src/PVE/AccessControl.pm

   1 package PVE::AccessControl;
   2
   3 use strict;
   4 use warnings;
   5 use Encode;
   6 use Crypt::OpenSSL::Random;
   7 use Crypt::OpenSSL::RSA;
   8 use Net::SSLeay;
   9 use Net::IP;
  10 use MIME::Base64;
  11 use Digest::SHA;
  12 use IO::File;
  13 use File::stat;
  14 use JSON;
  15
  16 use PVE::OTP;
  17 use PVE::Ticket;
  18 use PVE::Tools qw(run_command lock_file file_get_contents split_list safe_print);
  19 use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file);
  20 use PVE::JSONSchema qw(register_standard_option get_standard_option);
  21
  22 use PVE::RS::TFA;
  23
  24 use PVE::Auth::Plugin;
  25 use PVE::Auth::AD;
  26 use PVE::Auth::LDAP;
  27 use PVE::Auth::PVE;
  28 use PVE::Auth::PAM;
  29 use PVE::Auth::OpenId;
  30
  31 # load and initialize all plugins
  32
  33 PVE::Auth::AD->register();
  34 PVE::Auth::LDAP->register();
  35 PVE::Auth::PVE->register();
  36 PVE::Auth::PAM->register();
  37 PVE::Auth::OpenId->register();
  38 PVE::Auth::Plugin->init();
  39
  40 # $authdir must be writable by root only!
  41 my $confdir = "/etc/pve";
  42 my $authdir = "$confdir/priv";
  43
  44 my $pve_www_key_fn = "$confdir/pve-www.key";
  45
  46 my $pve_auth_key_files = {
  47     priv => "$authdir/authkey.key",
  48     pub =>  "$confdir/authkey.pub",
  49     pubold => "$confdir/authkey.pub.old",
  50 };
  51
  52 my $pve_auth_key_cache = {};
  53
  54 my $ticket_lifetime = 3600 * 2; # 2 hours
  55 my $auth_graceperiod = 60 * 5; # 5 minutes
  56 my $authkey_lifetime = 3600 * 24; # rotate every 24 hours
  57
  58 Crypt::OpenSSL::RSA->import_random_seed();
  59
  60 cfs_register_file('user.cfg', \&parse_user_config, \&write_user_config);
  61 cfs_register_file('priv/tfa.cfg', \&parse_priv_tfa_config, \&write_priv_tfa_config);
  62
  63 sub verify_username {
  64     PVE::Auth::Plugin::verify_username(@_);
  65 }
  66
  67 sub pve_verify_realm {
  68     PVE::Auth::Plugin::pve_verify_realm(@_);
  69 }
  70
  71 sub lock_user_config {
  72     my ($code, $errmsg) = @_;
  73
  74     cfs_lock_file("user.cfg", undef, $code);
  75     if (my $err = $@) {
  76         $errmsg ? die "$errmsg: $err" : die $err;
  77     }
  78 }
  79
  80 sub lock_tfa_config {
  81     my ($code, $errmsg) = @_;
  82
  83     my $res = cfs_lock_file("priv/tfa.cfg", undef, $code);
  84     if (my $err = $@) {
  85         $errmsg ? die "$errmsg: $err" : die $err;
  86     }
  87
  88     return $res;
  89 }
  90
  91 my $cache_read_key = sub {
  92     my ($type) = @_;
  93
  94     my $path = $pve_auth_key_files->{$type};
  95
  96     my $read_key_and_mtime = sub {
  97         my $fh = IO::File->new($path, "r");
  98
  99         return undef if !defined($fh);
 100
 101         my $st = stat($fh);
 102         my $pem = PVE::Tools::safe_read_from($fh, 0, 0, $path);
 103
 104         close $fh;
 105
 106         my $key;
 107         if ($type eq 'pub' || $type eq 'pubold') {
 108             $key = eval { Crypt::OpenSSL::RSA->new_public_key($pem); };
 109         } elsif ($type eq 'priv') {
 110             $key = eval { Crypt::OpenSSL::RSA->new_private_key($pem); };
 111         } else {
 112             die "Invalid authkey type '$type'\n";
 113         }
 114
 115         return { key => $key, mtime => $st->mtime };
 116     };
 117
 118     if (!defined($pve_auth_key_cache->{$type})) {
 119         $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 120     } else {
