLS + return "", nil, ErrNotTLS } // ensure handshake is performed @@ -104,16 +105,16 @@ func GetCertFP(conn net.Conn, handshakeTimeout time.Duration) (result string, er tlsConn.SetDeadline(time.Time{}) if err != nil { - return "", err + return "", nil, err } - peerCerts := tlsConn.ConnectionState().PeerCertificates + peerCerts = tlsConn.ConnectionState().PeerCertificates if len(peerCerts) < 1 { - return "", ErrNoPeerCerts + return "", nil, ErrNoPeerCerts } rawCert := sha256.Sum256(peerCerts[0].Raw) - fingerprint := hex.EncodeToString(rawCert[:]) + fingerprint = hex.EncodeToString(rawCert[:]) - return fingerprint, nil + return fingerprint, peerCerts, nil }