Jonathan Turner 8 лет назад
Родитель
Сommit
4e733652ad
3 измененных файлов с 77 добавлено и 56 удалено
  1. 47 47
      credentials/ccache.go
  2. 23 2
      credentials/credentials.go
  3. 7 7
      mstypes/kerb_sid_and_attributes.go

+ 47 - 47
credentials/ccache.go

@@ -104,14 +104,14 @@ func ParseCCache(b []byte) (c CCache, err error) {
 		endian = binary.LittleEndian
 	}
 	if c.Version == 4 {
-		err = parse_header(b, &p, &c, &endian)
+		err = parseHeader(b, &p, &c, &endian)
 		if err != nil {
 			return
 		}
 	}
-	c.DefaultPrincipal = parse_principal(b, &p, &c, &endian)
+	c.DefaultPrincipal = parsePrincipal(b, &p, &c, &endian)
 	for p < len(b) {
-		cred, e := parse_credential(b, &p, &c, &endian)
+		cred, e := parseCredential(b, &p, &c, &endian)
 		if e != nil {
 			err = e
 			return
@@ -121,16 +121,16 @@ func ParseCCache(b []byte) (c CCache, err error) {
 	return
 }
 
-func parse_header(b []byte, p *int, c *CCache, e *binary.ByteOrder) error {
+func parseHeader(b []byte, p *int, c *CCache, e *binary.ByteOrder) error {
 	if c.Version != 4 {
 		return errors.New("Credentials cache version is not 4 so there is no header to parse.")
 	}
 	h := header{}
-	h.length = uint16(read_int16(b, p, e))
+	h.length = uint16(readInt16(b, p, e))
 	for *p <= int(h.length) {
 		f := headerField{}
-		f.tag = uint16(read_int16(b, p, e))
-		f.length = uint16(read_int16(b, p, e))
+		f.tag = uint16(readInt16(b, p, e))
+		f.length = uint16(readInt16(b, p, e))
 		f.value = b[*p : *p+int(f.length)]
 		*p += int(f.length)
 		if !f.valid() {
@@ -143,59 +143,59 @@ func parse_header(b []byte, p *int, c *CCache, e *binary.ByteOrder) error {
 }
 
 // Parse the Keytab bytes of a principal into a Keytab entry's principal.
-func parse_principal(b []byte, p *int, c *CCache, e *binary.ByteOrder) (princ principal) {
+func parsePrincipal(b []byte, p *int, c *CCache, e *binary.ByteOrder) (princ principal) {
 	if c.Version != 1 {
 		//Name Type is omitted in version 1
-		princ.PrincipalName.NameType = int(read_int32(b, p, e))
+		princ.PrincipalName.NameType = int(readInt32(b, p, e))
 	}
-	nc := int(read_int32(b, p, e))
+	nc := int(readInt32(b, p, e))
 	if c.Version == 1 {
 		//In version 1 the number of components includes the realm. Minus 1 to make consistent with version 2
 		nc--
 	}
-	len_realm := read_int32(b, p, e)
-	princ.Realm = string(read_Bytes(b, p, int(len_realm), e))
+	len_realm := readInt32(b, p, e)
+	princ.Realm = string(readBytes(b, p, int(len_realm), e))
 	for i := 0; i < int(nc); i++ {
-		l := read_int32(b, p, e)
-		princ.PrincipalName.NameString = append(princ.PrincipalName.NameString, string(read_Bytes(b, p, int(l), e)))
+		l := readInt32(b, p, e)
+		princ.PrincipalName.NameString = append(princ.PrincipalName.NameString, string(readBytes(b, p, int(l), e)))
 	}
 	return princ
 }
 