 121         my $st = stat($path);
 122         if (!$st || $st->mtime != $pve_auth_key_cache->{$type}->{mtime}) {
 123             $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 124         }
 125     }
 126
 127     return $pve_auth_key_cache->{$type};
 128 };
 129
 130 sub get_pubkey {
 131     my ($old) = @_;
 132
 133     my $type = $old ? 'pubold' : 'pub';
 134
 135     my $res = $cache_read_key->($type);
 136     return undef if !defined($res);
 137
 138     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 139 }
 140
 141 sub get_privkey {
 142     my $res = $cache_read_key->('priv');
 143
 144     if (!defined($res) || !check_authkey(1)) {
 145         rotate_authkey();
 146         $res = $cache_read_key->('priv');
 147     }
 148
 149     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 150 }
 151
 152 sub check_authkey {
 153     my ($quiet) = @_;
 154
 155     # skip check if non-quorate, as rotation is not possible anyway
 156     return 1 if !PVE::Cluster::check_cfs_quorum(1);
 157
 158     my ($pub_key, $mtime) = get_pubkey();
 159     if (!$pub_key) {
 160         warn "auth key pair missing, generating new one..\n"  if !$quiet;
 161         return 0;
 162     } else {
 163         my $now = time();
 164         if ($now - $mtime >= $authkey_lifetime) {
 165             warn "auth key pair too old, rotating..\n" if !$quiet;;
 166             return 0;
 167         } elsif ($mtime > $now + $auth_graceperiod) {
 168             # a nodes RTC had a time set in the future during key generation -> ticket
 169             # validity is clamped to 0+5 min grace period until now >= mtime again
 170             my (undef, $old_mtime) = get_pubkey(1);
 171             if ($old_mtime && $mtime >= $old_mtime && $mtime - $old_mtime < $ticket_lifetime) {
 172                 warn "auth key pair generated in the future (key $mtime > host $now),"
 173                     ." but old key still exists and in valid grace period so avoid automatic"
 174                     ." fixup. Cluster time not in sync?\n" if !$quiet;
 175                 return 1;
 176             }
 177             warn "auth key pair generated in the future (key $mtime > host $now), rotating..\n" if !$quiet;
 178             return 0;
 179         } else {
 180             warn "auth key new enough, skipping rotation\n" if !$quiet;;
 181             return 1;
 182         }
 183     }
 184 }
 185
 186 sub rotate_authkey {
 187     return if $authkey_lifetime == 0;
 188
 189     PVE::Cluster::cfs_lock_authkey(undef, sub {
 190         # re-check with lock to avoid double rotation in clusters
 191         return if check_authkey();
 192
 193         my $old = get_pubkey();
 194         my $new = Crypt::OpenSSL::RSA->generate_key(2048);
 195
 196         if ($old) {
 197             eval {
 198                 my $pem = $old->get_public_key_x509_string();
 199                 # mtime is used for caching and ticket age range calculation
 200                 PVE::Tools::file_set_contents($pve_auth_key_files->{pubold}, $pem);
 201             };
 202             die "Failed to store old auth key: $@\n" if $@;
 203         }
 204
 205         eval {
 206             my $pem = $new->get_public_key_x509_string();
 207             # mtime is used for caching and ticket age range calculation,
 208             # should be close to that of pubold above
 209             PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 210         };
