From 8a54f506768cc30d018d0a5603da489187775a14 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Wed, 20 Oct 2021 14:17:31 -0400 Subject: [PATCH 01/10] initialized --- auth/auth.go | 66 +++++++++++++++++++++++++++++++++++++++++ auth/google.go | 65 ++++++++++++++++++++++++++++++++++++++++ config/config.go | 66 +++++++++++++++++++++-------------------- go.mod | 1 + servercfg/serverconf.go | 26 ++++++++++++++++ 5 files changed, 192 insertions(+), 32 deletions(-) create mode 100644 auth/auth.go create mode 100644 auth/google.go diff --git a/auth/auth.go b/auth/auth.go new file mode 100644 index 00000000..92728804 --- /dev/null +++ b/auth/auth.go @@ -0,0 +1,66 @@ +package auth + +import ( + "net/http" + + "github.com/gravitl/netmaker/servercfg" + "golang.org/x/oauth2" +) + +// == consts == +const ( + init_provider = "initprovider" + get_user_info = "getuserinfo" + handle_callback = "handlecallback" + handle_login = "handlelogin" + oauth_state_string = "netmaker-oauth-state" + google_provider_name = "google" + azure_ad_provider_name = "azure-ad" + github_provider_name = "github" +) + +var auth_provider *oauth2.Config + +func getCurrentAuthFunctions() map[string]interface{} { + var authInfo = servercfg.GetAuthProviderInfo() + var authProvider = authInfo[0] + switch authProvider { + case google_provider_name: + return google_functions + case azure_ad_provider_name: + return google_functions + case github_provider_name: + return google_functions + default: + return nil + } +} + +// InitializeAuthProvider - initializes the auth provider if any is present +func InitializeAuthProvider() bool { + var functions = getCurrentAuthFunctions() + if functions == nil { + return false + } + var authInfo = servercfg.GetAuthProviderInfo() + functions[init_provider].(func(string, string, string))(servercfg.GetAPIConnString(), authInfo[1], authInfo[2]) + return auth_provider != nil +} + +// HandleAuthCallback - handles oauth callback +func HandleAuthCallback(w http.ResponseWriter, r *http.Request) { + var functions = getCurrentAuthFunctions() + if functions == nil { + return + } + functions[handle_callback].(func(http.ResponseWriter, *http.Request))(w, r) +} + +// HandleAuthLogin - handles oauth login +func HandleAuthLogin(w http.ResponseWriter, r *http.Request) { + var functions = getCurrentAuthFunctions() + if functions == nil { + return + } + functions[handle_login].(func(http.ResponseWriter, *http.Request))(w, r) +} diff --git a/auth/google.go b/auth/google.go new file mode 100644 index 00000000..6bafb3f3 --- /dev/null +++ b/auth/google.go @@ -0,0 +1,65 @@ +package auth + +import ( + "fmt" + "io/ioutil" + "net/http" + + "golang.org/x/oauth2" + "golang.org/x/oauth2/google" +) + +var google_functions = map[string]interface{}{ + init_provider: initGoogle, + get_user_info: getUserInfo, + handle_callback: handleGoogleCallback, + handle_login: handleGoogleLogin, +} + +// == handle google authentication here == + +func initGoogle(redirectURL string, clientID string, clientSecret string) { + auth_provider = &oauth2.Config{ + RedirectURL: redirectURL, + ClientID: clientID, + ClientSecret: clientSecret, + Scopes: []string{"https://www.googleapis.com/auth/userinfo.email"}, + Endpoint: google.Endpoint, + } +} + +func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { + url := auth_provider.AuthCodeURL(oauth_state_string) + http.Redirect(w, r, url, http.StatusTemporaryRedirect) +} + +func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { + + var content, err = getUserInfo(r.FormValue("state"), r.FormValue("code")) + if err != nil { + fmt.Println(err.Error()) + http.Redirect(w, r, "/api/oauth/error", http.StatusTemporaryRedirect) + return + } + fmt.Fprintf(w, "Content: %s\n", content) +} + +func getUserInfo(state string, code string) ([]byte, error) { + if state != oauth_state_string { + return nil, fmt.Errorf("invalid oauth state") + } + token, err := auth_provider.Exchange(oauth2.NoContext, code) + if err != nil { + return nil, fmt.Errorf("code exchange failed: %s", err.Error()) + } + response, err := http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken) + if err != nil { + return nil, fmt.Errorf("failed getting user info: %s", err.Error()) + } + defer response.Body.Close() + contents, err := ioutil.ReadAll(response.Body) + if err != nil { + return nil, fmt.Errorf("failed reading response body: %s", err.Error()) + } + return contents, nil +} diff --git a/config/config.go b/config/config.go index 367bbb83..12c5d91a 100644 --- a/config/config.go +++ b/config/config.go @@ -30,49 +30,51 @@ var Config *EnvironmentConfig // EnvironmentConfig : type EnvironmentConfig struct { Server ServerConfig `yaml:"server"` - SQL SQLConfig `yaml:"sql"` + SQL SQLConfig `yaml:"sql"` } // ServerConfig : type ServerConfig struct { - CoreDNSAddr string `yaml:"corednsaddr"` - APIConnString string `yaml:"apiconn"` - APIHost string `yaml:"apihost"` - APIPort string `yaml:"apiport"` - GRPCConnString string `yaml:"grpcconn"` - GRPCHost string `yaml:"grpchost"` - GRPCPort string `yaml:"grpcport"` - GRPCSecure string `yaml:"grpcsecure"` - MasterKey string `yaml:"masterkey"` - AllowedOrigin string `yaml:"allowedorigin"` - NodeID string `yaml:"nodeid"` - RestBackend string `yaml:"restbackend"` - AgentBackend string `yaml:"agentbackend"` - ClientMode string `yaml:"clientmode"` - DNSMode string `yaml:"dnsmode"` - SplitDNS string `yaml:"splitdns"` - DisableRemoteIPCheck string `yaml:"disableremoteipcheck"` - DisableDefaultNet string `yaml:"disabledefaultnet"` - GRPCSSL string `yaml:"grpcssl"` - Version string `yaml:"version"` - SQLConn string `yaml:"sqlconn"` - Platform string `yaml:"platform"` - Database string `yaml:database` - CheckinInterval string `yaml:checkininterval` - DefaultNodeLimit int32 `yaml:"defaultnodelimit"` - Verbosity int32 `yaml:"verbosity"` + CoreDNSAddr string `yaml:"corednsaddr"` + APIConnString string `yaml:"apiconn"` + APIHost string `yaml:"apihost"` + APIPort string `yaml:"apiport"` + GRPCConnString string `yaml:"grpcconn"` + GRPCHost string `yaml:"grpchost"` + GRPCPort string `yaml:"grpcport"` + GRPCSecure string `yaml:"grpcsecure"` + MasterKey string `yaml:"masterkey"` + AllowedOrigin string `yaml:"allowedorigin"` + NodeID string `yaml:"nodeid"` + RestBackend string `yaml:"restbackend"` + AgentBackend string `yaml:"agentbackend"` + ClientMode string `yaml:"clientmode"` + DNSMode string `yaml:"dnsmode"` + SplitDNS string `yaml:"splitdns"` + DisableRemoteIPCheck string `yaml:"disableremoteipcheck"` + DisableDefaultNet string `yaml:"disabledefaultnet"` + GRPCSSL string `yaml:"grpcssl"` + Version string `yaml:"version"` + SQLConn string `yaml:"sqlconn"` + Platform string `yaml:"platform"` + Database string `yaml:database` + CheckinInterval string `yaml:checkininterval` + DefaultNodeLimit int32 `yaml:"defaultnodelimit"` + Verbosity int32 `yaml:"verbosity"` ServerCheckinInterval int64 `yaml:"servercheckininterval"` + AuthProvider string `yaml:"authprovider"` + ClientID string `yaml:"clientid"` + ClientSecret string `yaml:"clientsecret"` } - // Generic SQL Config type SQLConfig struct { - Host string `yaml:"host"` - Port int32 `yaml:"port"` + Host string `yaml:"host"` + Port int32 `yaml:"port"` Username string `yaml:"username"` Password string `yaml:"password"` - DB string `yaml:"db"` - SSLMode string `yaml:"sslmode"` + DB string `yaml:"db"` + SSLMode string `yaml:"sslmode"` } //reading in the env file diff --git a/go.mod b/go.mod index 00453777..59748f11 100644 --- a/go.mod +++ b/go.mod @@ -17,6 +17,7 @@ require ( github.com/urfave/cli/v2 v2.3.0 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985 // indirect + golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be // indirect golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e // indirect golang.org/x/text v0.3.7-0.20210524175448-3115f89c4b99 // indirect golang.zx2c4.com/wireguard v0.0.0-20210805125648-3957e9b9dd19 // indirect diff --git a/servercfg/serverconf.go b/servercfg/serverconf.go index 29676f23..84327087 100644 --- a/servercfg/serverconf.go +++ b/servercfg/serverconf.go @@ -7,6 +7,7 @@ import ( "net/http" "os" "strconv" + "strings" "github.com/gravitl/netmaker/config" ) @@ -65,6 +66,12 @@ func GetServerConfig() config.ServerConfig { cfg.Database = GetDB() cfg.Platform = GetPlatform() cfg.Version = GetVersion() + + // == auth config == + var authInfo = GetAuthProviderInfo() + cfg.AuthProvider = authInfo[0] + cfg.ClientID = authInfo[1] + cfg.ClientSecret = authInfo[2] return cfg } func GetAPIConnString() string { @@ -398,6 +405,25 @@ func GetServerCheckinInterval() int64 { return t } +// GetAuthProviderInfo = gets the oauth provider info +func GetAuthProviderInfo() []string { + var authProvider = "" + if os.Getenv("AUTH_PROVIDER") != "" && os.Getenv("CLIENT_ID") != "" && os.Getenv("CLIENT_SECRET") != "" { + authProvider = strings.ToLower(os.Getenv("AUTH_PROVIDER")) + if authProvider == "google" || authProvider == "azure-ad" || authProvider == "github" { + return []string{authProvider, os.Getenv("CLIENT_ID"), os.Getenv("CLIENT_SECRET")} + } else { + authProvider = "" + } + } else if config.Config.Server.AuthProvider != "" && config.Config.Server.ClientID != "" && config.Config.Server.ClientSecret != "" { + authProvider = strings.ToLower(config.Config.Server.AuthProvider) + if authProvider == "google" || authProvider == "azure-ad" || authProvider == "github" { + return []string{authProvider, config.Config.Server.ClientID, config.Config.Server.ClientSecret} + } + } + return []string{"", "", ""} +} + // GetMacAddr - get's mac address func getMacAddr() string { ifas, err := net.Interfaces() From 4e4e8b3ab586580ec845c072cbad92e8173c4dc6 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Thu, 21 Oct 2021 15:28:58 -0400 Subject: [PATCH 02/10] began oauth implementation --- auth/auth.go | 31 +++- auth/google.go | 35 +++- config/config.go | 1 + controllers/controller.go | 8 +- controllers/extClientHttpController.go | 15 -- controllers/userHttpController.go | 213 ++----------------------- database/database.go | 4 +- logic/auth.go | 199 +++++++++++++++++++++++ logic/util.go | 16 +- main.go | 37 +++-- servercfg/serverconf.go | 14 +- 11 files changed, 330 insertions(+), 243 deletions(-) create mode 100644 logic/auth.go diff --git a/auth/auth.go b/auth/auth.go index 92728804..b5ca44a0 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -1,6 +1,7 @@ package auth import ( + "encoding/json" "net/http" "github.com/gravitl/netmaker/servercfg" @@ -13,14 +14,20 @@ const ( get_user_info = "getuserinfo" handle_callback = "handlecallback" handle_login = "handlelogin" - oauth_state_string = "netmaker-oauth-state" google_provider_name = "google" azure_ad_provider_name = "azure-ad" github_provider_name = "github" + verify_user = "verifyuser" ) +var oauth_state_string = "netmaker-oauth-state" // should be set randomly each provider login var auth_provider *oauth2.Config +type OauthUser struct { + Email string `json:"email" bson:"email"` + AccessToken string `json:"accesstoken" bson:"accesstoken"` +} + func getCurrentAuthFunctions() map[string]interface{} { var authInfo = servercfg.GetAuthProviderInfo() var authProvider = authInfo[0] @@ -37,14 +44,14 @@ func getCurrentAuthFunctions() map[string]interface{} { } // InitializeAuthProvider - initializes the auth provider if any is present -func InitializeAuthProvider() bool { +func InitializeAuthProvider() string { var functions = getCurrentAuthFunctions() if functions == nil { - return false + return "" } var authInfo = servercfg.GetAuthProviderInfo() - functions[init_provider].