Golang Buffer.Bytes方法代码示例

// Replaces the contents of buf with the base64 representation of the data
// after encryption with the given key.
// The key is a word as used in gosa-si.conf whose md5sum will be used as
// the actual AES key. buf is empty, it won't be changed.
func GosaEncryptBuffer(buf *bytes.Buffer, key string) {
	datalen := buf.Len()
	if datalen == 0 {
		return
	}
	ciph, _ := aes.NewCipher([]byte(util.Md5sum(key)))
	crypter := cipher.NewCBCEncrypter(ciph, config.InitializationVector)
	cryptpad := (aes.BlockSize - datalen%aes.BlockSize) &^ aes.BlockSize
	cryptlen := cryptpad + datalen
	b64len := ((cryptlen + 2) / 3) << 2
	for i := datalen; i < b64len; i++ {
		buf.WriteByte(0)
	}
	data := buf.Bytes()
	copy(data[b64len-datalen:], data) // move data back
	idx := b64len - cryptlen
	copy(data[idx:], make([]byte, cryptpad)) // insert 0s in front
	crypter.CryptBlocks(data[idx:], data[idx:])
	util.Base64EncodeInPlace(data, idx)
}

// Like GosaDecrypt() but operates in-place on buf.
// Returns true if decryption successful and false if not.
// If false is returned, the buffer contents may be destroyed, but only
// if further decryption attempts with other keys would be pointless anyway,
// because of some fatal condition (such as the data not being a multiple of
// the cipher's block size).
func GosaDecryptBuffer(buf *bytes.Buffer, key string) bool {
	buf.TrimSpace()

	if buf.Len() < 11 {
		return false
	} // minimum length of unencrypted <xml></xml>

	data := buf.Bytes()
	if string(data[0:5]) == "<xml>" {
		return true
	}

	// Fixes the following:
	// * gosa-si bug in the following line:
	//     if( $client_answer =~ s/session_id=(\d+)$// ) {
	//   This leaves the "." before "session_id" which breaks base64
	// * new gosa-si protocol has ";IP:PORT" appended to message
	//   which also breaks base64
	for semicolon_period := 0; semicolon_period < len(data); semicolon_period++ {
		if data[semicolon_period] == ';' || data[semicolon_period] == '.' {
			buf.Trim(0, semicolon_period)
			data = buf.Bytes()
			break
		}
	}

	aescipher, _ := aes.NewCipher([]byte(util.Md5sum(key)))
	crypter := cipher.NewCBCDecrypter(aescipher, config.InitializationVector)

	cryptotest := make([]byte, (((3*aes.BlockSize)+2)/3)<<2)
	n := copy(cryptotest, data)
	cryptotest = cryptotest[0:n]
	cryptotest = util.Base64DecodeInPlace(cryptotest)
	n = (len(cryptotest) / aes.BlockSize) * aes.BlockSize
	cryptotest = cryptotest[0:n]
	crypter.CryptBlocks(cryptotest, cryptotest)
	if !strings.Contains(string(cryptotest), "<xml>") {
		return false
	}

	data = util.Base64DecodeInPlace(data)
	buf.Trim(0, len(data))
	data = buf.Bytes()

	if buf.Len()%aes.BlockSize != 0 {
		// this condition is fatal => further decryption attempts are pointless
		buf.Reset()
		return false
	}

	crypter = cipher.NewCBCDecrypter(aescipher, config.InitializationVector)
	crypter.CryptBlocks(data, data)

	buf.TrimSpace() // removes 0 padding, too

	return true
}

// Handles the message "gosa_get_log_file_by_date_and_mac".
//  xmlmsg: the decrypted and parsed message
// Returns:
//  unencrypted reply
func gosa_get_log_file_by_date_and_mac(xmlmsg *xml.Hash) *xml.Hash {
	macaddress := xmlmsg.Text("mac")
	lmac := strings.ToLower(macaddress)
	subdir := xmlmsg.Text("date")
	log_file := xmlmsg.Text("log_file")

	header := "get_log_file_by_date_and_mac"
	x := xml.NewHash("xml", "header", header)
	x.Add(header)
	x.Add("source", config.ServerSourceAddress)
	x.Add("target", "GOSA")
	x.Add("session_id", "1")

	if !macAddressRegexp.MatchString(macaddress) {
		emsg := fmt.Sprintf("Illegal or missing <mac> element in message: %v", xmlmsg)
		util.Log(0, "ERROR! %v", emsg)
		return ErrorReplyXML(emsg)
	}