 211         if ($@) {
 212             if ($old) {
 213                 warn "Failed to store new auth key - $@\n";
 214                 warn "Reverting to previous auth key\n";
 215                 eval {
 216                     my $pem = $old->get_public_key_x509_string();
 217                     PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 218                 };
 219                 die "Failed to restore old auth key: $@\n" if $@;
 220             } else {
 221                 die "Failed to store new auth key - $@\n";
 222             }
 223         }
 224
 225         eval {
 226             my $pem = $new->get_private_key_string();
 227             PVE::Tools::file_set_contents($pve_auth_key_files->{priv}, $pem);
 228         };
 229         if ($@) {
 230             warn "Failed to store new auth key - $@\n";
 231             warn "Deleting auth key to force regeneration\n";
 232             unlink $pve_auth_key_files->{pub};
 233             unlink $pve_auth_key_files->{priv};
 234         }
 235     });
 236     die $@ if $@;
 237 }
 238
 239 PVE::JSONSchema::register_standard_option('tokenid', {
 240     description => "API token identifier.",
 241     type => "string",
 242     format => "pve-tokenid",
 243 });
 244
 245 our $token_subid_regex = $PVE::Auth::Plugin::realm_regex;
 246
 247 # username@realm username realm tokenid
 248 our $token_full_regex = qr/((${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex}))!(${token_subid_regex})/;
 249
 250 our $userid_or_token_regex = qr/^$PVE::Auth::Plugin::user_regex\@$PVE::Auth::Plugin::realm_regex(?:!$token_subid_regex)?$/;
 251
 252 sub split_tokenid {
 253     my ($tokenid, $noerr) = @_;
 254
 255     if ($tokenid =~ /^${token_full_regex}$/) {
 256         return ($1, $4);
 257     }
 258
 259     die "'$tokenid' is not a valid token ID - not able to split into user and token parts\n" if !$noerr;
 260
 261     return undef;
 262 }
 263
 264 sub join_tokenid {
 265     my ($username, $tokensubid) = @_;
 266
 267     my $joined = "${username}!${tokensubid}";
 268
 269     return pve_verify_tokenid($joined);
 270 }
 271
 272 PVE::JSONSchema::register_format('pve-tokenid', \&pve_verify_tokenid);
 273 sub pve_verify_tokenid {
 274     my ($tokenid, $noerr) = @_;
 275
 276     if ($tokenid =~ /^${token_full_regex}$/) {
 277         return wantarray ? ($tokenid, $2, $3, $4) : $tokenid;
 278     }
 279
 280     die "value '$tokenid' does not look like a valid token ID\n" if !$noerr;
 281
 282     return undef;
 283 }
 284
 285
 286 my $csrf_prevention_secret;
 287 my $csrf_prevention_secret_legacy;
 288 my $get_csrfr_secret = sub {
 289     if (!$csrf_prevention_secret) {
 290         my $input = PVE::Tools::file_get_contents($pve_www_key_fn);
 291         $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input);
 292         $csrf_prevention_secret_legacy = Digest::SHA::sha1_base64($input);
 293     }
 294     return $csrf_prevention_secret;
 295 };
 296
 297 sub assemble_csrf_prevention_token {
 298     my ($username) = @_;
 299
 300     my $secret =  &$get_csrfr_secret();
 301
 302     return PVE::Ticket::assemble_csrf_prevention_token ($secret, $username);
 303 }
 304
 305 sub verify_csrf_prevention_token {
 306     my ($username, $token, $noerr) = @_;
 307
 308     my $secret = $get_csrfr_secret->();
 309
 310     # FIXME: remove with PVE 7 and/or refactor all into PVE::Ticket ?