(func(string, string, string))(servercfg.GetAPIConnString(), authInfo[1], authInfo[2]) - return auth_provider != nil + functions[init_provider].(func(string, string, string))(servercfg.GetAPIConnString()+"/api/oauth/callback", authInfo[1], authInfo[2]) + return authInfo[0] } // HandleAuthCallback - handles oauth callback @@ -64,3 +71,17 @@ func HandleAuthLogin(w http.ResponseWriter, r *http.Request) { } functions[handle_login].(func(http.ResponseWriter, *http.Request))(w, r) } + +// VerifyUserToken - checks if oauth2 token is valid +func VerifyUserToken(accessToken string) bool { + var token = &oauth2.Token{} + var err = json.Unmarshal([]byte(accessToken), token) + if err != nil || !token.Valid() { + return false + } + var functions = getCurrentAuthFunctions() + if functions == nil { + return false + } + return functions[verify_user].(func(*oauth2.Token) bool)(token) +} diff --git a/auth/google.go b/auth/google.go index 6bafb3f3..44c82489 100644 --- a/auth/google.go +++ b/auth/google.go @@ -1,10 +1,13 @@ package auth import ( + "encoding/json" "fmt" "io/ioutil" "net/http" + "github.com/gravitl/netmaker/logic" + "github.com/gravitl/netmaker/servercfg" "golang.org/x/oauth2" "golang.org/x/oauth2/google" ) @@ -14,6 +17,7 @@ var google_functions = map[string]interface{}{ get_user_info: getUserInfo, handle_callback: handleGoogleCallback, handle_login: handleGoogleLogin, + verify_user: verifyGoogleUser, } // == handle google authentication here == @@ -29,6 +33,7 @@ func initGoogle(redirectURL string, clientID string, clientSecret string) { } func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { + oauth_state_string = logic.RandomString(16) url := auth_provider.AuthCodeURL(oauth_state_string) http.Redirect(w, r, url, http.StatusTemporaryRedirect) } @@ -38,20 +43,26 @@ func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { var content, err = getUserInfo(r.FormValue("state"), r.FormValue("code")) if err != nil { fmt.Println(err.Error()) - http.Redirect(w, r, "/api/oauth/error", http.StatusTemporaryRedirect) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) return } - fmt.Fprintf(w, "Content: %s\n", content) + logic.Log("completed google oauth sigin in for "+content.Email, 0) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth="+content.AccessToken+"&email="+content.Email, http.StatusPermanentRedirect) } -func getUserInfo(state string, code string) ([]byte, error) { +func getUserInfo(state string, code string) (*OauthUser, error) { if state != oauth_state_string { return nil, fmt.Errorf("invalid oauth state") } - token, err := auth_provider.Exchange(oauth2.NoContext, code) + var token, err = auth_provider.Exchange(oauth2.NoContext, code) if err != nil { return nil, fmt.Errorf("code exchange failed: %s", err.Error()) } + var data []byte + data, err = json.Marshal(token) + if err != nil { + return nil, fmt.Errorf("failed to convert token to json: %s", err.Error()) + } response, err := http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken) if err != nil { return nil, fmt.Errorf("failed getting user info: %s", err.Error()) @@ -61,5 +72,19 @@ func getUserInfo(state string, code string) ([]byte, error) { if err != nil { return nil, fmt.Errorf("failed reading response body: %s", err.Error()) } - return contents, nil + var userInfo = &OauthUser{} + if err = json.Unmarshal(contents, userInfo); err != nil { + return nil, fmt.Errorf("failed parsing email from response data: %s", err.Error()) + } + userInfo.AccessToken = string(data) + return userInfo, nil +} + +func verifyGoogleUser(token *oauth2.Token) bool { + if token.Valid() { + var err error + _, err = http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken) + return err == nil + } + return false } diff --git a/config/config.go b/config/config.go index 12c5d91a..c6663840 100644 --- a/config/config.go +++ b/config/config.go @@ -65,6 +65,7 @@ type ServerConfig struct { AuthProvider string `yaml:"authprovider"` ClientID string `yaml:"clientid"` ClientSecret string `yaml:"clientsecret"` + FrontendURL string `yaml:"frontendurl"` } // Generic SQL Config diff --git a/controllers/controller.go b/controllers/controller.go index 07bce556..662e3440 100644 --- a/controllers/controller.go +++ b/controllers/controller.go @@ -10,6 +10,7 @@ import ( "github.com/gorilla/handlers" "github.com/gorilla/mux" + "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/servercfg" ) @@ -42,8 +43,7 @@ func HandleRESTRequests(wg *sync.WaitGroup) { log.Println(err) } }() - - log.Println("REST Server successfully started on port " + port + " (REST)") + logic.Log("REST Server successfully started on port "+port+" (REST)", 0) c := make(chan os.Signal) // Relay os.Interrupt to our channel (os.Interrupt = CTRL+C) @@ -55,7 +55,7 @@ func HandleRESTRequests(wg *sync.WaitGroup) { <-c // After receiving CTRL+C Properly stop the server - log.Println("Stopping the REST server...") + logic.Log("Stopping the REST server...", 0) srv.Shutdown(context.TODO()) - log.Println("REST Server closed.") + logic.Log("REST Server closed.", 0) } diff --git a/controllers/extClientHttpController.go b/controllers/extClientHttpController.go index 5eca78ce..5cdda0a1 100644 --- a/controllers/extClientHttpController.go +++ b/controllers/extClientHttpController.go @@ -5,7 +5,6 @@ import ( "errors" "fmt" "io" - "math/rand" "net/http" "strconv" "time" @@ -413,17 +412,3 @@ func deleteExtClient(w http.ResponseWriter, r *http.Request) { "Deleted extclient client "+params["clientid"]+" from network "+params["network"], 1) returnSuccessResponse(w, r, params["clientid"]+" deleted.") } - -// StringWithCharset - returns a random string in a charset -func StringWithCharset(length int, charset string) string { - b := make([]byte, length) - for i := range b { - b[i] = charset[seededRand.Intn(len(charset))] - } - return string(b) -} - -const charset = "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" - -var seededRand *rand.Rand = rand.New( - rand.NewSource(time.Now().UnixNano())) diff --git a/controllers/userHttpController.go b/controllers/userHttpController.go index 999fa89b..613a9a4e 100644 --- a/controllers/userHttpController.go +++ b/controllers/userHttpController.go @@ -3,14 +3,14 @@ package controller import ( "encoding/json" "errors" - "fmt" "net/http" "strings" - "github.com/go-playground/validator/v10" "github.com/gorilla/mux" + "github.com/gravitl/netmaker/auth" "github.com/gravitl/netmaker/database" "github.com/gravitl/netmaker/functions" + "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" "golang.org/x/crypto/bcrypt" ) @@ -26,6 +26,13 @@ func userHandlers(r *mux.Router) { r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(deleteUser))).Methods("DELETE") r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(getUser))).Methods("GET") r.HandleFunc("/api/users", authorizeUserAdm(http.HandlerFunc(getUsers))).Methods("GET") + r.HandleFunc("/api/oauth/login", auth.HandleAuthLogin).Methods("GET") + r.HandleFunc("/api/oauth/callback", auth.HandleAuthCallback).Methods("GET") + r.HandleFunc("/api/oauth/error", throwOauthError).Methods("GET") +} + +func throwOauthError(response http.ResponseWriter, request *http.Request) { + returnErrorResponse(response, request, formatError(errors.New("No token returned"), "unauthorized")) } // Node authenticates using its password and retrieves a JWT for authorization. @@ -181,37 +188,11 @@ func ValidateUserToken(token string, user string, adminonly bool) error { return nil } -// HasAdmin - checks if server has an admin -func HasAdmin() (bool, error) { - - collection, err := database.FetchRecords(database.USERS_TABLE_NAME) - if err != nil { - if database.IsEmptyRecord(err) { - return false, nil - } else { - return true, err - - } - } - for _, value := range collection { // filter for isadmin true - var user models.User - err = json.Unmarshal([]byte(value), &user) - if err != nil { - continue - } - if user.IsAdmin { - return true, nil - } - } - - return false, err -} - func hasAdmin(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") - hasadmin, err := HasAdmin() + hasadmin, err := logic.HasAdmin() if err != nil { returnErrorResponse(w, r, formatError(err, "internal")) return @@ -221,20 +202,6 @@ func hasAdmin(w http.ResponseWriter, r *http.Request) { } -// GetUser - gets a user -func GetUser(username string) (models.ReturnUser, error) { - - var user models.ReturnUser - record, err := database.FetchRecord(database.USERS_TABLE_NAME, username) - if err != nil { - return user, err - } - if err = json.Unmarshal([]byte(record), &user); err != nil { - return models.ReturnUser{}, err - } - return user, err -} - // GetUserInternal - gets an internal user func GetUserInternal(username string) (models.User, error) { @@ -249,30 +216,6 @@ func GetUserInternal(username string) (models.User, error) { return user, err } -// GetUsers - gets users -func GetUsers() ([]models.ReturnUser, error) { - - var users []models.ReturnUser - - collection, err := database.FetchRecords(database.USERS_TABLE_NAME) - - if err != nil { - return users, err - } - - for _, value := range collection { - - var user models.ReturnUser - err = json.Unmarshal([]byte(value), &user) - if err != nil { - continue // get users - } - users = append(users, user) - } - - return users, err -} - // Get an individual node. Nothin fancy here folks. func getUser(w http.ResponseWriter, r *http.Request) { // set header. @@ -280,7 +223,7 @@ func getUser(w http.ResponseWriter, r *http.Request) { var params = mux.Vars(r) usernameFetched := params["username"] - user, err := GetUser(usernameFetched) + user, err := logic.GetUser(usernameFetched) if err != nil { returnErrorResponse(w, r, formatError(err, "internal")) @@ -295,7 +238,7 @@ func getUsers(w http.ResponseWriter, r *http.Request) { // set header. w.Header().Set("Content-Type", "application/json") - users, err := GetUsers() + users, err := logic.GetUsers() if err != nil { returnErrorResponse(w, r, formatError(err, "internal")) @@ -306,42 +249,6 @@ func getUsers(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(users) } -// CreateUser - creates a user -func CreateUser(user models.User) (models.User, error) { - // check if user exists - if _, err := GetUser(user.UserName); err == nil { - return models.User{}, errors.New("user exists") - } - err := ValidateUser("create", user) - if err != nil { - return models.User{}, err - } - - // encrypt that password so we never see it again - hash, err := bcrypt.GenerateFromPassword([]byte(user.Password), 5) - if err != nil { - return user, err - } - // set password to encrypted password - user.Password = string(hash) - - tokenString, _ := functions.CreateUserJWT(user.UserName, user.Networks, user.IsAdmin) - - if tokenString == "" { - // returnErrorResponse(w, r, errorResponse) - return user, err - } - - // connect db - data, err := json.Marshal(&user) - if err != nil { - return user, err - } - err = database.Insert(user.UserName, string(data), database.USERS_TABLE_NAME) - - return