mirror of
https://github.com/hanzozt/zt.git
synced 2026-10-30 15:04:55 +00:00
Andrew MartinezandGitHub
bb5cc51a97
* adds posture cache, instance, instance data, and event hooks - reworks router security - abstracts api session and service sessions - use connection tracker instead of various maps - doc - adds service sessions as always JWTs - addes token logging fields - removes multiple connection tracking fields - adds support for router specific posture data/respones - adds support for router posture check evaluation - defer dial/bind posture checking for legacy to controller - fix double session event emitting - fix session event missing id
80 lines
1.9 KiB
Go
80 lines
1.9 KiB
Go
package posture
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/openziti/ziti/common/pb/edge_ctrl_pb"
|
|
"github.com/pkg/errors"
|
|
"time"
|
|
)
|
|
|
|
const (
|
|
NoTimeout = int64(-1)
|
|
PromptGracePeriod = 5 * time.Minute
|
|
)
|
|
|
|
type MfaCheck struct {
|
|
*edge_ctrl_pb.DataState_PostureCheck
|
|
*edge_ctrl_pb.DataState_PostureCheck_Mfa
|
|
}
|
|
|
|
func (m *MfaCheck) Evaluate(state *InstanceData) *CheckError {
|
|
now := time.Now()
|
|
|
|
if state == nil {
|
|
return &CheckError{
|
|
Id: m.Id,
|
|
Name: m.Name,
|
|
Cause: NilStateError,
|
|
}
|
|
}
|
|
|
|
if state.PassedMfaAt == nil {
|
|
return &CheckError{
|
|
Id: m.Id,
|
|
Name: m.Name,
|
|
Cause: errors.New("MFA has never been passed"),
|
|
}
|
|
}
|
|
|
|
if m.TimeoutSeconds != NoTimeout {
|
|
timeout := time.Duration(m.TimeoutSeconds) * time.Second
|
|
timedOut := state.PassedMfaAt.Add(timeout).Before(time.Now())
|
|
|
|
if timedOut {
|
|
return &CheckError{
|
|
Id: m.Id,
|
|
Name: m.Name,
|
|
Cause: fmt.Errorf("last MFA check exceeded timeout of %s, last mfa at %s, checked at %s", timeout.String(), state.PassedMfaAt.String(), now.String()),
|
|
}
|
|
}
|
|
}
|
|
|
|
if m.PromptOnWake {
|
|
wokenAt := state.Woken.Time.AsTime()
|
|
wokenGraceEndsAt := wokenAt.Add(PromptGracePeriod)
|
|
|
|
if now.After(wokenGraceEndsAt) {
|
|
return &CheckError{
|
|
Id: m.Id,
|
|
Name: m.Name,
|
|
Cause: fmt.Errorf("MFA not resupplied during grace period, woken at %s, grace period: %s, supplied at %s, checked at: %s", wokenAt.String(), PromptGracePeriod.String(), state.PassedMfaAt.String(), now.String()),
|
|
}
|
|
}
|
|
}
|
|
|
|
if m.PromptOnUnlock {
|
|
unlockedAt := state.Unlocked.Time.AsTime()
|
|
unlockedGraceEndsAt := unlockedAt.Add(PromptGracePeriod)
|
|
|
|
if now.After(unlockedGraceEndsAt) {
|
|
return &CheckError{
|
|
Id: m.Id,
|
|
Name: m.Name,
|
|
Cause: fmt.Errorf("MFA not resupplied during grace period, unlocked at %s, grace period: %s, supplied at %s, checked at: %s", unlockedAt.String(), PromptGracePeriod.String(), state.PassedMfaAt.String(), now.String()),
|
|
}
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|