	// As a precaution, make sure subdir and log_file contain no slashes.
	subdir = strings.Replace(subdir, "/", "_", -1)
	log_file = strings.Replace(log_file, "/", "_", -1)

	if subdir == "" {
		// When you open the installation logs in GOsa for the first time, GOsa sends
		// a broken request that is characterized by an empty <date> and log_file==0.
		// If we return an error, GOsa presents it to the user which
		// gives a bad experience. So we instead return an empty reply in this special case.
		if log_file == "0" {
			return x
		}
		emsg := fmt.Sprintf("Missing or empty <date> element in message: %v", xmlmsg)
		util.Log(0, "ERROR! %v", emsg)
		return ErrorReplyXML(emsg)
	}

	if log_file == "" {
		emsg := fmt.Sprintf("Missing or empty <log_file> element in message: %v", xmlmsg)
		util.Log(0, "ERROR! %v", emsg)
		return ErrorReplyXML(emsg)
	}

	f, err := os.Open(path.Join(config.FAILogPath, lmac, subdir, log_file))
	if err != nil {
		emsg := fmt.Sprintf("gosa_get_log_file_by_date_and_mac: %v", err)
		util.Log(0, "ERROR! %v", emsg)
		return ErrorReplyXML(emsg)
	}
	defer f.Close()

	var b bytes.Buffer
	defer b.Reset()
	buffy := make([]byte, 65536)
	for {
		n, err := f.Read(buffy)
		b.Write(buffy[0:n])
		if err == io.EOF {
			break
		}
		if err != nil {
			emsg := fmt.Sprintf("gosa_get_log_file_by_date_and_mac: %v", err)
			util.Log(0, "ERROR! %v", emsg)
			return ErrorReplyXML(emsg)
		}
		if n == 0 {
			util.Log(0, "WARNING! Read returned 0 bytes but no error. Assuming EOF")
			break
		}
	}

	idx := (((b.Len() + 2) / 3) << 2) - b.Len()
	b.Write0(idx)
	data := b.Bytes()
	copy(data[idx:], data)
	data = util.Base64EncodeInPlace(data, idx)

	data_element := x.Add(log_file)

	// To reduce memory leak potential, we append in pieces rather than as one large string
	end := xml.MaxFragmentLength
	for ; end < len(data); end += xml.MaxFragmentLength {
		data_element.AppendString(string(data[end-xml.MaxFragmentLength : end]))
	}
	data_element.AppendString(string(data[end-xml.MaxFragmentLength:]))

	return x
}

// Converts LDIF data into a Hash. The outermost tag will always be "xml".
// If an error occurs the returned Hash may contain partial data but it
// is never nil.
//
//  itemtag: If non-empty, each object in the LDIF will be inside an element
//           whose outermosttag is itemtag. If itemtag == "", all objects in the
//           LDIF are merged, i.e. all their combined attributes are directly
//           inside the surrounding "xml" tag.
//  casefold: If true, all attribute names are converted to lowercase.
//            If false, they are left exactly as found in the LDIF.
//  ldif: A []byte, string, io.Reader or *exec.Cmd that provides the LDIF data.
//        Understands all ldapsearch formats with an arbitrary number of "-L" switches.
//  elementInfo: If one or more ElementInfo structs are passed, only attributes
//        matching one of them will be accepted and the first match in the
//        elementInfo list determines how the attribute in the LDIF will be
//        converted to an element in the result Hash.
//        If casefold==true, matching is done case-insensitive. This requires that
//        the LDIFAttributeName fields are all lowercase.
func LdifToHash(itemtag string, casefold bool, ldif interface{}, elementInfo ...*ElementInfo) (xml *Hash, err error) {
	x := NewHash("xml")