 311     if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) {
 312         my $sig = $2;
 313         if (length($sig) == 27) {
 314             # the legacy secret got populated by above get_csrfr_secret call
 315             $secret = $csrf_prevention_secret_legacy;
 316         }
 317     }
 318
 319     return PVE::Ticket::verify_csrf_prevention_token(
 320         $secret, $username, $token, -$auth_graceperiod, $ticket_lifetime, $noerr);
 321 }
 322
 323 my $get_ticket_age_range = sub {
 324     my ($now, $mtime, $rotated) = @_;
 325
 326     my $key_age = $now - $mtime;
 327     $key_age = 0 if $key_age < 0;
 328
 329     my $min = -$auth_graceperiod;
 330     my $max = $ticket_lifetime;
 331
 332     if ($rotated) {
 333         # ticket creation after rotation is not allowed
 334         $min = $key_age - $auth_graceperiod;
 335     } else {
 336         if ($key_age > $authkey_lifetime && $authkey_lifetime > 0) {
 337             if (PVE::Cluster::check_cfs_quorum(1)) {
 338                 # key should have been rotated, clamp range accordingly
 339                 $min = $key_age - $authkey_lifetime;
 340             } else {
 341                 warn "Cluster not quorate - extending auth key lifetime!\n";
 342             }
 343         }
 344
 345         $max = $key_age + $auth_graceperiod if $key_age < $ticket_lifetime;
 346     }
 347
 348     return undef if $min > $ticket_lifetime;
 349     return ($min, $max);
 350 };
 351
 352 sub assemble_ticket : prototype($;$) {
 353     my ($data, $aad) = @_;
 354
 355     my $rsa_priv = get_privkey();
 356
 357     return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PVE', $data, $aad);
 358 }
 359
 360 # Returns the username, "age" and tfa info.
 361 #
 362 # Note that for the new-style outh, tfa info is never set, as it only uses the `/ticket` api call
 363 # via the new 'tfa-challenge' parameter, so this part can go with PVE-8.
 364 #
 365 # New-style auth still uses this function, but sets `$tfa_ticket` to true when validating the tfa
 366 # ticket.
 367 sub verify_ticket : prototype($;$$) {
 368     my ($ticket, $noerr, $tfa_ticket_aad) = @_;
 369
 370     my $now = time();
 371
 372     my $check = sub {
 373         my ($old) = @_;
 374
 375         my ($rsa_pub, $rsa_mtime) = get_pubkey($old);
 376         return undef if !$rsa_pub;
 377
 378         my ($min, $max) = $get_ticket_age_range->($now, $rsa_mtime, $old);
 379         return undef if !defined($min);
 380
 381         return PVE::Ticket::verify_rsa_ticket(
 382             $rsa_pub, 'PVE', $ticket, $tfa_ticket_aad, $min, $max, 1);
 383     };
 384
 385     my ($data, $age) = $check->();
 386
 387     # check with old, rotated key if current key failed
 388     ($data, $age) = $check->(1) if !defined($data);
 389
 390     my $auth_failure = sub {
 391         if ($noerr) {
 392             return undef;
 393         } else {
 394             # raise error via undef ticket
 395             PVE::Ticket::verify_rsa_ticket(undef, 'PVE');
 396         }
 397     };
 398
 399     if (!defined($data)) {
 400         return $auth_failure->();
 401     }
 402
 403     if ($tfa_ticket_aad) {
 404         # We're validating a ticket-call's 'tfa-challenge' parameter, so just return its data.
 405         if ($data =~ /^!tfa!(.*)$/) {
 406             return $1;
 407         }
 408         die "bad ticket\n";
 409     }
 410
 411     my ($username, $tfa_info);
 412     if ($data =~ /^!tfa!(.*)$/) {
 413         # PBS style half-authenticated ticket, contains a json string form of a `TfaChallenge`
 414         # object.
 415         # This type of ticket does not contain the user name.