user, err -} - func createAdmin(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") @@ -349,7 +256,7 @@ func createAdmin(w http.ResponseWriter, r *http.Request) { // get node from body of request _ = json.NewDecoder(r.Body).Decode(&admin) - admin, err := CreateAdmin(admin) + admin, err := logic.CreateAdmin(admin) if err != nil { returnErrorResponse(w, r, formatError(err, "badrequest")) @@ -359,18 +266,6 @@ func createAdmin(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(admin) } -func CreateAdmin(admin models.User) (models.User, error) { - hasadmin, err := HasAdmin() - if err != nil { - return models.User{}, err - } - if hasadmin { - return models.User{}, errors.New("admin user already exists") - } - admin.IsAdmin = true - return CreateUser(admin) -} - func createUser(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") @@ -378,7 +273,7 @@ func createUser(w http.ResponseWriter, r *http.Request) { // get node from body of request _ = json.NewDecoder(r.Body).Decode(&user) - user, err := CreateUser(user) + user, err := logic.CreateUser(user) if err != nil { returnErrorResponse(w, r, formatError(err, "badrequest")) @@ -388,52 +283,6 @@ func createUser(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(user) } -// UpdateUser - updates a given user -func UpdateUser(userchange models.User, user models.User) (models.User, error) { - //check if user exists - if _, err := GetUser(user.UserName); err != nil { - return models.User{}, err - } - - err := ValidateUser("update", userchange) - if err != nil { - return models.User{}, err - } - - queryUser := user.UserName - - if userchange.UserName != "" { - user.UserName = userchange.UserName - } - if len(userchange.Networks) > 0 { - user.Networks = userchange.Networks - } - if userchange.Password != "" { - // encrypt that password so we never see it again - hash, err := bcrypt.GenerateFromPassword([]byte(userchange.Password), 5) - - if err != nil { - return userchange, err - } - // set password to encrypted password - userchange.Password = string(hash) - - user.Password = userchange.Password - } - if err = database.DeleteRecord(database.USERS_TABLE_NAME, queryUser); err != nil { - return models.User{}, err - } - data, err := json.Marshal(&user) - if err != nil { - return models.User{}, err - } - if err = database.Insert(user.UserName, string(data), database.USERS_TABLE_NAME); err != nil { - return models.User{}, err - } - functions.PrintUserLog(models.NODE_SERVER_NAME, "updated user "+queryUser, 1) - return user, nil -} - func updateUser(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") var params = mux.Vars(r) @@ -453,7 +302,7 @@ func updateUser(w http.ResponseWriter, r *http.Request) { return } userchange.Networks = nil - user, err = UpdateUser(userchange, user) + user, err = logic.UpdateUser(userchange, user) if err != nil { returnErrorResponse(w, r, formatError(err, "badrequest")) return @@ -480,7 +329,7 @@ func updateUserAdm(w http.ResponseWriter, r *http.Request) { returnErrorResponse(w, r, formatError(err, "internal")) return } - user, err = UpdateUser(userchange, user) + user, err = logic.UpdateUser(userchange, user) if err != nil { returnErrorResponse(w, r, formatError(err, "badrequest")) return @@ -489,20 +338,6 @@ func updateUserAdm(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(user) } -// DeleteUser - deletes a given user -func DeleteUser(user string) (bool, error) { - - if userRecord, err := database.FetchRecord(database.USERS_TABLE_NAME, user); err != nil || len(userRecord) == 0 { - return false, errors.New("user does not exist") - } - - err := database.DeleteRecord(database.USERS_TABLE_NAME, user) - if err != nil { - return false, err - } - return true, nil -} - func deleteUser(w http.ResponseWriter, r *http.Request) { // Set header w.Header().Set("Content-Type", "application/json") @@ -511,7 +346,7 @@ func deleteUser(w http.ResponseWriter, r *http.Request) { var params = mux.Vars(r) username := params["username"] - success, err := DeleteUser(username) + success, err := logic.DeleteUser(username) if err != nil { returnErrorResponse(w, r, formatError(err, "internal")) @@ -524,17 +359,3 @@ func deleteUser(w http.ResponseWriter, r *http.Request) { functions.PrintUserLog(username, "was deleted", 1) json.NewEncoder(w).Encode(params["username"] + " deleted.") } - -// ValidateUser - validates a user model -func ValidateUser(operation string, user models.User) error { - - v := validator.New() - err := v.Struct(user) - - if err != nil { - for _, e := range err.(validator.ValidationErrors) { - fmt.Println(e) - } - } - return err -} diff --git a/database/database.go b/database/database.go index 2c4d50d6..1dd4a733 100644 --- a/database/database.go +++ b/database/database.go @@ -87,11 +87,11 @@ func getCurrentDB() map[string]interface{} { } func InitializeDatabase() error { - log.Println("connecting to", servercfg.GetDB()) + log.Println("[netmaker] connecting to", servercfg.GetDB()) tperiod := time.Now().Add(10 * time.Second) for { if err := getCurrentDB()[INIT_DB].(func() error)(); err != nil { - log.Println("unable to connect to db, retrying . . .") + log.Println("[netmaker] unable to connect to db, retrying . . .") if time.Now().After(tperiod) { return err } diff --git a/logic/auth.go b/logic/auth.go new file mode 100644 index 00000000..4939cb8f --- /dev/null +++ b/logic/auth.go @@ -0,0 +1,199 @@ +package logic + +import ( + "encoding/json" + "errors" + + "github.com/go-playground/validator/v10" + "github.com/gravitl/netmaker/database" + "github.com/gravitl/netmaker/functions" + "github.com/gravitl/netmaker/models" + "golang.org/x/crypto/bcrypt" +) + +// HasAdmin - checks if server has an admin +func HasAdmin() (bool, error) { + + collection, err := database.FetchRecords(database.USERS_TABLE_NAME) + if err != nil { + if database.IsEmptyRecord(err) { + return false, nil + } else { + return true, err + } + } + for _, value := range collection { // filter for isadmin true + var user models.User + err = json.Unmarshal([]byte(value), &user) + if err != nil { + continue + } + if user.IsAdmin { + return true, nil + } + } + + return false, err +} + +// GetUser - gets a user +func GetUser(username string) (models.ReturnUser, error) { + + var user models.ReturnUser + record, err := database.FetchRecord(database.USERS_TABLE_NAME, username) + if err != nil { + return user, err + } + if err = json.Unmarshal([]byte(record), &user); err != nil { + return models.ReturnUser{}, err + } + return user, err +} + +// GetUsers - gets users +func GetUsers() ([]models.ReturnUser, error) { + + var users []models.ReturnUser + + collection, err := database.FetchRecords(database.USERS_TABLE_NAME) + + if err != nil { + return users, err + } + + for _, value := range collection { + + var user models.ReturnUser + err = json.Unmarshal([]byte(value), &user) + if err != nil { + continue // get users + } + users = append(users, user) + } + + return users, err +} + +// CreateUser - creates a user +func CreateUser(user models.User) (models.User, error) { + // check if user exists + if _, err := GetUser(user.UserName); err == nil { + return models.User{}, errors.New("user exists") + } + var err = ValidateUser(user) + if err != nil { + return models.User{}, err + } + + // encrypt that password so we never see it again + hash, err := bcrypt.GenerateFromPassword([]byte(user.Password), 5) + if err != nil { + return user, err + } + // set password to encrypted password + user.Password = string(hash) + + tokenString, _ := functions.CreateUserJWT(user.UserName, user.Networks, user.IsAdmin) + + if tokenString == "" { + // returnErrorResponse(w, r, errorResponse) + return user, err + } + + // connect db + data, err := json.Marshal(&user) + if err != nil { + return user, err + } + err = database.Insert(user.UserName, string(data), database.USERS_TABLE_NAME) + + return user, err +} + +// CreateAdmin - creates an admin user +func CreateAdmin(admin models.User) (models.User, error) { + hasadmin, err := HasAdmin() + if err != nil { + return models.User{}, err + } + if hasadmin { + return models.User{}, errors.New("admin user already exists") + } + admin.IsAdmin = true + return CreateUser(admin) +} + +// UpdateUser - updates a given user +func UpdateUser(userchange models.User, user models.User) (models.User, error) { + //check if user exists + if _, err := GetUser(user.UserName); err != nil { + return models.User{}, err + } + + err := ValidateUser(userchange) + if err != nil { + return models.User{}, err + } + + queryUser := user.UserName + + if userchange.UserName != "" { + user.UserName = userchange.UserName + } + if len(userchange.Networks) > 0 { + user.Networks = userchange.Networks + } + if userchange.Password != "" { + // encrypt that password so we never see it again + hash, err := bcrypt.GenerateFromPassword([]byte(userchange.Password), 5) + + if err != nil { + return userchange, err + } + // set password to encrypted password + userchange.Password = string(hash) + + user.Password = userchange.Password + } + if err = database.DeleteRecord(database.USERS_TABLE_NAME, queryUser); err != nil { + return models.User{}, err + } + data, err := json.Marshal(&user) + if err != nil { + return models.User{}, err + } + if err = database.Insert(user.UserName, string(data), database.USERS_TABLE_NAME); err != nil { + return models.User{}, err + } + functions.PrintUserLog(models.NODE_SERVER_NAME, "updated user "+queryUser, 1) + return user, nil +} + +// ValidateUser - validates a user model +func ValidateUser(user models.User) error { + + v := validator.New() + err := v.Struct(user) + + if err != nil { + for _, e := range err.