-func parse_credential(b []byte, p *int, c *CCache, e *binary.ByteOrder) (cred credential, err error) {
-	cred.Client = parse_principal(b, p, c, e)
-	cred.Server = parse_principal(b, p, c, e)
+func parseCredential(b []byte, p *int, c *CCache, e *binary.ByteOrder) (cred credential, err error) {
+	cred.Client = parsePrincipal(b, p, c, e)
+	cred.Server = parsePrincipal(b, p, c, e)
 	key := types.EncryptionKey{}
-	key.KeyType = int(read_int16(b, p, e))
+	key.KeyType = int(readInt16(b, p, e))
 	if c.Version == 3 {
 		//repeated twice in version 3
-		key.KeyType = int(read_int16(b, p, e))
+		key.KeyType = int(readInt16(b, p, e))
 	}
-	key.KeyValue = read_data(b, p, e)
+	key.KeyValue = readData(b, p, e)
 	cred.Key = key
-	cred.AuthTime = read_timestamp(b, p, e)
-	cred.StartTime = read_timestamp(b, p, e)
-	cred.EndTime = read_timestamp(b, p, e)
-	cred.RenewTill = read_timestamp(b, p, e)
-	if ik := read_int8(b, p, e); ik == 0 {
+	cred.AuthTime = readTimestamp(b, p, e)
+	cred.StartTime = readTimestamp(b, p, e)
+	cred.EndTime = readTimestamp(b, p, e)
+	cred.RenewTill = readTimestamp(b, p, e)
+	if ik := readInt8(b, p, e); ik == 0 {
 		cred.IsSKey = false
 	} else {
 		cred.IsSKey = true
 	}
 	cred.TicketFlags = types.NewKrbFlags()
-	cred.TicketFlags.Bytes = read_Bytes(b, p, 4, e)
-	l := int(read_int32(b, p, e))
+	cred.TicketFlags.Bytes = readBytes(b, p, 4, e)
+	l := int(readInt32(b, p, e))
 	cred.Addresses = make([]types.HostAddress, l, l)
 	for i := range cred.Addresses {
-		cred.Addresses[i] = read_address(b, p, e)
+		cred.Addresses[i] = readAddress(b, p, e)
 	}
-	l = int(read_int32(b, p, e))
+	l = int(readInt32(b, p, e))
 	cred.AuthData = make([]types.AuthorizationDataEntry, l, l)
 	for i := range cred.AuthData {
-		cred.AuthData[i] = read_authDataEntry(b, p, e)
+		cred.AuthData[i] = readAuthDataEntry(b, p, e)
 	}
-	cred.Ticket = read_data(b, p, e)
-	cred.SecondTicket = read_data(b, p, e)
+	cred.Ticket = readData(b, p, e)
+	cred.SecondTicket = readData(b, p, e)
 	return
 }
 
@@ -276,32 +276,32 @@ func (h *headerField) valid() bool {
 	return false
 }
 
-func read_data(b []byte, p *int, e *binary.ByteOrder) []byte {
-	l := read_int32(b, p, e)
-	return read_Bytes(b, p, int(l), e)
+func readData(b []byte, p *int, e *binary.ByteOrder) []byte {
+	l := readInt32(b, p, e)
+	return readBytes(b, p, int(l), e)
 }
 
-func read_address(b []byte, p *int, e *binary.ByteOrder) types.HostAddress {
+func readAddress(b []byte, p *int, e *binary.ByteOrder) types.HostAddress {
 	a := types.HostAddress{}
-	a.AddrType = int(read_int16(b, p, e))
-	a.Address = read_data(b, p, e)
+	a.AddrType = int(readInt16(b, p, e))
+	a.Address = readData(b, p, e)
 	return a
 }
 
-func read_authDataEntry(b []byte, p *int, e *binary.ByteOrder) types.AuthorizationDataEntry {
+func readAuthDataEntry(b []byte, p *int, e *binary.ByteOrder) types.AuthorizationDataEntry {
 	a := types.AuthorizationDataEntry{}
-	a.ADType = int(read_int16(b, p, e))
-	a.ADData = read_data(b, p, e)
+	a.ADType = int(readInt16(b, p, e))
+	a.ADData = readData(b, p, e)
 	return a
 }
 