 416         return { type => 'new', data => $1 };
 417     }
 418     if ($data =~ m{^u2f!([^!]+)!([0-9a-zA-Z/.=_\-+]+)$}) {
 419         # Ticket for u2f-users:
 420         ($username, my $challenge) = ($1, $2);
 421         if ($challenge eq 'verified') {
 422             # u2f challenge was completed
 423             $challenge = undef;
 424         } elsif (!wantarray) {
 425             # The caller is not aware there could be an ongoing challenge,
 426             # so we treat this ticket as invalid:
 427             return $auth_failure->();
 428         }
 429         $tfa_info = {
 430             type => 'u2f',
 431             challenge => $challenge,
 432         };
 433     } elsif ($data =~ /^tfa!(.*)$/) {
 434         # TOTP and Yubico don't require a challenge so this is the generic
 435         # 'missing 2nd factor ticket'
 436         $username = $1;
 437         $tfa_info = { type => 'tfa' };
 438     } else {
 439         # Regular ticket (full access)
 440         $username = $data;
 441     }
 442
 443     return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
 444
 445     return wantarray ? ($username, $age, $tfa_info) : $username;
 446 }
 447
 448 sub verify_token {
 449     my ($api_token) = @_;
 450
 451     die "no API token specified\n" if !$api_token;
 452
 453     my ($tokenid, $value);
 454     if ($api_token =~ /^(.*)=(.*)$/) {
 455         $tokenid = $1;
 456         $value = $2;
 457     } else {
 458         die "no tokenid specified\n";
 459     }
 460
 461     my ($username, $token) = split_tokenid($tokenid);
 462
 463     my $usercfg = cfs_read_file('user.cfg');
 464     check_user_enabled($usercfg, $username);
 465     check_token_exist($usercfg, $username, $token);
 466
 467     my $user = $usercfg->{users}->{$username};
 468     my $token_info = $user->{tokens}->{$token};
 469
 470     my $ctime = time();
 471     die "token expired\n" if $token_info->{expire} && ($token_info->{expire} < $ctime);
 472
 473     die "invalid token value!\n" if !PVE::Cluster::verify_token($tokenid, $value);
 474
 475     return wantarray ? ($tokenid) : $tokenid;
 476 }
 477
 478
 479 # VNC tickets
 480 # - they do not contain the username in plain text
 481 # - they are restricted to a specific resource path (example: '/vms/100')
 482 sub assemble_vnc_ticket {
 483     my ($username, $path) = @_;
 484
 485     my $rsa_priv = get_privkey();
 486
 487     $path = normalize_path($path);
 488
 489     my $secret_data = "$username:$path";
 490
 491     return PVE::Ticket::assemble_rsa_ticket(
 492         $rsa_priv, 'PVEVNC', undef, $secret_data);
 493 }
 494
 495 sub verify_vnc_ticket {
 496     my ($ticket, $username, $path, $noerr) = @_;
 497
 498     my $secret_data = "$username:$path";
 499
 500     my ($rsa_pub, $rsa_mtime) = get_pubkey();
 501     if (!$rsa_pub || (time() - $rsa_mtime > $authkey_lifetime && $authkey_lifetime > 0)) {
 502         if ($noerr) {
 503             return undef;
 504         } else {
 505             # raise error via undef ticket
 506             PVE::Ticket::verify_rsa_ticket($rsa_pub, 'PVEVNC');
 507         }
 508     }
 509
 510     return PVE::Ticket::verify_rsa_ticket(
 511         $rsa_pub, 'PVEVNC', $ticket, $secret_data, -20, 40, $noerr);
 512 }
 513
 514 sub assemble_spice_ticket {
 515     my ($username, $vmid, $node) = @_;
 516
 517     my $secret = &$get_csrfr_secret();
 518
 519     return PVE::Ticket::assemble_spice_ticket(
 520         $secret, $username, $vmid, $node);
 521 }
 522
 523 sub verify_spice_connect_url {
 524     my ($connect_str) = @_;
 525
 526     my $secret = &$get_csrfr_secret();
 527
 528     return PVE::Ticket::verify_spice_connect_url($secret, $connect_str);