	var xmldata []byte
	switch ld := ldif.(type) {
	case []byte:
		xmldata = ld
	case string:
		xmldata = []byte(ld)
	case io.Reader:
		xmldata, err = ioutil.ReadAll(ld)
		if err != nil {
			return x, err
		}
	case *exec.Cmd:
		var outbuf bytes.Buffer
		defer outbuf.Reset()
		var errbuf bytes.Buffer
		defer errbuf.Reset()
		oldout := ld.Stdout
		olderr := ld.Stderr
		ld.Stdout = &outbuf
		ld.Stderr = &errbuf
		err := ld.Run()
		ld.Stdout = oldout
		ld.Stderr = olderr
		errstr := errbuf.String()
		if errstr != "" {
			err = fmt.Errorf(errstr)
		}
		if err != nil {
			return x, err
		}

		xmldata = outbuf.Bytes()
	default:
		return x, fmt.Errorf("ldif argument has unsupported type")
	}

	item := x
	var attr *Hash
	new_item := true
	end := len(xmldata)
	b64 := false
	var info *ElementInfo = nil
	skip := false

	i := 0
	start := 0
	if !match(xmldata, i, "version:") {
		goto wait_for_item
	}

	///////////////////////////////////////////////////////////////////////
skip_line:
	///////////////////////////////////////////////////////////////////////
	for {
		if i == end {
			goto end_of_input
		}
		if xmldata[i] == '\n' {
			break
		}
		i++
	}
	// Even comments can have line continuations in LDIF, so we need to
	// continue skipping if there is a continuation.
	i++
	if i < end && (xmldata[i] == ' ' || xmldata[i] == '\t') {
		goto skip_line
	}

	///////////////////////////////////////////////////////////////////////
wait_for_item:
	///////////////////////////////////////////////////////////////////////
	new_item = true
	for {
		if i == end {
			goto end_of_input
		}
		if ch := xmldata[i]; ch > ' ' {
			if match(xmldata, i, "# search result") {
//.........这里部分代码省略.........

// Handles the message "CLMSG_save_fai_log".
//  buf: the decrypted message
func clmsg_save_fai_log(buf *bytes.Buffer) {
	macaddress := ""
	action := ""
	start := 0
	end := 0
	data := buf.Bytes()
	for i := 0; i < len(data)-19; i++ {
		if data[i] == '<' {
			if i+12+17 <= len(data) && match(data, i, "<macaddress>") {
				macaddress = string(data[i+12 : i+12+17])
			} else if match(data, i, "<fai_action>") {
				for k := i + 12; k < len(data); k++ {
					if data[k] == '<' {
						action = string(data[i+12 : k])
						i = k
						break
					}
				}
			} else if match(data, i, "<CLMSG_save_fai_log>") {
				start = i + 20
			} else if match(data, i, "</CLMSG_save_fai_log>") {
				end = i
			}
		}
	}

	if !macAddressRegexp.MatchString(macaddress) {
		util.Log(0, "ERROR! CLMSG_save_fai_log with illegal <macaddress> \"%v\"", macaddress)
		return
	}

	if !actionRegexp.MatchString(action) {
		util.Log(0, "ERROR! CLMSG_save_fai_log with illegal <fai_action> \"%v\"", action)
		return
	}

	util.Log(1, "INFO! Received log files from client %v. Assuming CLMSG_PROGRESS 100", macaddress)
	progress_msg := xml.NewHash("xml", "CLMSG_PROGRESS", "100")
	progress_msg.Add("macaddress", macaddress)
	clmsg_progress(progress_msg)

	timestamp := util.MakeTimestamp(time.Now())
	logname := action + "_" + timestamp[0:8] + "_" + timestamp[8:]
	logdir := path.Join(config.FAILogPath, strings.ToLower(macaddress), logname)

	// NOTE: 1kB = 1000B, 1kiB = 1024B
	util.Log(1, "INFO! Storing %vkB of %v log files from %v in %v", len(data)/1000, action, macaddress, logdir)

	err := os.MkdirAll(logdir, 0755)
	if err != nil {
		util.Log(0, "ERROR! Error creating log directory \"%v\": %v", logdir, err)
		return
	}