 // Read bytes representing a timestamp.
-func read_timestamp(b []byte, p *int, e *binary.ByteOrder) time.Time {
-	return time.Unix(int64(read_int32(b, p, e)), 0)
+func readTimestamp(b []byte, p *int, e *binary.ByteOrder) time.Time {
+	return time.Unix(int64(readInt32(b, p, e)), 0)
 }
 
 // Read bytes representing an eight bit integer.
-func read_int8(b []byte, p *int, e *binary.ByteOrder) (i int8) {
+func readInt8(b []byte, p *int, e *binary.ByteOrder) (i int8) {
 	buf := bytes.NewBuffer(b[*p : *p+1])
 	binary.Read(buf, *e, &i)
 	*p++
@@ -309,7 +309,7 @@ func read_int8(b []byte, p *int, e *binary.ByteOrder) (i int8) {
 }
 
 // Read bytes representing a sixteen bit integer.
-func read_int16(b []byte, p *int, e *binary.ByteOrder) (i int16) {
+func readInt16(b []byte, p *int, e *binary.ByteOrder) (i int16) {
 	buf := bytes.NewBuffer(b[*p : *p+2])
 	binary.Read(buf, *e, &i)
 	*p += 2
@@ -317,14 +317,14 @@ func read_int16(b []byte, p *int, e *binary.ByteOrder) (i int16) {
 }
 
 // Read bytes representing a thirty two bit integer.
-func read_int32(b []byte, p *int, e *binary.ByteOrder) (i int32) {
+func readInt32(b []byte, p *int, e *binary.ByteOrder) (i int32) {
 	buf := bytes.NewBuffer(b[*p : *p+4])
 	binary.Read(buf, *e, &i)
 	*p += 4
 	return
 }
 
-func read_Bytes(b []byte, p *int, s int, e *binary.ByteOrder) []byte {
+func readBytes(b []byte, p *int, s int, e *binary.ByteOrder) []byte {
 	buf := bytes.NewBuffer(b[*p : *p+s])
 	r := make([]byte, s)
 	binary.Read(buf, *e, &r)

+ 23 - 2
credentials/credentials.go

@@ -10,7 +10,8 @@ import (
 )
 
 const (
-	AttributeKey_ADCredentials = 1
+	// Assigned number for AD credentials.
+	AttributeKeyADCredentials = 1
 )
 
 // Credentials struct for a user.
@@ -108,8 +109,9 @@ func (c *Credentials) HasPassword() bool {
 	return false
 }
 
+// SetADCredentials adds ADCredentials attributes to the credentials
 func (c *Credentials) SetADCredentials(a ADCredentials) {
-	c.Attributes[AttributeKey_ADCredentials] = a
+	c.Attributes[AttributeKeyADCredentials] = a
 	if a.FullName != "" {
 		c.SetDisplayName(a.FullName)
 	}
@@ -120,46 +122,57 @@ func (c *Credentials) SetADCredentials(a ADCredentials) {
 
 // Methods to implement goidentity.Identity interface
 
+// UserName returns the credential's username.
 func (c *Credentials) UserName() string {
 	return c.Username
 }
 
+// SetUserName sets the username value on the credential.
 func (c *Credentials) SetUserName(s string) {
 	c.Username = s
 }
 
+// Domain returns the credential's domain.
 func (c *Credentials) Domain() string {
 	return c.Realm
 }
 
+// SetDomain sets the domain value on the credential.
 func (c *Credentials) SetDomain(s string) {
 	c.Realm = s
 }
 
+// DisplayName returns the credential's display name.
 func (c *Credentials) DisplayName() string {
 	return c.Username
 }
 
+// SetDisplayName sets the display name value on the credential.
 func (c *Credentials) SetDisplayName(s string) {
 	c.Username = s
 }
 
+// Human returns if the  credential represents a human or not.
 func (c *Credentials) Human() bool {
 	return c.human
 }
 
+// SetHuman sets the credential as human.
 func (c *Credentials) SetHuman(b bool) {
 	c.human = b
 }
 