 529 }
 530
 531 sub read_x509_subject_spice {
 532     my ($filename) = @_;
 533
 534     # read x509 subject
 535     my $bio = Net::SSLeay::BIO_new_file($filename, 'r');
 536     die "Could not open $filename using OpenSSL\n"
 537         if !$bio;
 538
 539     my $x509 = Net::SSLeay::PEM_read_bio_X509($bio);
 540     Net::SSLeay::BIO_free($bio);
 541
 542     die "Could not parse X509 certificate in $filename\n"
 543         if !$x509;
 544
 545     my $nameobj = Net::SSLeay::X509_get_subject_name($x509);
 546     my $subject = Net::SSLeay::X509_NAME_oneline($nameobj);
 547     Net::SSLeay::X509_free($x509);
 548
 549     # remote-viewer wants comma as seperator (not '/')
 550     $subject =~ s!^/!!;
 551     $subject =~ s!/(\w+=)!,$1!g;
 552
 553     return $subject;
 554 }
 555
 556 # helper to generate SPICE remote-viewer configuration
 557 sub remote_viewer_config {
 558     my ($authuser, $vmid, $node, $proxy, $title, $port) = @_;
 559
 560     if (!$proxy) {
 561         my $host = `hostname -f` || PVE::INotify::nodename();
 562         chomp $host;
 563         $proxy = $host;
 564     }
 565
 566     my ($ticket, $proxyticket) = assemble_spice_ticket($authuser, $vmid, $node);
 567
 568     my $filename = "/etc/pve/local/pve-ssl.pem";
 569     my $subject = read_x509_subject_spice($filename);
 570
 571     my $cacert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192);
 572     $cacert =~ s/\n/\\n/g;
 573
 574     $proxy = "[$proxy]" if Net::IP::ip_is_ipv6($proxy);
 575     my $config = {
 576         'secure-attention' => "Ctrl+Alt+Ins",
 577         'toggle-fullscreen' => "Shift+F11",
 578         'release-cursor' => "Ctrl+Alt+R",
 579         type => 'spice',
 580         title => $title,
 581         host => $proxyticket, # this breaks tls hostname verification, so we need to use 'host-subject'
 582         proxy => "http://$proxy:3128",
 583         'tls-port' => $port,
 584         'host-subject' => $subject,
 585         ca => $cacert,
 586         password => $ticket,
 587         'delete-this-file' => 1,
 588     };
 589
 590     return ($ticket, $proxyticket, $config);
 591 }
 592
 593 sub check_user_exist {
 594     my ($usercfg, $username, $noerr) = @_;
 595
 596     $username = PVE::Auth::Plugin::verify_username($username, $noerr);
 597     return undef if !$username;
 598
 599     return $usercfg->{users}->{$username} if $usercfg && $usercfg->{users}->{$username};
 600
 601     die "no such user ('$username')\n" if !$noerr;
 602
 603     return undef;
 604 }
 605
 606 sub check_user_enabled {
 607     my ($usercfg, $username, $noerr) = @_;
 608
 609     my $data = check_user_exist($usercfg, $username, $noerr);
 610     return undef if !$data;
 611
 612     return 1 if $data->{enable};
 613
 614     die "user '$username' is disabled\n" if !$noerr;
 615
 616     my $ctime = time();
 617     my $expire = $usercfg->{users}->{$username}->{expire};
 618
 619     die "account expired\n" if $expire && ($expire < $ctime);
 620
 621     return undef;
 622 }
 623
 624 sub check_token_exist {
 625     my ($usercfg, $username, $tokenid, $noerr) = @_;
 626
 627     my $user = check_user_exist($usercfg, $username, $noerr);
 628     return undef if !$user;
 629
 630     return $user->{tokens}->{$tokenid}
 631         if defined($user->{tokens}) && $user->{tokens}->{$tokenid};
 632
 633     die "no such token '$tokenid' for user '$username'\n" if !$noerr;
 634
 635     return undef;
 636 }
 637
 638 # deprecated
 639 sub verify_one_time_pw {
 640     my ($type, $username, $keys, $tfa_cfg, $otp) = @_;
 641
 642     die "missing one time password for two-factor authentication '$type'\n" if !$otp;
 643
 644     # fixme: proxy support?