	// Create convenience symlink with the system's name as alias for MAC address.
	go util.WithPanicHandler(func() {
		if plainname := db.SystemPlainnameForMAC(macaddress); plainname != "none" {
			linkpath := path.Join(config.FAILogPath, strings.ToLower(plainname))
			link_target, err := os.Readlink(linkpath)
			if err != nil && !os.IsNotExist(err.(*os.PathError).Err) {
				util.Log(0, "ERROR! %v exists but is not a symlink: %v", linkpath, err)
				return
			}
			if err == nil {
				if link_target == strings.ToLower(macaddress) {
					return // symlink is already correct => nothing to do
				}

				util.Log(0, "WARNING! Machine %v has a new MAC %v . Removing old symlink %v => %v", plainname, macaddress, linkpath, link_target)
				err = os.Remove(linkpath)
				if err != nil {
					util.Log(0, "ERROR! Removing %v failed: %v", linkpath, err)
					// Don't bail out. Maybe we can create the new symlink anyway.
				}
			}
			err = os.Symlink(strings.ToLower(macaddress), linkpath)
			if err != nil && !os.IsExist(err.(*os.LinkError).Err) {
				util.Log(0, "ERROR! Could not create symlink %v => %v: %v", linkpath, strings.ToLower(macaddress), err)
			}
		}
	})

	files := []int{}
	for i := start; i < end; i++ {
		if data[i] == ':' && match(data, i-8, "log_file") {
			k := i
			i++
			for i < end {
				if data[i] == ':' {
					if k+1 < i {
						files = append(files, k+1, i)
					}
					break
				}
				i++
			}
		}
	}
//.........这里部分代码省略.........

//.........这里部分代码省略.........
	b.WriteString("Der Cottbuser Postkutscher kotzt in den Cottbuser Postkotzkasten")
	n = b.Len()
	c = b.Capacity()
	p = b.Pointer()
	b.Trim(0, b.Len()-6)
	check(b.Len(), n-6)
	check(b.Capacity(), c)
	check(b.Pointer(), p)
	check(b.String(), "Der Cottbuser Postkutscher kotzt in den Cottbuser Postkotz")

	b.Trim(27, b.Len())
	check(b.Len(), n-6-27)
	check(b.Capacity(), c)
	check(b.Pointer(), p)
	check(b.String(), "kotzt in den Cottbuser Postkotz")

	b.Trim(1, b.Len()-1)
	check(b.Len(), n-6-27-2)
	check(b.Capacity(), c)
	check(b.Pointer(), p)
	check(b.String(), "otzt in den Cottbuser Postkot")

	b.Reset()
	b.Write0(-1)
	b.Write0(-100)
	b.Write0(0)
	check(b.Len(), 0)
	check(b.Capacity(), 0)
	check(b.Pointer(), nil)

	b.Write0(1)
	check(b.Len(), 1)
	check(b.Capacity(), 1)
	check(b.Bytes(), []byte{0})

	b.WriteByte(111)
	b.Write0(1)
	b.WriteByte(222)
	b.Write0(2)
	b.WriteByte(99)
	check(b.Len(), 7)
	check(b.Bytes(), []byte{0, 111, 0, 222, 0, 0, 99})

	b2.Reset()
	slices := [][]byte{}
	total := 0
	numfakeerrs := 0
	for total < 100000 {
		c = rand.Intn(30000)
		total += c

		sl := make([]byte, c)
		for i := range sl {
			sl[i] = byte(rand.Intn(256))
		}
		slices = append(slices, sl)
		b2.Write(sl)

		if total/30000 > numfakeerrs {
			slices = append(slices, nil)
			numfakeerrs++
		}
	}

	check(numfakeerrs, 3)