(validator.ValidationErrors) { + Log(e.Error(), 2) + } + } + + return err +} + +// DeleteUser - deletes a given user +func DeleteUser(user string) (bool, error) { + + if userRecord, err := database.FetchRecord(database.USERS_TABLE_NAME, user); err != nil || len(userRecord) == 0 { + return false, errors.New("user does not exist") + } + + err := database.DeleteRecord(database.USERS_TABLE_NAME, user) + if err != nil { + return false, err + } + return true, nil +} diff --git a/logic/util.go b/logic/util.go index 3ea52a93..c733ccf6 100644 --- a/logic/util.go +++ b/logic/util.go @@ -5,6 +5,7 @@ import ( "encoding/base64" "encoding/json" "log" + "math/rand" "strconv" "strings" "time" @@ -278,6 +279,19 @@ func GetPeersList(networkName string, excludeRelayed bool, relayedNodeAddr strin return peers, err } +// RandomString - returns a random string in a charset +func RandomString(length int) string { + const charset = "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" + + var seededRand *rand.Rand = rand.New(rand.NewSource(time.Now().UnixNano())) + + b := make([]byte, length) + for i := range b { + b[i] = charset[seededRand.Intn(len(charset))] + } + return string(b) +} + func setPeerInfo(node models.Node) models.Node { var peer models.Node peer.RelayAddrs = node.RelayAddrs @@ -303,7 +317,7 @@ func setPeerInfo(node models.Node) models.Node { func Log(message string, loglevel int) { log.SetFlags(log.Flags() &^ (log.Llongfile | log.Lshortfile)) - if int32(loglevel) <= servercfg.GetVerbose() && servercfg.GetVerbose() != 0 { + if int32(loglevel) <= servercfg.GetVerbose() && servercfg.GetVerbose() >= 0 { log.Println("[netmaker] " + message) } } diff --git a/main.go b/main.go index d98cc6a0..8abced07 100644 --- a/main.go +++ b/main.go @@ -13,11 +13,13 @@ import ( "sync" "time" + "github.com/gravitl/netmaker/auth" controller "github.com/gravitl/netmaker/controllers" "github.com/gravitl/netmaker/database" "github.com/gravitl/netmaker/dnslogic" "github.com/gravitl/netmaker/functions" nodepb "github.com/gravitl/netmaker/grpc" + "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/netclient/ncutils" "github.com/gravitl/netmaker/servercfg" @@ -35,20 +37,27 @@ func main() { func initialize() { // Client Mode Prereq Check var err error + if err = database.InitializeDatabase(); err != nil { - log.Println("Error connecting to database.") + logic.Log("Error connecting to database", 0) log.Fatal(err) } - log.Println("database successfully connected.") + logic.Log("database successfully connected", 0) + + var authProvider = auth.InitializeAuthProvider() + if authProvider != "" { + logic.Log("OAuth provider, "+authProvider+", initialized", 0) + } + if servercfg.IsClientMode() != "off" { output, err := ncutils.RunCmd("id -u", true) if err != nil { - log.Println("Error running 'id -u' for prereq check. Please investigate or disable client mode.") + logic.Log("Error running 'id -u' for prereq check. Please investigate or disable client mode.", 0) log.Fatal(output, err) } uid, err := strconv.Atoi(string(output[:len(output)-1])) if err != nil { - log.Println("Error retrieving uid from 'id -u' for prereq check. Please investigate or disable client mode.") + logic.Log("Error retrieving uid from 'id -u' for prereq check. Please investigate or disable client mode.", 0) log.Fatal(err) } if uid != 0 { @@ -74,7 +83,7 @@ func startControllers() { if !(servercfg.DisableRemoteIPCheck()) && servercfg.GetGRPCHost() == "127.0.0.1" { err := servercfg.SetHost() if err != nil { - log.Println("Unable to Set host. Exiting...") + logic.Log("Unable to Set host. Exiting...", 0) log.Fatal(err) } } @@ -90,7 +99,7 @@ func startControllers() { if servercfg.IsDNSMode() { err := dnslogic.SetDNS() if err != nil { - log.Println("error occurred initializing DNS:", err) + logic.Log("error occurred initializing DNS: "+err.Error(), 0) } } //Run Rest Server @@ -98,7 +107,7 @@ func startControllers() { if !servercfg.DisableRemoteIPCheck() && servercfg.GetAPIHost() == "127.0.0.1" { err := servercfg.SetHost() if err != nil { - log.Println("Unable to Set host. Exiting...") + logic.Log("Unable to Set host. Exiting...", 0) log.Fatal(err) } } @@ -106,11 +115,11 @@ func startControllers() { controller.HandleRESTRequests(&waitnetwork) } if !servercfg.IsAgentBackend() && !servercfg.IsRestBackend() { - log.Println("No Server Mode selected, so nothing is being served! Set either Agent mode (AGENT_BACKEND) or Rest mode (REST_BACKEND) to 'true'.") + logic.Log("No Server Mode selected, so nothing is being served! Set either Agent mode (AGENT_BACKEND) or Rest mode (REST_BACKEND) to 'true'.", 0) } waitnetwork.Wait() - log.Println("[netmaker] exiting") + logic.Log("exiting", 0) } func runClient(wg *sync.WaitGroup) { @@ -139,7 +148,7 @@ func runGRPC(wg *sync.WaitGroup) { listener, err := net.Listen("tcp", ":"+grpcport) // Handle errors if any if err != nil { - log.Fatalf("Unable to listen on port "+grpcport+", error: %v", err) + log.Fatalf("[netmaker] Unable to listen on port "+grpcport+", error: %v", err) } s := grpc.NewServer( @@ -157,7 +166,7 @@ func runGRPC(wg *sync.WaitGroup) { log.Fatalf("Failed to serve: %v", err) } }() - log.Println("Agent Server successfully started on port " + grpcport + " (gRPC)") + logic.Log("Agent Server successfully started on port "+grpcport+" (gRPC)", 0) // Right way to stop the server using a SHUTDOWN HOOK // Create a channel to receive OS signals @@ -172,11 +181,11 @@ func runGRPC(wg *sync.WaitGroup) { <-c // After receiving CTRL+C Properly stop the server - log.Println("Stopping the Agent server...") + logic.Log("Stopping the Agent server...", 0) s.Stop() listener.Close() - log.Println("Agent server closed..") - log.Println("Closed DB connection.") + logic.Log("Agent server closed..", 0) + logic.Log("Closed DB connection.", 0) } func authServerUnaryInterceptor() grpc.ServerOption { diff --git a/servercfg/serverconf.go b/servercfg/serverconf.go index 84327087..8e9d8b4b 100644 --- a/servercfg/serverconf.go +++ b/servercfg/serverconf.go @@ -72,8 +72,20 @@ func GetServerConfig() config.ServerConfig { cfg.AuthProvider = authInfo[0] cfg.ClientID = authInfo[1] cfg.ClientSecret = authInfo[2] + cfg.FrontendURL = GetFrontendURL() + return cfg } +func GetFrontendURL() string { + var frontend = "" + if os.Getenv("FRONTEND_URL") != "" { + frontend = os.Getenv("FRONTEND_URL") + } else if config.Config.Server.FrontendURL != "" { + frontend = config.Config.Server.FrontendURL + } + return frontend +} + func GetAPIConnString() string { conn := "" if os.Getenv("SERVER_API_CONN_STRING") != "" { @@ -84,7 +96,7 @@ func GetAPIConnString() string { return conn } func GetVersion() string { - version := "0.8.4" + version := "0.8.5" if config.Config.Server.Version != "" { version = config.Config.Server.Version } From 7939e5968feed85298dd026aec69a324280b7d06 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Thu, 21 Oct 2021 20:32:23 -0400 Subject: [PATCH 03/10] good first draft, fixed test --- auth/auth.go | 71 +++++++++++++++++--- auth/google.go | 27 +++++++- controllers/userHttpController.go | 32 +-------- controllers/userHttpController_test.go | 91 +++++++++++++------------- database/database.go | 4 ++ logic/auth.go | 40 +++++++++++ 6 files changed, 177 insertions(+), 88 deletions(-) diff --git a/auth/auth.go b/auth/auth.go index b5ca44a0..41adbab0 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -4,6 +4,8 @@ import ( "encoding/json" "net/http" + "github.com/gravitl/netmaker/logic" + "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/servercfg" "golang.org/x/oauth2" ) @@ -18,6 +20,7 @@ const ( azure_ad_provider_name = "azure-ad" github_provider_name = "github" verify_user = "verifyuser" + auth_key = "netmaker_auth" ) var oauth_state_string = "netmaker-oauth-state" // should be set randomly each provider login @@ -49,6 +52,10 @@ func InitializeAuthProvider() string { if functions == nil { return "" } + var _, err = fetchPassValue(logic.RandomString(64)) + if err != nil { + return "" + } var authInfo = servercfg.GetAuthProviderInfo() functions[init_provider].(func(string, string, string))(servercfg.GetAPIConnString()+"/api/oauth/callback", authInfo[1], authInfo[2]) return authInfo[0] @@ -72,16 +79,60 @@ func HandleAuthLogin(w http.ResponseWriter, r *http.Request) { functions[handle_login].(func(http.ResponseWriter, *http.Request))(w, r) } -// VerifyUserToken - checks if oauth2 token is valid -func VerifyUserToken(accessToken string) bool { - var token = &oauth2.Token{} - var err = json.Unmarshal([]byte(accessToken), token) - if err != nil || !token.Valid() { - return false +// == private methods == + +func addUser(email string) error { + var hasAdmin, err = logic.HasAdmin() + if err != nil { + logic.Log("error checking for existence of admin user during OAuth login for "+email+", user not added", 1) + return err + } // generate random password to adapt to current model + var newPass, fetchErr = fetchPassValue("") + if fetchErr != nil { + return fetchErr } - var functions = getCurrentAuthFunctions() - if functions == nil { - return false + var newUser = models.User{ + UserName: email, + Password: newPass, } - return functions[verify_user].(func(*oauth2.Token) bool)(token) + if !hasAdmin { // must be first attempt, create an admin + if newUser, err = logic.CreateAdmin(newUser); err != nil { + logic.Log("error creating admin from user, "+email+", user not added", 1) + } else { + logic.Log("admin created from user, "+email+", was first user added", 0) + } + } else { // otherwise add to db as admin..? + // TODO: add ability to add users with preemptive permissions + newUser.IsAdmin = true + if newUser, err = logic.CreateUser(newUser); err != nil { + logic.Log("error creating user, "+email+", user not added", 1) + } else { + logic.Log("user created from, "+email+"", 0) + } + } + return nil +} + +func fetchPassValue(newValue string) (string, error) { + + type valueHolder struct { + Value string `json:"value" bson:"value"` + } + var newValueHolder = &valueHolder{ + Value: newValue, + } + var data, marshalErr = json.Marshal(newValueHolder) + if marshalErr != nil { + return "", marshalErr + } + + var currentValue, err = logic.FetchAuthSecret(auth_key, string(data)) + if err != nil { + return "", err + } + var unmarshErr = json.Unmarshal([]byte(currentValue), newValueHolder) + if unmarshErr != nil { + return "", unmarshErr + } + return newValueHolder.Value, nil } diff --git a/auth/google.go b/auth/google.go index 44c82489..cb76f9fc 100644 --- a/auth/google.go +++ b/auth/google.go @@ -7,6 +7,7 @@ import ( "net/http" "github.com/gravitl/netmaker/logic" + "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/servercfg" "golang.org/x/oauth2" "golang.org/x/oauth2/google" @@ -34,7 +35,7 @@ func initGoogle(redirectURL string, clientID string, clientSecret string) { func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { oauth_state_string = logic.RandomString(16) - url := auth_provider.AuthCodeURL(oauth_state_string) + var url = auth_provider.AuthCodeURL(oauth_state_string) http.Redirect(w, r, url, http.StatusTemporaryRedirect) } @@ -46,8 +47,30 @@ func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) return } + _, err = logic.GetUser(content.Email) + if err != nil { // user must not exists, so try to make one + if err = addUser(content.Email); err != nil { + return + } + } + var newPass, fetchErr = fetchPassValue("") + if fetchErr != nil { + return + } + // send a netmaker jwt token + var authRequest = models.UserAuthParams{ + UserName: content.Email, + Password: newPass, + } + + var jwt, jwtErr = logic.VerifyAuthRequest(authRequest) + if jwtErr != nil { + logic.Log("could not parse jwt for user "+authRequest.UserName, 1) + return + } + logic.Log("completed google oauth sigin in for "+content.Email, 0) - http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth="+content.AccessToken+"&email="+content.Email, http.StatusPermanentRedirect) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&email="+content.Email, http.StatusPermanentRedirect) } func getUserInfo(state string, code string) (*OauthUser, error) { diff --git a/controllers/userHttpController.go b/controllers/userHttpController.go index 613a9a4e..478dc42f 100644 --- a/controllers/userHttpController.go +++ b/controllers/userHttpController.go @@ -12,7 +12,6 @@ import ( "github.com/gravitl/netmaker/functions" "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" - "golang.org/x/crypto/bcrypt" ) func userHandlers(r *mux.Router) { @@ -53,7 +52,7 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) { return } - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) if err != nil { returnErrorResponse(response, request, formatError(err, "badrequest")) return @@ -86,35 +85,6 @@ func authenticateUser(response http.ResponseWriter, request *http.Request) { response.Write(successJSONResponse) } -// VerifyAuthRequest - verifies an auth request -func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) { - var result models.User - if authRequest.UserName == "" { - return "", errors.New("username can't be empty") - } else if authRequest.Password == "" { - return "", errors.New("password can't be empty") - } - //Search DB for node with Mac Address. Ignore pending nodes (they should not be able to authenticate with API until approved). - record, err := database.FetchRecord(database.USERS_TABLE_NAME, authRequest.UserName) - if err != nil { - return "", errors.New("incorrect credentials") - } - if err = json.Unmarshal([]byte(record), &result); err != nil { - return "", errors.New("incorrect credentials") - } - - // compare password from request to stored password in database - // might be able to have a common hash (certificates?) and compare those so that a password isn't passed in in plain text... - // TODO: Consider a way of hashing the password client side before sending, or using certificates - if err = bcrypt.CompareHashAndPassword([]byte(result.Password), []byte(authRequest.Password)); err != nil { - return "", errors.New("incorrect credentials") - } - - //Create a new JWT for the node - tokenString, _ := functions.CreateUserJWT(authRequest.UserName, result.Networks, result.IsAdmin) - return tokenString, nil -} - // The middleware for most requests to the API // They all pass through here first // This will validate the JWT (or check for master token) diff --git a/controllers/userHttpController_test.go b/controllers/userHttpController_test.go index 7efe642d..3afea694 100644 --- a/controllers/userHttpController_test.go +++ b/controllers/userHttpController_test.go @@ -4,52 +4,53 @@ import ( "testing" "github.com/gravitl/netmaker/database" + "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" "github.com/stretchr/testify/assert" ) func deleteAllUsers() { - users, _ := GetUsers() + users, _ := logic.GetUsers() for _, user := range users { - DeleteUser(user.UserName) + logic.DeleteUser(user.UserName) } } func TestHasAdmin(t *testing.T) { //delete all current users database.InitializeDatabase() - users, _ := GetUsers() + users, _ := logic.GetUsers() for _, user := range users { - success, err := DeleteUser(user.UserName) + success, err := logic.DeleteUser(user.UserName) assert.Nil(t, err) assert.True(t, success) } t.Run("NoUser", func(t *testing.T) { - found, err := HasAdmin() + found, err := logic.HasAdmin() assert.Nil(t, err) assert.False(t, found) }) t.Run("No admin user", func(t *testing.T) { var user = models.User{"noadmin", "password", nil, false} - _, err := CreateUser(user) + _, err := logic.CreateUser(user) assert.Nil(t, err) - found, err := HasAdmin() + found, err := logic.HasAdmin() assert.Nil(t, err) assert.False(t, found) }) t.Run("admin user", func(t *testing.T) { var user = models.User{"admin", "password", nil, true} - _, err := CreateUser(user) + _, err := logic.CreateUser(user) assert.Nil(t, err) - found, err := HasAdmin() + found, err := logic.HasAdmin() assert.Nil(t, err) assert.True(t, found) }) t.Run("multiple admins", func(t *testing.T) { var user = models.User{"admin1", "password", nil, true} - _, err := CreateUser(user) + _, err := logic.CreateUser(user) assert.Nil(t, err) - found, err := HasAdmin() + found, err := logic.HasAdmin() assert.Nil(t, err) assert.True(t, found) }) @@ -60,12 +61,12 @@ func TestCreateUser(t *testing.T) { deleteAllUsers() user := models.User{"admin", "password", nil, true} t.Run("NoUser", func(t *testing.T) { - admin, err := CreateUser(user) + admin, err := logic.CreateUser(user) assert.Nil(t, err) assert.Equal(t, user.UserName, admin.UserName) }) t.Run("UserExists", func(t *testing.T) { - _, err := CreateUser(user) + _, err := logic.CreateUser(user) assert.NotNil(t, err) assert.EqualError(t, err, "user exists") }) @@ -78,14 +79,14 @@ func TestCreateAdmin(t *testing.T) { t.Run("NoAdmin", func(t *testing.T) { user.UserName = "admin" user.Password = "password" - admin, err := CreateAdmin(user) + admin, err := logic.CreateAdmin(user) assert.Nil(t, err) assert.Equal(t, user.UserName, admin.UserName) }) t.Run("AdminExists", func(t *testing.T) { user.UserName = "admin2" user.Password = "password1" - admin, err := CreateAdmin(user) + admin, err := logic.CreateAdmin(user) assert.EqualError(t, err, "admin user already exists") assert.Equal(t, admin, models.User{}) }) @@ -95,14 +96,14 @@ func TestDeleteUser(t *testing.T) { database.InitializeDatabase() deleteAllUsers() t.Run("NonExistent User", func(t *testing.T) { - deleted, err := DeleteUser("admin") + deleted, err := logic.DeleteUser("admin") assert.EqualError(t, err, "user does not exist") assert.False(t, deleted) }) t.Run("Existing User", func(t *testing.T) { user := models.User{"admin", "password", nil, true} - CreateUser(user) - deleted, err := DeleteUser("admin") + logic.CreateUser(user) + deleted, err := logic.DeleteUser("admin") assert.Nil(t, err) assert.True(t, deleted) }) @@ -114,44 +115,44 @@ func TestValidateUser(t *testing.T) { t.Run("Valid Create", func(t *testing.T) { user.UserName = "admin" user.Password = "validpass" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.Nil(t, err) }) t.Run("Valid Update", func(t *testing.T) { user.UserName = "admin" user.Password = "password" - err := ValidateUser("update", user) + err := logic.ValidateUser(user) assert.Nil(t, err) }) t.Run("Invalid UserName", func(t *testing.T) { t.Skip() user.UserName = "*invalid" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.Error(t, err) //assert.Contains(t, err.Error(), "Field validation for 'UserName' failed") }) t.Run("Short UserName", func(t *testing.T) { t.Skip() user.UserName = "1" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.NotNil(t, err) //assert.Contains(t, err.Error(), "Field validation for 'UserName' failed") }) t.Run("Empty UserName", func(t *testing.T) { t.Skip() user.UserName = "" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.EqualError(t, err, "some string") //assert.Contains(t, err.Error(), "Field validation for 'UserName' failed") }) t.Run("EmptyPassword", func(t *testing.T) { user.Password = "" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.EqualError(t, err, "Key: 'User.Password' Error:Field validation for 'Password' failed on the 'required' tag") }) t.Run("ShortPassword", func(t *testing.T) { user.Password = "123" - err := ValidateUser("create", user) + err := logic.ValidateUser(user) assert.EqualError(t, err, "Key: 'User.Password' Error:Field validation for 'Password' failed on the 'min' tag") }) } @@ -160,14 +161,14 @@ func TestGetUser(t *testing.T) { database.InitializeDatabase() deleteAllUsers() t.Run("NonExistantUser", func(t *testing.T) { - admin, err := GetUser("admin") + admin, err := logic.GetUser("admin") assert.EqualError(t, err, "could not find any records") assert.Equal(t, "", admin.UserName) }) t.Run("UserExisits", func(t *testing.T) { user := models.User{"admin", "password", nil, true} - CreateUser(user) - admin, err := GetUser("admin") + logic.CreateUser(user) + admin, err := logic.GetUser("admin") assert.Nil(t, err) assert.Equal(t, user.UserName, admin.UserName) }) @@ -183,7 +184,7 @@ func TestGetUserInternal(t *testing.T) { }) t.Run("UserExisits", func(t *testing.T) { user := models.User{"admin", "password", nil, true} - CreateUser(user) + logic.CreateUser(user) admin, err := GetUserInternal("admin") assert.Nil(t, err) assert.Equal(t, user.UserName, admin.UserName) @@ -194,21 +195,21 @@ func TestGetUsers(t *testing.T) { database.InitializeDatabase() deleteAllUsers() t.Run("NonExistantUser", func(t *testing.T) { - admin, err := GetUsers() + admin, err := logic.GetUsers() assert.EqualError(t, err, "could not find any records") assert.Equal(t, []models.ReturnUser(nil), admin) }) t.Run("UserExisits", func(t *testing.T) { user := models.User{"admin", "password", nil, true} - CreateUser(user) - admins, err := GetUsers() + logic.CreateUser(user) + admins, err := logic.GetUsers() assert.Nil(t, err) assert.Equal(t, user.UserName, admins[0].UserName) }) t.Run("MulipleUsers", func(t *testing.T) { user := models.User{"user", "password", nil, true} - CreateUser(user) - admins, err := GetUsers() + logic.CreateUser(user) + admins, err := logic.GetUsers() assert.Nil(t, err) for _, u := range admins { if u.UserName == "admin" { @@ -227,14 +228,14 @@ func TestUpdateUser(t *testing.T) { user := models.User{"admin", "password", nil, true} newuser := models.User{"hello", "world", []string{"wirecat, netmaker"}, true} t.Run("NonExistantUser", func(t *testing.T) { - admin, err := UpdateUser(newuser, user) + admin, err := logic.UpdateUser(newuser, user) assert.EqualError(t, err, "could not find any records") assert.Equal(t, "", admin.UserName) }) t.Run("UserExists", func(t *testing.T) { - CreateUser(user) - admin, err := UpdateUser(newuser, user) + logic.CreateUser(user) + admin, err := logic.UpdateUser(newuser, user) assert.Nil(t, err) assert.Equal(t, newuser.UserName, admin.UserName) }) @@ -271,43 +272,43 @@ func TestVerifyAuthRequest(t *testing.T) { t.Run("EmptyUserName", func(t *testing.T) { authRequest.UserName = "" authRequest.Password = "Password" - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.Equal(t, "", jwt) assert.EqualError(t, err, "username can't be empty") }) t.Run("EmptyPassword", func(t *testing.T) { authRequest.UserName = "admin" authRequest.Password = "" - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.Equal(t, "", jwt) assert.EqualError(t, err, "password can't be empty") }) t.Run("NonExistantUser", func(t *testing.T) { authRequest.UserName = "admin" authRequest.Password = "password" - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.Equal(t, "", jwt) assert.EqualError(t, err, "incorrect credentials") }) t.Run("Non-Admin", func(t *testing.T) { user := models.User{"nonadmin", "somepass", nil, false} - CreateUser(user) + logic.CreateUser(user) authRequest := models.UserAuthParams{"nonadmin", "somepass"} - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.NotNil(t, jwt) assert.Nil(t, err) }) t.Run("WrongPassword", func(t *testing.T) { user := models.User{"admin", "password", nil, false} - CreateUser(user) + logic.CreateUser(user) authRequest := models.UserAuthParams{"admin", "badpass"} - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.Equal(t, "", jwt) assert.EqualError(t, err, "incorrect credentials") }) t.Run("Success", func(t *testing.T) { authRequest := models.UserAuthParams{"admin", "password"} - jwt, err := VerifyAuthRequest(authRequest) + jwt, err := logic.VerifyAuthRequest(authRequest) assert.Nil(t, err) assert.NotNil(t, jwt) }) diff --git a/database/database.go b/database/database.go index 1dd4a733..7981ece2 100644 --- a/database/database.go +++ b/database/database.go @@ -39,6 +39,9 @@ const SERVERCONF_TABLE_NAME = "serverconf" // DATABASE_FILENAME - database file name const DATABASE_FILENAME = "netmaker.db" +// GENERATED_TABLE_NAME - stores server generated k/v +const GENERATED_TABLE_NAME = "generated" + // == ERROR CONSTS == // NO_RECORD - no singular result found @@ -114,6 +117,7 @@ func createTables() { createTable(INT_CLIENTS_TABLE_NAME) createTable(PEERS_TABLE_NAME) createTable(SERVERCONF_TABLE_NAME) + createTable(GENERATED_TABLE_NAME) } func createTable(tableName