 645     my $proxy;
 646
 647     if ($type eq 'yubico') {
 648         PVE::OTP::yubico_verify_otp($otp, $keys, $tfa_cfg->{url},
 649                                     $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
 650     } elsif ($type eq 'oath') {
 651         PVE::OTP::oath_verify_otp($otp, $keys, $tfa_cfg->{step}, $tfa_cfg->{digits});
 652     } else {
 653         die "unknown tfa type '$type'\n";
 654     }
 655 }
 656
 657 # password should be utf8 encoded
 658 # Note: some plugins delay/sleep if auth fails
 659 sub authenticate_user : prototype($$$$;$) {
 660     my ($username, $password, $otp, $new_format, $tfa_challenge) = @_;
 661
 662     die "no username specified\n" if !$username;
 663
 664     my ($ruid, $realm);
 665
 666     ($username, $ruid, $realm) = PVE::Auth::Plugin::verify_username($username);
 667
 668     my $usercfg = cfs_read_file('user.cfg');
 669
 670     check_user_enabled($usercfg, $username);
 671
 672     my $domain_cfg = cfs_read_file('domains.cfg');
 673
 674     my $cfg = $domain_cfg->{ids}->{$realm};
 675     die "auth domain '$realm' does not exist\n" if !$cfg;
 676     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 677
 678     if ($tfa_challenge) {
 679         # This is the 2nd factor, use the password for the OTP response.
 680         my $tfa_challenge = authenticate_2nd_new($username, $realm, $password, $tfa_challenge);
 681         return wantarray ? ($username, $tfa_challenge) : $username;
 682     }
 683
 684     $plugin->authenticate_user($cfg, $realm, $ruid, $password);
 685
 686     if ($new_format) {
 687         # This is the first factor with an optional immediate 2nd factor for TOTP:
 688         my $tfa_challenge = authenticate_2nd_new($username, $realm, $otp, $tfa_challenge);
 689         return wantarray ? ($username, $tfa_challenge) : $username;
 690     } else {
 691         return authenticate_2nd_old($username, $realm, $otp);
 692     }
 693 }
 694
 695 sub authenticate_2nd_old : prototype($$$) {
 696     my ($username, $realm, $otp) = @_;
 697
 698     my ($type, $tfa_data) = user_get_tfa($username, $realm, 0);
 699     if ($type) {
 700         if ($type eq 'u2f') {
 701             # Note that if the user did not manage to complete the initial u2f registration
 702             # challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
 703             $tfa_data = undef if exists $tfa_data->{challenge};
 704         } elsif (!defined($otp)) {
 705             # The user requires a 2nd factor but has not provided one. Return success but
 706             # don't clear $tfa_data.
 707         } else {
 708             my $keys = $tfa_data->{keys};
 709             my $tfa_cfg = $tfa_data->{config};
 710             verify_one_time_pw($type, $username, $keys, $tfa_cfg, $otp);
 711             $tfa_data = undef;
 712         }
 713
 714         # Return the type along with the rest:
 715         if ($tfa_data) {
 716             $tfa_data = {
 717                 type => $type,
 718                 data => $tfa_data,
 719             };
 720         }
 721     }
 722
 723     return wantarray ? ($username, $tfa_data) : $username;
 724 }
 725
 726 # Returns a tfa challenge or undef.
 727 sub authenticate_2nd_new : prototype($$$$) {
 728     my ($username, $realm, $otp, $tfa_challenge) = @_;
 729
 730     my $result = lock_tfa_config(sub {
 731         my ($tfa_cfg, $realm_tfa) = user_get_tfa($username, $realm, 1);
 732
 733         if (!defined($tfa_cfg)) {
 734             return undef;
 735         }
 736
 737         my $realm_type = $realm_tfa && $realm_tfa->{type};
 738         if (defined($realm_type) && $realm_type eq 'yubico') {
 739             # Yubico auth will not be supported in rust for now...