+// AuthTime returns the time the credential was authenticated.
 func (c *Credentials) AuthTime() time.Time {
 	return c.authTime
 }
 
+// SetAuthTime sets the time the credential was authenticated.
 func (c *Credentials) SetAuthTime(t time.Time) {
 	c.authTime = t
 }
 
+// AuthzAttributes returns the credentials authorizing attributes.
 func (c *Credentials) AuthzAttributes() []string {
 	s := make([]string, len(c.groupMembership))
 	i := 0
@@ -170,18 +183,22 @@ func (c *Credentials) AuthzAttributes() []string {
 	return s
 }
 
+// Authenticated indicates if the credential has been successfully authenticated or not.
 func (c *Credentials) Authenticated() bool {
 	return c.authenticated
 }
 
+// SetAuthenticated sets the credential as having been successfully authenticated.
 func (c *Credentials) SetAuthenticated(b bool) {
 	c.authenticated = b
 }
 
+// AddAuthzAttribute adds an authorization attribute to the credential.
 func (c *Credentials) AddAuthzAttribute(a string) {
 	c.groupMembership[a] = true
 }
 
+// AddAuthzAttribute removes an authorization attribute from the credential.
 func (c *Credentials) RemoveAuthzAttribute(a string) {
 	if _, ok := c.groupMembership[a]; !ok {
 		return
@@ -189,18 +206,21 @@ func (c *Credentials) RemoveAuthzAttribute(a string) {
 	delete(c.groupMembership, a)
 }
 
+// EnableAuthzAttribute toggles an authorization attribute to an enabled state on the credential.
 func (c *Credentials) EnableAuthzAttribute(a string) {
 	if enabled, ok := c.groupMembership[a]; ok && !enabled {
 		c.groupMembership[a] = true
 	}
 }
 
+// DisableAuthzAttribute toggles an authorization attribute to a disabled state on the credential.
 func (c *Credentials) DisableAuthzAttribute(a string) {
 	if enabled, ok := c.groupMembership[a]; ok && enabled {
 		c.groupMembership[a] = false
 	}
 }
 
+// Authorized indicates if the credential has the specified authorizing attribute.
 func (c *Credentials) Authorized(a string) bool {
 	if enabled, ok := c.groupMembership[a]; ok && enabled {
 		return true
@@ -208,6 +228,7 @@ func (c *Credentials) Authorized(a string) bool {
 	return false
 }
 
+// SessionID returns the credential's session ID.
 func (c *Credentials) SessionID() string {
 	return c.sessionID
 }

+ 7 - 7
mstypes/kerb_sid_and_attributes.go

@@ -6,11 +6,11 @@ import (
 )
 
 const (
-	SE_GROUP_MANDATORY          = 31
-	SE_GROUP_ENABLED_BY_DEFAULT = 30
-	SE_GROUP_ENABLED            = 29
-	SE_GROUP_OWNER              = 28
-	SE_GROUP_RESOURCE           = 2
+	SEGroupMandatory         = 31
+	SSEGroupEnabledByDefault = 30
+	SEGroupEnabled           = 29
+	SEGroupOwner             = 28
+	SEGroupResource          = 2
 	//All other bits MUST be set to zero and MUST be  ignored on receipt.
 )
 
@@ -20,8 +20,8 @@ type KerbSidAndAttributes struct {
 	Attributes uint32
 }
 
-// Read_KerbSidAndAttributes reads a KerbSidAndAttribute from the bytes slice.
-func Read_KerbSidAndAttributes(b *[]byte, p *int, e *binary.ByteOrder) (KerbSidAndAttributes, error) {
+// ReadKerbSidAndAttributes reads a KerbSidAndAttribute from the bytes slice.
+func ReadKerbSidAndAttributes(b *[]byte, p *int, e *binary.ByteOrder) (KerbSidAndAttributes, error) {
 	s, err := Read_RPC_SID(b, p, e)
 	if err != nil {
 		return KerbSidAndAttributes{}, err