1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
// Copyright (C) 2018 LEAP
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package bonafide
import (
"encoding/json"
"fmt"
"io/ioutil"
"log"
"os"
"path"
"strings"
"time"
"0xacab.org/leap/bitmask-vpn/pkg/config"
)
type sipAuthentication struct {
client httpClient
authURI string
}
func (a *sipAuthentication) needsCredentials() bool {
return true
}
func (a *sipAuthentication) getToken(user, password string) ([]byte, error) {
/* TODO refresh session token periodically */
if hasRecentToken() {
return readToken()
}
credJSON, err := formatCredentials(user, password)
if err != nil {
log.Println("ERROR: cannot encode credentials.", err)
return nil, fmt.Errorf("TokenErrBadCred")
}
resp, err := a.client.Post(a.authURI, "text/json", strings.NewReader(credJSON))
if err != nil {
log.Println("ERROR: failed auth request", err)
if os.IsTimeout(err) {
return nil, fmt.Errorf("TokenErrTimeout")
} else {
return nil, fmt.Errorf("TokenErrBadPost")
}
}
defer resp.Body.Close()
if resp.StatusCode != 200 {
return nil, fmt.Errorf("TokenErrBadStatus %d", resp.StatusCode)
}
token, err := ioutil.ReadAll(resp.Body)
if err != nil {
return nil, err
}
writeToken(token)
return token, nil
}
func getTokenPath() string {
return path.Join(config.Path, config.ApplicationName+".token")
}
func writeToken(token []byte) {
tp := getTokenPath()
err := ioutil.WriteFile(tp, token, 0600)
if err != nil {
log.Println("BUG: cannot write token to", tp, err)
}
}
func readToken() ([]byte, error) {
f, err := os.Open(getTokenPath())
if err != nil {
log.Println("Error: cannot open token file", err)
return nil, err
}
token, err := ioutil.ReadAll(f)
if err != nil {
log.Println("Error: cannot read token", err)
return nil, err
}
return token, nil
}
func hasRecentToken() bool {
/* See https://0xacab.org/leap/bitmask-vpn/-/issues/346 for ability to refresh tokens,
when implemented that should be tried in a goroutine */
statinfo, err := os.Stat(getTokenPath())
if err != nil {
return false
}
lastWrote := statinfo.ModTime().Unix()
/* in vpnweb we set the duration of the token to 24 hours */
old := time.Now().Add(-time.Hour * 20).Unix()
return lastWrote >= old
}
func formatCredentials(user, pass string) (string, error) {
c := credentials{User: user, Password: pass}
credJSON, err := json.Marshal(c)
if err != nil {
return "", err
}
return string(credJSON), nil
}
|