// Reads the output from the program config.PackageListHookPath (LDIF) and
// uses it to replace packagedb.
// debconf is passed as PackageListDebconf environment var to the hook.
// See manual section on package-list-hook for more info.
func PackageListHook(debconf string) {
	start := time.Now()
	timestamp := util.MakeTimestamp(start)

	cmd := exec.Command(config.PackageListHookPath)
	cmd.Env = append(config.HookEnvironment(), os.Environ()...)

	fairepos := []string{}
	for repo := FAIServers().First("repository"); repo != nil; repo = repo.Next() {
		fairepos = append(fairepos, fmt.Sprintf("%v||%v|%v", repo.Text("server"), repo.Text("repopath"), repo.Text("sections")))
	}

	package_list_params := []string{"PackageListDebconf=" + debconf, "PackageListCacheDir=" + config.PackageCacheDir, "PackageListFAIrepository=" + strings.Join(fairepos, " ")}
	cmd.Env = append(cmd.Env, package_list_params...)
	util.Log(1, "INFO! Running package-list-hook: %v %v", strings.Join(package_list_params, " "), config.PackageListHookPath)

	var outbuf bytes.Buffer
	defer outbuf.Reset()
	var errbuf bytes.Buffer
	defer errbuf.Reset()
	cmd.Stdout = &outbuf
	cmd.Stderr = &errbuf
	err := cmd.Run()

	if err != nil {
		util.Log(0, "ERROR! package-list-hook %v: %v (%v)", config.PackageListHookPath, err, errbuf.String())
		return
	} else if errbuf.Len() != 0 {
		// if the command prints to stderr but does not return non-0 exit status (which
		// would result in err != nil), we just log a WARNING, but use the stdout data
		// anyway.
		util.Log(0, "WARNING! package-list-hook %v: %v", config.PackageListHookPath, errbuf.String())
	}

	plist, err := xml.LdifToHash("pkg", true, outbuf.Bytes(), packageListFormat...)
	if err != nil {
		util.Log(0, "ERROR! package-list-hook %v: %v", config.PackageListHookPath, err)
		return
	}
	if plist.First("pkg") == nil {
		util.Log(0, "ERROR! package-list-hook %v returned no data", config.PackageListHookPath)
		return
	}
	util.Log(1, "INFO! Finished package-list-hook. Running time: %v", time.Since(start))

	start = time.Now()

	plist.Rename("packagedb")

	new_mapRepoPath2FAIrelease := map[string]string{}

	accepted := 0
	total := 0

	for pkg := plist.FirstChild(); pkg != nil; pkg = pkg.Next() {
		total++
		p := pkg.Element()

		release := p.First("distribution") // packageListFormat translates "release" => "distribution"
		if release == nil {
			util.Log(0, "ERROR! package-list-hook %v returned entry without \"Release\": %v", config.PackageListHookPath, p)
			pkg.Remove()
			continue
		}

		for repopath := p.First("repository"); repopath != nil; repopath = repopath.Next() {
			new_mapRepoPath2FAIrelease[repopath.Text()] = release.Text()
		}

		pkgname := p.Get("package")
		if len(pkgname) == 0 {
			if p.First("repository") == nil { // Release/Repository groups without Package are okay, so only log error if there is no Repository
				util.Log(0, "ERROR! package-list-hook %v returned entry without \"Package\": %v", config.PackageListHookPath, p)
			}
			pkg.Remove()
			continue
		}

		if len(pkgname) > 1 {
			util.Log(0, "ERROR! package-list-hook %v returned entry with multiple \"Package\" values: %v", config.PackageListHookPath, p)
			pkg.Remove()
			continue
		}

		version := p.First("version")
		if version == nil {
			util.Log(0, "WARNING! package-list-hook %v returned entry for \"%v\" without \"Version\". Assuming \"1.0\"", config.PackageListHookPath, pkgname[0])
			p.Add("version", "1.0")
		}

		section := p.First("section")
		if section == nil {
			util.Log(0, "WARNING! package-list-hook %v returned entry for \"%v\" without \"Section\". Assuming \"main\"", config.PackageListHookPath, pkgname[0])
			p.Add("section", "main")
		}

//.........这里部分代码省略.........