string) error { diff --git a/logic/auth.go b/logic/auth.go index 4939cb8f..41e82e43 100644 --- a/logic/auth.go +++ b/logic/auth.go @@ -123,6 +123,35 @@ func CreateAdmin(admin models.User) (models.User, error) { return CreateUser(admin) } +// VerifyAuthRequest - verifies an auth request +func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) { + var result models.User + if authRequest.UserName == "" { + return "", errors.New("username can't be empty") + } else if authRequest.Password == "" { + return "", errors.New("password can't be empty") + } + //Search DB for node with Mac Address. Ignore pending nodes (they should not be able to authenticate with API until approved). + record, err := database.FetchRecord(database.USERS_TABLE_NAME, authRequest.UserName) + if err != nil { + return "", errors.New("incorrect credentials") + } + if err = json.Unmarshal([]byte(record), &result); err != nil { + return "", errors.New("incorrect credentials") + } + + // compare password from request to stored password in database + // might be able to have a common hash (certificates?) and compare those so that a password isn't passed in in plain text... + // TODO: Consider a way of hashing the password client side before sending, or using certificates + if err = bcrypt.CompareHashAndPassword([]byte(result.Password), []byte(authRequest.Password)); err != nil { + return "", errors.New("incorrect credentials") + } + + //Create a new JWT for the node + tokenString, _ := functions.CreateUserJWT(authRequest.UserName, result.Networks, result.IsAdmin) + return tokenString, nil +} + // UpdateUser - updates a given user func UpdateUser(userchange models.User, user models.User) (models.User, error) { //check if user exists @@ -197,3 +226,14 @@ func DeleteUser(user string) (bool, error) { } return true, nil } + +// FetchAuthSecret - manages secrets for oauth +func FetchAuthSecret(key string, secret string) (string, error) { + var record, err = database.FetchRecord(database.GENERATED_TABLE_NAME, key) + if err != nil { + if err = database.Insert(key, secret, database.GENERATED_TABLE_NAME); err != nil { + return "", err + } + } + return record, nil +} From 9c5703e28c207130d9cbc5704a1aa620661e39b7 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Fri, 22 Oct 2021 09:47:29 -0400 Subject: [PATCH 04/10] google oauth implmented --- auth/auth.go | 16 ++++++++++++++-- auth/google.go | 13 +++++++------ main.go | 2 ++ 3 files changed, 23 insertions(+), 8 deletions(-) diff --git a/auth/auth.go b/auth/auth.go index 41adbab0..eb16e73f 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -1,6 +1,7 @@ package auth import ( + "encoding/base64" "encoding/json" "net/http" @@ -56,6 +57,10 @@ func InitializeAuthProvider() string { if err != nil { return "" } + var currentFrontendURL = servercfg.GetFrontendURL() + if currentFrontendURL == "" { + return "" + } var authInfo = servercfg.GetAuthProviderInfo() functions[init_provider].(func(string, string, string))(servercfg.GetAPIConnString()+"/api/oauth/callback", authInfo[1], authInfo[2]) return authInfo[0] @@ -118,8 +123,9 @@ func fetchPassValue(newValue string) (string, error) { type valueHolder struct { Value string `json:"value" bson:"value"` } + var b64NewValue = base64.StdEncoding.EncodeToString([]byte(newValue)) var newValueHolder = &valueHolder{ - Value: newValue, + Value: b64NewValue, } var data, marshalErr = json.Marshal(newValueHolder) if marshalErr != nil { @@ -134,5 +140,11 @@ func fetchPassValue(newValue string) (string, error) { if unmarshErr != nil { return "", unmarshErr } - return newValueHolder.Value, nil + + var b64CurrentValue, b64Err = base64.StdEncoding.DecodeString(newValueHolder.Value) + if b64Err != nil { + logic.Log("could not decode pass", 0) + return "", nil + } + return string(b64CurrentValue), nil } diff --git a/auth/google.go b/auth/google.go index cb76f9fc..3c47bb3c 100644 --- a/auth/google.go +++ b/auth/google.go @@ -35,6 +35,12 @@ func initGoogle(redirectURL string, clientID string, clientSecret string) { func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { oauth_state_string = logic.RandomString(16) + if auth_provider == nil && servercfg.GetFrontendURL() != "" { + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) + } else if auth_provider == nil { + fmt.Fprintf(w, "%s", []byte("no frontend URL was provided and an OAuth login was attempted\nplease reconfigure server to use OAuth or use basic credentials")) + return + } var url = auth_provider.AuthCodeURL(oauth_state_string) http.Redirect(w, r, url, http.StatusTemporaryRedirect) } @@ -104,10 +110,5 @@ func getUserInfo(state string, code string) (*OauthUser, error) { } func verifyGoogleUser(token *oauth2.Token) bool { - if token.Valid() { - var err error - _, err = http.Get("https://www.googleapis.com/oauth2/v2/userinfo?access_token=" + token.AccessToken) - return err == nil - } - return false + return token.Valid() } diff --git a/main.go b/main.go index 8abced07..999adacf 100644 --- a/main.go +++ b/main.go @@ -47,6 +47,8 @@ func initialize() { // Client Mode Prereq Check var authProvider = auth.InitializeAuthProvider() if authProvider != "" { logic.Log("OAuth provider, "+authProvider+", initialized", 0) + } else { + logic.Log("no OAuth provider found or not configured, continuing without OAuth", 0) } if servercfg.IsClientMode() != "off" { From 36d60eba648161fc189683d417094e8c5ed0afe5 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Fri, 22 Oct 2021 13:12:03 -0400 Subject: [PATCH 05/10] github auth added --- auth/auth.go | 21 +++++--- auth/github.go | 129 +++++++++++++++++++++++++++++++++++++++++++++++++ auth/google.go | 16 ++++-- logic/auth.go | 2 + 4 files changed, 156 insertions(+), 12 deletions(-) create mode 100644 auth/github.go diff --git a/auth/auth.go b/auth/auth.go index eb16e73f..f6fa331d 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -8,6 +8,7 @@ import ( "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/servercfg" + "golang.org/x/crypto/bcrypt" "golang.org/x/oauth2" ) @@ -27,11 +28,6 @@ const ( var oauth_state_string = "netmaker-oauth-state" // should be set randomly each provider login var auth_provider *oauth2.Config -type OauthUser struct { - Email string `json:"email" bson:"email"` - AccessToken string `json:"accesstoken" bson:"accesstoken"` -} - func getCurrentAuthFunctions() map[string]interface{} { var authInfo = servercfg.GetAuthProviderInfo() var authProvider = authInfo[0] @@ -41,7 +37,7 @@ func getCurrentAuthFunctions() map[string]interface{} { case azure_ad_provider_name: return google_functions case github_provider_name: - return google_functions + return github_functions default: return nil } @@ -55,6 +51,7 @@ func InitializeAuthProvider() string { } var _, err = fetchPassValue(logic.RandomString(64)) if err != nil { + logic.Log(err.Error(), 0) return "" } var currentFrontendURL = servercfg.GetFrontendURL() @@ -84,6 +81,16 @@ func HandleAuthLogin(w http.ResponseWriter, r *http.Request) { functions[handle_login].(func(http.ResponseWriter, *http.Request))(w, r) } +// IsOauthUser - returns +func IsOauthUser(user *models.User) error { + var currentValue, err = fetchPassValue("") + if err != nil { + return err + } + var bCryptErr = bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(currentValue)) + return bCryptErr +} + // == private methods == func addUser(email string) error { @@ -108,7 +115,7 @@ func addUser(email string) error { } } else { // otherwise add to db as admin..? // TODO: add ability to add users with preemptive permissions - newUser.IsAdmin = true + newUser.IsAdmin = false if newUser, err = logic.CreateUser(newUser); err != nil { logic.Log("error creating user, "+email+", user not added", 1) } else { diff --git a/auth/github.go b/auth/github.go new file mode 100644 index 00000000..a8d0a371 --- /dev/null +++ b/auth/github.go @@ -0,0 +1,129 @@ +package auth + +import ( + "encoding/json" + "fmt" + "io/ioutil" + "net/http" + + "github.com/gravitl/netmaker/logic" + "github.com/gravitl/netmaker/models" + "github.com/gravitl/netmaker/servercfg" + "golang.org/x/oauth2" + "golang.org/x/oauth2/github" +) + +var github_functions = map[string]interface{}{ + init_provider: initGithub, + get_user_info: getGithubUserInfo, + handle_callback: handleGithubCallback, + handle_login: handleGithubLogin, + verify_user: verifyGithubUser, +} + +type githubOauthUser struct { + Login string `json:"login" bson:"login"` + AccessToken string `json:"accesstoken" bson:"accesstoken"` +} + +// == handle google authentication here == + +func initGithub(redirectURL string, clientID string, clientSecret string) { + auth_provider = &oauth2.Config{ + RedirectURL: redirectURL, + ClientID: clientID, + ClientSecret: clientSecret, + Scopes: []string{}, + Endpoint: github.Endpoint, + } +} + +func handleGithubLogin(w http.ResponseWriter, r *http.Request) { + oauth_state_string = logic.RandomString(16) + if auth_provider == nil && servercfg.GetFrontendURL() != "" { + http.Redirect(w, r, servercfg.GetFrontendURL()+"?error=callback-error", http.StatusTemporaryRedirect) + return + } else if auth_provider == nil { + fmt.Fprintf(w, "%s", []byte("no frontend URL was provided and an OAuth login was attempted\nplease reconfigure server to use OAuth or use basic credentials")) + return + } + var url = auth_provider.AuthCodeURL(oauth_state_string) + http.Redirect(w, r, url, http.StatusTemporaryRedirect) +} + +func handleGithubCallback(w http.ResponseWriter, r *http.Request) { + + var content, err = getGithubUserInfo(r.URL.Query().Get("state"), r.URL.Query().Get("code")) + if err != nil { + logic.Log("error when getting user info from github: "+err.Error(), 1) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) + return + } + _, err = logic.GetUser(content.Login) + if err != nil { // user must not exist, so try to make one + if err = addUser(content.Login); err != nil { + return + } + } + var newPass, fetchErr = fetchPassValue("") + if fetchErr != nil { + return + } + // send a netmaker jwt token + var authRequest = models.UserAuthParams{ + UserName: content.Login, + Password: newPass, + } + + var jwt, jwtErr = logic.VerifyAuthRequest(authRequest) + if jwtErr != nil { + logic.Log("could not parse jwt for user "+authRequest.UserName, 1) + return + } + + logic.Log("completed github oauth sigin in for "+content.Login, 0) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&email="+content.Login, http.StatusPermanentRedirect) +} + +func getGithubUserInfo(state string, code string) (*githubOauthUser, error) { + if state != oauth_state_string { + return nil, fmt.Errorf("invalid oauth state") + } + var token, err = auth_provider.Exchange(oauth2.NoContext, code) + if err != nil { + return nil, fmt.Errorf("code exchange failed: %s", err.Error()) + } + if !token.Valid() { + return nil, fmt.Errorf("GitHub code exchange yielded invalid token") + } + var data []byte + data, err = json.Marshal(token) + if err != nil { + return nil, fmt.Errorf("failed to convert token to json: %s", err.Error()) + } + var httpClient = &http.Client{} + var httpReq, reqErr = http.NewRequest("GET", "https://api.github.com/user", nil) + if reqErr != nil { + return nil, fmt.Errorf("failed to create request to GitHub") + } + httpReq.Header.Set("Authorization", "token "+token.AccessToken) + response, err := httpClient.Do(httpReq) + if err != nil { + return nil, fmt.Errorf("failed getting user info: %s", err.Error()) + } + defer response.Body.Close() + contents, err := ioutil.ReadAll(response.Body) + if err != nil { + return nil, fmt.Errorf("failed reading response body: %s", err.Error()) + } + var userInfo = &githubOauthUser{} + if err = json.Unmarshal(contents, userInfo); err != nil { + return nil, fmt.Errorf("failed parsing email from response data: %s", err.Error()) + } + userInfo.AccessToken = string(data) + return userInfo, nil +} + +func verifyGithubUser(token *oauth2.Token) bool { + return token.Valid() +} diff --git a/auth/google.go b/auth/google.go index 3c47bb3c..0a5d8a26 100644 --- a/auth/google.go +++ b/auth/google.go @@ -15,12 +15,17 @@ import ( var google_functions = map[string]interface{}{ init_provider: initGoogle, - get_user_info: getUserInfo, + get_user_info: getGoogleUserInfo, handle_callback: handleGoogleCallback, handle_login: handleGoogleLogin, verify_user: verifyGoogleUser, } +type googleOauthUser struct { + Email string `json:"email" bson:"email"` + AccessToken string `json:"accesstoken" bson:"accesstoken"` +} + // == handle google authentication here == func initGoogle(redirectURL string, clientID string, clientSecret string) { @@ -37,6 +42,7 @@ func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { oauth_state_string = logic.RandomString(16) if auth_provider == nil && servercfg.GetFrontendURL() != "" { http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) + return } else if auth_provider == nil { fmt.Fprintf(w, "%s", []byte("no frontend URL was provided and an OAuth login was attempted\nplease reconfigure server to use OAuth or use basic credentials")) return @@ -47,9 +53,9 @@ func handleGoogleLogin(w http.ResponseWriter, r *http.Request) { func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { - var content, err = getUserInfo(r.FormValue("state"), r.FormValue("code")) + var content, err = getGoogleUserInfo(r.FormValue("state"), r.FormValue("code")) if err != nil { - fmt.Println(err.Error()) + logic.Log("error when getting user info from google: "+err.Error(), 1) http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) return } @@ -79,7 +85,7 @@ func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&email="+content.Email, http.StatusPermanentRedirect) } -func getUserInfo(state string, code string) (*OauthUser, error) { +func getGoogleUserInfo(state string, code string) (*googleOauthUser, error) { if state != oauth_state_string { return nil, fmt.Errorf("invalid oauth state") } @@ -101,7 +107,7 @@ func getUserInfo(state string, code string) (*OauthUser, error) { if err != nil { return nil, fmt.Errorf("failed reading response body: %s", err.Error()) } - var userInfo = &OauthUser{} + var userInfo = &googleOauthUser{} if err = json.Unmarshal(contents, userInfo); err != nil { return nil, fmt.Errorf("failed parsing email from response data: %s", err.Error()) } diff --git a/logic/auth.go b/logic/auth.go index 41e82e43..3d3ae4d0 100644 --- a/logic/auth.go +++ b/logic/auth.go @@ -233,6 +233,8 @@ func FetchAuthSecret(key string, secret string) (string, error) { if err != nil { if err = database.Insert(key, secret, database.GENERATED_TABLE_NAME); err != nil { return "", err + } else { + return secret, nil } } return record, nil From f39e16fbc9592b139029183ea57c68c8f0db528c Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Fri, 22 Oct 2021 15:07:45 -0400 Subject: [PATCH 06/10] added azure sign in --- auth/auth.go | 2 +- auth/azure-ad.go | 126 +++++++++++++++++++++++++++++++++++++++++++++++ auth/github.go | 8 +-- auth/google.go | 6 +-- 4 files changed, 134 insertions(+), 8 deletions(-) create mode 100644 auth/azure-ad.go diff --git a/auth/auth.go b/auth/auth.go index f6fa331d..eb2b0f91 100644 --- a/auth/auth.go +++ b/auth/auth.go @@ -35,7 +35,7 @@ func getCurrentAuthFunctions() map[string]interface{} { case google_provider_name: return google_functions case azure_ad_provider_name: - return google_functions + return azure_ad_functions case github_provider_name: return github_functions default: diff --git a/auth/azure-ad.go b/auth/azure-ad.go new file mode 100644 index 00000000..bb67b719 --- /dev/null +++ b/auth/azure-ad.go @@ -0,0 +1,126 @@ +package auth + +import ( + "encoding/json" + "fmt" + "io/ioutil" + "net/http" + "os" + + "github.com/gravitl/netmaker/logic" + "github.com/gravitl/netmaker/models" + "github.com/gravitl/netmaker/servercfg" + "golang.org/x/oauth2" + "golang.org/x/oauth2/microsoft" +) + +var azure_ad_functions = map[string]interface{}{ + init_provider: initAzureAD, + get_user_info: getAzureUserInfo, + handle_callback: handleAzureCallback, + handle_login: handleAzureLogin, + verify_user: verifyAzureUser, +} + +type azureOauthUser struct { + UserPrincipalName string `json:"userPrincipalName" bson:"userPrincipalName"` + AccessToken string `json:"accesstoken" bson:"accesstoken"` +} + +// == handle azure ad authentication here == + +func initAzureAD(redirectURL string, clientID string, clientSecret string) { + auth_provider = &oauth2.Config{ + RedirectURL: redirectURL, + ClientID: clientID, + ClientSecret: clientSecret, + Scopes: []string{"User.Read"}, + Endpoint: microsoft.AzureADEndpoint(os.Getenv("AZURE_TENANT")), + } +} + +func handleAzureLogin(w http.ResponseWriter, r *http.Request) { + oauth_state_string = logic.RandomString(16) + if auth_provider == nil && servercfg.GetFrontendURL() != "" { + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) + return + } else if auth_provider == nil { + fmt.Fprintf(w, "%s", []byte("no frontend URL was provided and an OAuth login was attempted\nplease reconfigure server to use OAuth or use basic credentials")) + return + } + var url = auth_provider.AuthCodeURL(oauth_state_string) + http.Redirect(w, r, url, http.StatusTemporaryRedirect) +} + +func handleAzureCallback(w http.ResponseWriter, r *http.Request) { + + var content, err = getAzureUserInfo(r.FormValue("state"), r.FormValue("code")) + if err != nil { + logic.Log("error when getting user info from azure: "+err.Error(), 1) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?oauth=callback-error", http.StatusTemporaryRedirect) + return + } + _, err = logic.GetUser(content.UserPrincipalName) + if err != nil { // user must not exists, so try to make one + if err = addUser(content.UserPrincipalName); err != nil { + return + } + } + var newPass, fetchErr = fetchPassValue("") + if fetchErr != nil { + return + } + // send a netmaker jwt token + var authRequest = models.UserAuthParams{ + UserName: content.UserPrincipalName, + Password: newPass, + } + + var jwt, jwtErr = logic.VerifyAuthRequest(authRequest) + if jwtErr != nil { + logic.Log("could not parse jwt for user "+authRequest.UserName, 1) + return + } + + logic.Log("completed azure OAuth sigin in for "+content.UserPrincipalName, 1) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&user="+content.UserPrincipalName, http.StatusPermanentRedirect) +} + +func getAzureUserInfo(state string, code string) (*azureOauthUser, error) { + if state != oauth_state_string { + return nil, fmt.Errorf("invalid oauth state") + } + var token, err = auth_provider.Exchange(oauth2.NoContext, code) + if err != nil { + return nil, fmt.Errorf("code exchange failed: %s", err.Error()) + } + var data []byte + data, err = json.Marshal(token) + if err != nil { + return nil, fmt.Errorf("failed to convert token to json: %s", err.Error()) + } + var httpReq, reqErr = http.NewRequest("GET", "https://graph.microsoft.com/v1.0/me", nil) + if reqErr != nil { + return nil, fmt.Errorf("failed to create request to GitHub") + } + httpReq.Header.Set("Authorization", "Bearer "+token.AccessToken) + response, err := http.DefaultClient.Do(httpReq) + if err != nil { + return nil, fmt.Errorf("failed getting user info: %s", err.Error()) + } + defer response.Body.Close() + contents, err := ioutil.ReadAll(response.Body) + if err != nil { + return nil, fmt.Errorf("failed reading response body: %s", err.Error()) + } + var userInfo = &azureOauthUser{} + if err = json.Unmarshal(contents, userInfo); err != nil { + return nil, fmt.Errorf("failed parsing email from response data: %s", err.Error()) + } + userInfo.AccessToken = string(data) + return userInfo, nil +} + +func verifyAzureUser(token *oauth2.Token) bool { + return token.Valid() +} diff --git a/auth/github.go b/auth/github.go index a8d0a371..552f2525 100644 --- a/auth/github.go +++ b/auth/github.go @@ -26,7 +26,7 @@ type githubOauthUser struct { AccessToken string `json:"accesstoken" bson:"accesstoken"` } -// == handle google authentication here == +// == handle github authentication here == func initGithub(redirectURL string, clientID string, clientSecret string) { auth_provider = &oauth2.Config{ @@ -81,13 +81,13 @@ func handleGithubCallback(w http.ResponseWriter, r *http.Request) { return } - logic.Log("completed github oauth sigin in for "+content.Login, 0) - http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&email="+content.Login, http.StatusPermanentRedirect) + logic.Log("completed github OAuth sigin in for "+content.Login, 1) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&user="+content.Login, http.StatusPermanentRedirect) } func getGithubUserInfo(state string, code string) (*githubOauthUser, error) { if state != oauth_state_string { - return nil, fmt.Errorf("invalid oauth state") + return nil, fmt.Errorf("invalid OAuth state") } var token, err = auth_provider.Exchange(oauth2.NoContext, code) if err != nil { diff --git a/auth/google.go b/auth/google.go index 0a5d8a26..91bb8030 100644 --- a/auth/google.go +++ b/auth/google.go @@ -81,13 +81,13 @@ func handleGoogleCallback(w http.ResponseWriter, r *http.Request) { return } - logic.Log("completed google oauth sigin in for "+content.Email, 0) - http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&email="+content.Email, http.StatusPermanentRedirect) + logic.Log("completed google OAuth sigin in for "+content.Email, 1) + http.Redirect(w, r, servercfg.GetFrontendURL()+"?login="+jwt+"&user="+content.Email, http.StatusPermanentRedirect) } func getGoogleUserInfo(state string, code string) (*googleOauthUser, error) { if state != oauth_state_string { - return nil, fmt.Errorf("invalid oauth state") + return nil, fmt.Errorf("invalid OAuth state") } var token, err = auth_provider.Exchange(oauth2.NoContext, code) if err != nil { From c002c30ba883f2dd2ecde7f3e793c70bb4a5a674 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Mon, 25 Oct 2021 14:51:52 -0400 Subject: [PATCH 07/10] added ability for admisn to change user's networks --- controllers/responseHttp.go | 4 ++-- controllers/userHttpController.go | 38 +++++++++++++++++++++++++++++++ logic/auth.go | 21 ++++++++++++++++- logic/network.go | 7 ++++++ 4 files changed, 67 insertions(+), 3 deletions(-) diff --git a/controllers/responseHttp.go b/controllers/responseHttp.go index e44ab2e1..594d1e4d 100644 --- a/controllers/responseHttp.go +++ b/controllers/responseHttp.go @@ -2,9 +2,9 @@ package controller import ( "encoding/json" - "fmt" "net/http" + "github.com/gravitl/netmaker/logic" "github.com/gravitl/netmaker/models" ) @@ -48,7 +48,7 @@ func returnErrorResponse(response http.ResponseWriter, request *http.Request, er if err != nil { panic(err) } - fmt.Println(errorMessage) + logic.Log("processed request error: "+errorMessage.Message, 1) response.Header().Set("Content-Type", "application/json") response.WriteHeader(errorMessage.Code) response.Write(jsonResponse) diff --git a/controllers/userHttpController.go b/controllers/userHttpController.go index 478dc42f..17b541ee 100644 --- a/controllers/userHttpController.go +++ b/controllers/userHttpController.go @@ -3,6 +3,7 @@ package controller import ( "encoding/json" "errors" + "fmt" "net/http" "strings" @@ -20,6 +21,7 @@ func userHandlers(r *mux.Router) { r.HandleFunc("/api/users/adm/createadmin", createAdmin).Methods("POST") r.HandleFunc("/api/users/adm/authenticate", authenticateUser).Methods("POST") r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(updateUser))).Methods("PUT") + r.HandleFunc("/api/users/networks/{username}", authorizeUser(http.HandlerFunc(updateUserNetworks))).Methods("PUT") r.HandleFunc("/api/users/{username}/adm", authorizeUserAdm(http.HandlerFunc(updateUserAdm))).Methods("PUT") r.HandleFunc("/api/users/{username}", authorizeUserAdm(http.HandlerFunc(createUser))).Methods("POST") r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(deleteUser))).Methods("DELETE") @@ -253,6 +255,34 @@ func createUser(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(user) } +func updateUserNetworks(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + var params = mux.Vars(r) + var user models.User + // start here + username := params["username"] + user, err := GetUserInternal(username) + if err != nil { + returnErrorResponse(w, r, formatError(err, "internal")) + return + } + var userchange models.User + // we decode our body request params + err = json.NewDecoder(r.Body).Decode(&userchange) + if err != nil { + returnErrorResponse(w, r, formatError(err, "internal")) + return + } + + err = logic.UpdateUserNetworks(userchange.Networks, &user) + if err != nil { + returnErrorResponse(w, r, formatError(err, "badrequest")) + return + } + functions.PrintUserLog(username, "networks were updated", 1) + json.NewEncoder(w).Encode(user) +} + func updateUser(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") var params = mux.Vars(r) @@ -264,6 +294,10 @@ func updateUser(w http.ResponseWriter, r *http.Request) { returnErrorResponse(w, r, formatError(err, "internal")) return } + if auth.IsOauthUser(&user) == nil { + returnErrorResponse(w, r, formatError(fmt.Errorf("can not update user info for oauth user %s", username), "forbidden")) + return + } var userchange models.User // we decode our body request params err = json.NewDecoder(r.Body).Decode(&userchange) @@ -292,6 +326,10 @@ func updateUserAdm(w http.ResponseWriter, r *http.Request) { returnErrorResponse(w, r, formatError(err, "internal")) return } + if auth.IsOauthUser(&user) != nil { + returnErrorResponse(w, r, formatError(fmt.Errorf("can not update user info for oauth user"), "forbidden")) + return + } var userchange models.User // we decode our body request params err = json.NewDecoder(r.Body).Decode(&userchange) diff --git a/logic/auth.go b/logic/auth.go index 3d3ae4d0..81904f70 100644 --- a/logic/auth.go +++ b/logic/auth.go @@ -152,6 +152,25 @@ func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) { return tokenString, nil } +// UpdateUserNetworks - updates the networks of a given user +func UpdateUserNetworks(newNetworks []string, currentUser *models.User) error { + // check if user exists + if _, err := GetUser(currentUser.UserName); err != nil { + return err + } + currentUser.Networks = newNetworks + + data, err := json.Marshal(currentUser) + if err != nil { + return err + } + if err = database.Insert(currentUser.UserName, string(data), database.USERS_TABLE_NAME); err != nil { + return err + } + + return nil +} + // UpdateUser - updates a given user func UpdateUser(userchange models.User, user models.User) (models.User, error) { //check if user exists @@ -194,7 +213,7 @@ func UpdateUser(userchange models.User, user models.User) (models.User, error) { if err = database.Insert(user.UserName, string(data), database.USERS_TABLE_NAME); err != nil { return models.User{}, err } - functions.PrintUserLog(models.NODE_SERVER_NAME, "updated user "+queryUser, 1) + Log("updated user "+queryUser, 1) return user, nil } diff --git a/logic/network.go b/logic/network.go index c2bb6bb1..6d763f74 100644 --- a/logic/network.go +++ b/logic/network.go @@ -5,10 +5,17 @@ import ( "os/exec" "strings" + "github.com/gravitl/netmaker/database" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/netclient/ncutils" ) +// CheckNetworkExists - checks i a network exists for this netmaker instance +func CheckNetworkExists(network string) bool { + var _, err = database.FetchRecord(database.NETWORKS_TABLE_NAME, network) + return err == nil +} + // GetLocalIP - gets the local ip func GetLocalIP(node models.Node) string { From 9f0f6ae9b579151b2a103433ae98106094f14050 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Mon, 25 Oct 2021 15:13:23 -0400 Subject: [PATCH 08/10] users network updates is admin only --- controllers/userHttpController.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/controllers/userHttpController.go b/controllers/userHttpController.go index 17b541ee..6f51e850 100644 --- a/controllers/userHttpController.go +++ b/controllers/userHttpController.go @@ -21,7 +21,7 @@ func userHandlers(r *mux.Router) { r.HandleFunc("/api/users/adm/createadmin", createAdmin).Methods("POST") r.HandleFunc("/api/users/adm/authenticate", authenticateUser).Methods("POST") r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(updateUser))).Methods("PUT") - r.HandleFunc("/api/users/networks/{username}", authorizeUser(http.HandlerFunc(updateUserNetworks))).Methods("PUT") + r.HandleFunc("/api/users/networks/{username}", authorizeUserAdm(http.HandlerFunc(updateUserNetworks))).Methods("PUT") r.HandleFunc("/api/users/{username}/adm", authorizeUserAdm(http.HandlerFunc(updateUserAdm))).Methods("PUT") r.HandleFunc("/api/users/{username}", authorizeUserAdm(http.HandlerFunc(createUser))).Methods("POST") r.HandleFunc("/api/users/{username}", authorizeUser(http.HandlerFunc(deleteUser))).Methods("DELETE") From 6891b52cee8c47e2dff5a910959a8cb38d095fb3 Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Mon, 25 Oct 2021 16:38:59 -0400 Subject: [PATCH 09/10] updated logs, ensured admins could not be edited --- controllers/userHttpController.go | 4 ++-- logic/auth.go | 14 +++++++++++--- logic/wireguard.go | 3 ++- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/controllers/userHttpController.go b/controllers/userHttpController.go index 6f51e850..c150ddeb 100644 --- a/controllers/userHttpController.go +++ b/controllers/userHttpController.go @@ -274,12 +274,12 @@ func updateUserNetworks(w http.ResponseWriter, r *http.Request) { return } - err = logic.UpdateUserNetworks(userchange.Networks, &user) + err = logic.UpdateUserNetworks(userchange.Networks, userchange.IsAdmin, &user) if err != nil { returnErrorResponse(w, r, formatError(err, "badrequest")) return } - functions.PrintUserLog(username, "networks were updated", 1) + functions.PrintUserLog(username, "status was updated", 1) json.NewEncoder(w).Encode(user) } diff --git a/logic/auth.go b/logic/auth.go index 81904f70..d29a9ecf 100644 --- a/logic/auth.go +++ b/logic/auth.go @@ -3,6 +3,7 @@ package logic import ( "encoding/json" "errors" + "fmt" "github.com/go-playground/validator/v10" "github.com/gravitl/netmaker/database" @@ -153,12 +154,19 @@ func VerifyAuthRequest(authRequest models.UserAuthParams) (string, error) { } // UpdateUserNetworks - updates the networks of a given user -func UpdateUserNetworks(newNetworks []string, currentUser *models.User) error { +func UpdateUserNetworks(newNetworks []string, isadmin bool, currentUser *models.User) error { // check if user exists - if _, err := GetUser(currentUser.UserName); err != nil { + if returnedUser, err := GetUser(currentUser.UserName); err != nil { return err + } else if returnedUser.IsAdmin { + return fmt.Errorf("can not make changes to an admin user, attempted to change %s", returnedUser.UserName) + } + if isadmin { + currentUser.IsAdmin = true + currentUser.Networks = nil + } else { + currentUser.Networks = newNetworks } - currentUser.Networks = newNetworks data, err := json.Marshal(currentUser) if err != nil { diff --git a/logic/wireguard.go b/logic/wireguard.go index 45191fbc..cb318f06 100644 --- a/logic/wireguard.go +++ b/logic/wireguard.go @@ -62,10 +62,11 @@ func setWGConfig(node models.Node, network string, peerupdate bool) error { var iface string iface = node.Interface err = setServerPeers(iface, node.PersistentKeepalive, peers) + Log("updated peers on server "+node.Name, 2) } else { err = initWireguard(&node, privkey, peers, hasGateway, gateways) + Log("finished setting wg config on server "+node.Name, 3) } - Log("finished setting wg config on server "+node.Name, 1) return err } From 72ce7dcfd042cc119d654a3024fb650f8c9b4fee Mon Sep 17 00:00:00 2001 From: 0xdcarns Date: Mon, 25 Oct 2021 16:51:26 -0400 Subject: [PATCH 10/10] format and update version in readme --- README.md | 2 +- netclient/functions/join.go | 8 ++++---- netclient/ncutils/netclientutils.go | 4 ++-- servercfg/sqlconf.go | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 04c592ce..7309d2e9 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@

- + diff --git a/netclient/functions/join.go b/netclient/functions/join.go index c24de8c1..fe12433c 100644 --- a/netclient/functions/join.go +++ b/netclient/functions/join.go @@ -5,8 +5,6 @@ import ( "encoding/json" "errors" "fmt" - "log" - "os/exec" nodepb "github.com/gravitl/netmaker/grpc" "github.com/gravitl/netmaker/models" "github.com/gravitl/netmaker/netclient/auth" @@ -18,6 +16,8 @@ import ( "github.com/gravitl/netmaker/netclient/wireguard" "golang.zx2c4.com/wireguard/wgctrl/wgtypes" "google.golang.org/grpc" + "log" + "os/exec" ) // JoinNetwork - helps a client join a network @@ -84,8 +84,8 @@ func JoinNetwork(cfg config.ClientConfig, privateKey string) error { if ncutils.IsLinux() { _, err := exec.LookPath("resolvectl") if err != nil { - ncutils.PrintLog("resolvectl not present",2) - ncutils.PrintLog("unable to configure DNS automatically, disabling automated DNS management",2) + ncutils.PrintLog("resolvectl not present", 2) + ncutils.PrintLog("unable to configure DNS automatically, disabling automated DNS management", 2) cfg.Node.DNSOn = "no" } } diff --git a/netclient/ncutils/netclientutils.go b/netclient/ncutils/netclientutils.go index 830253e2..793d93f7 100644 --- a/netclient/ncutils/netclientutils.go +++ b/netclient/ncutils/netclientutils.go @@ -155,9 +155,9 @@ func parsePeers(keepalive int32, peers []wgtypes.PeerConfig) (string, error) { if keepalive <= 0 { keepalive = 20 } - + for _, peer := range peers { - endpointString := "" + endpointString := "" if peer.Endpoint != nil && peer.Endpoint.String() != "" { endpointString += "Endpoint = " + peer.Endpoint.String() } diff --git a/servercfg/sqlconf.go b/servercfg/sqlconf.go index 0cef15ca..91dc4736 100644 --- a/servercfg/sqlconf.go +++ b/servercfg/sqlconf.go @@ -1,8 +1,8 @@ package servercfg import ( - "os" "github.com/gravitl/netmaker/config" + "os" "strconv" )