// Takes a possibly encrypted message in buf and processes it, returning a reply.
// context is the security context.
// Returns:
//  buffer containing the reply to return (MUST BE FREED BY CALLER VIA Reset()!)
//  disconnect == true if connection should be terminated due to error
//
// NOTE: buf IS NOT FREED BY THIS FUNCTION BUT ITS CONTENTS ARE CHANGED!
func ProcessEncryptedMessage(buf *bytes.Buffer, context *security.Context) (reply *bytes.Buffer, disconnect bool) {
	if buf.Len() > 4096 {
		util.Log(2, "DEBUG! Processing LONG message: (truncated)%v\n.\n.\n.\n%v", string(buf.Bytes()[0:2048]), string(buf.Bytes()[buf.Len()-2048:]))
	} else {
		util.Log(2, "DEBUG! Processing message: %v", buf.String())
	}

	for attempt := 0; attempt < 4; attempt++ {
		if attempt != 0 && config.TLSRequired {
			util.Log(1, "INFO! [SECURITY] TLS-only mode => Decryption with old protocol will not be attempted")
			//NOTE: This prevents the last ditch attempt to decrypt with all known
			//      server and client keys. This attempt might still have produced a
			//      result in case the connecting party is pre-TLS and we happen to
			//      have its key in our database (from a time before our server was
			//      configured to be TLS-only). However if the admin configured our
			//      server to be TLS-only (by not putting any keys
			//      in the config) we assume that he does not want pre-TLS
			//      parties to connect.
			break
		}
		var keys_to_try []string

		switch attempt {
		case 0:
			keys_to_try = config.ModuleKeys
		case 1:
			host := context.PeerID.IP.String()
			{
				keys_to_try = append(db.ServerKeys(host), db.ClientKeys(host)...)
				if host == "127.0.0.1" { // make sure we find the key even if registered under our external IP address
					keys_to_try = append(db.ServerKeys(config.IP), db.ClientKeys(config.IP)...)
				}
			}
		case 2:
			util.Log(1, "INFO! Last resort attempt to decrypt message from %v with all server keys", context.PeerID.IP)
			keys_to_try = db.ServerKeysForAllServers()
		case 3:
			util.Log(1, "INFO! Last resort attempt to decrypt message from %v with all client keys", context.PeerID.IP)
			keys_to_try = db.ClientKeysForAllClients()
		}

		for _, key := range keys_to_try {
			if security.GosaDecryptBuffer(buf, key) {
				if buf.Len() > 4096 {
					util.Log(2, "DEBUG! Decrypted LONG message from %v with key %v: (truncated)%v\n.\n.\n.\n%v", context.PeerID.IP, key, string(buf.Bytes()[0:2048]), string(buf.Bytes()[buf.Len()-2048:]))
				} else {
					util.Log(2, "DEBUG! Decrypted message from %v with key %v: %v", context.PeerID.IP, key, buf.String())
				}

				// special case for CLMSG_save_fai_log because this kind of message
				// is so large and parsing it to XML doesn't really gain us anything.
				if buf.Contains("<CLMSG_save_fai_log>") {
					if handleServerMessage() {
						clmsg_save_fai_log(buf)
					}
					return &bytes.Buffer{}, false
				}

				xml, err := xml.StringToHash(buf.String())
				if err != nil {
					util.Log(0, "ERROR! %v", err)
					return ErrorReplyBuffer(err), true
				}

				// At this point we have successfully decrypted and parsed the message
				return ProcessXMLMessage(xml, context, key)
			}
		}
	}

	// This part is only reached if none of the keys opened the message
	util.Log(0, "ERROR! Could not decrypt message from %v", context.PeerID.IP)

	// Maybe we got out of sync with the sender's encryption key
	// (e.g. by missing a new_key message). Try to re-establish communcation.
	ip := context.PeerID.IP.To4()
	if ip == nil {
		util.Log(0, "ERROR! Cannot convert sender address to IPv4 address: %v", context.PeerID.IP)
	} else {
		go tryToReestablishCommunicationWith(ip.String())
	}

	return ErrorReplyBuffer("Could not decrypt message"), true
}