 740             if (!defined($tfa_challenge)) {
 741                 my $challenge = { yubico => JSON::true };
 742                 # Even with yubico auth we do allow recovery keys to be used:
 743                 if (my $recovery = $tfa_cfg->recovery_state($username)) {
 744                     $challenge->{recovery} = $recovery;
 745                 }
 746                 return to_json($challenge);
 747             }
 748
 749             if ($otp =~ /^yubico:(.*)$/) {
 750                 $otp = $1;
 751                 # Defer to after unlocking the TFA config:
 752                 return sub {
 753                     authenticate_yubico_new($tfa_cfg, $username, $realm_tfa, $tfa_challenge, $otp);
 754                 };
 755             }
 756
 757             # Beside the realm configured auth we only allow recovery keys:
 758             if ($otp !~ /^recovery:/) {
 759                 die "realm requires yubico authentication\n";
 760             }
 761         }
 762
 763         configure_u2f_and_wa($tfa_cfg);
 764
 765         my $must_save = 0;
 766         if (defined($tfa_challenge)) {
 767             $tfa_challenge = verify_ticket($tfa_challenge, 0, $username);
 768             $must_save = $tfa_cfg->authentication_verify($username, $tfa_challenge, $otp);
 769             $tfa_challenge = undef;
 770         } else {
 771             $tfa_challenge = $tfa_cfg->authentication_challenge($username);
 772             if (defined($otp)) {
 773                 if (defined($tfa_challenge)) {
 774                     $must_save = $tfa_cfg->authentication_verify($username, $tfa_challenge, $otp);
 775                 } else {
 776                     die "no such challenge\n";
 777                 }
 778             }
 779         }
 780
 781         if ($must_save) {
 782             cfs_write_file('priv/tfa.cfg', $tfa_cfg);
 783         }
 784
 785         return $tfa_challenge;
 786     });
 787
 788     # Yubico auth returns the authentication sub:
 789     if (ref($result) eq 'CODE') {
 790         $result = $result->();
 791     }
 792
 793     return $result;
 794 }
 795
 796 sub authenticate_yubico_new : prototype($$$) {
 797     my ($tfa_cfg, $username, $realm, $tfa_challenge, $otp) = @_;
 798
 799     $tfa_challenge = verify_ticket($tfa_challenge, 0, $username);
 800     $tfa_challenge = from_json($tfa_challenge);
 801
 802     if (!$tfa_challenge->{yubico}) {
 803         die "no such challenge\n";
 804     }
 805
 806     my $keys = $tfa_cfg->get_yubico_keys($username);
 807     die "no keys configured\n" if !defined($keys) || !length($keys);
 808
 809     # Defer to after unlocking the TFA config:
 810
 811     # fixme: proxy support?
 812     my $proxy;
 813     PVE::OTP::yubico_verify_otp($otp, $keys, $realm->{url}, $realm->{id}, $realm->{key}, $proxy);
 814
 815     # return `undef` to clear the tfa challenge.
 816     return undef;
 817 }
 818
 819 sub configure_u2f_and_wa : prototype($) {
 820     my ($tfa_cfg) = @_;
 821
 822     my $dc = cfs_read_file('datacenter.cfg');
 823     if (my $u2f = $dc->{u2f}) {
 824         my $origin = $u2f->{origin};
 825         if (!defined($origin)) {
 826             my $rpcenv = PVE::RPCEnvironment::get();
 827             $origin = $rpcenv->get_request_host(1);
 828             if ($origin) {
 829                 $origin = "https://$origin";
 830             } else {
 831                 die "failed to figure out u2f origin\n";
 832             }
 833         }
 834         $tfa_cfg->set_u2f_config({
 835             origin => $origin,
 836             appid => $u2f->{appid},
 837         });
 838     }
 839     if (my $wa = $dc->{webauthn}) {
 840         $tfa_cfg->set_webauthn_config($wa);
 841     }
 842 }
 843
 844 sub domain_set_password {
 845     my ($realm, $username, $password) = @_;
 846
 847     die "no auth domain specified" if !$realm;
 848
 849     my $domain_cfg = cfs_read_file('domains.cfg');
 850
 851     my $cfg = $domain_cfg->{ids}->{$realm};
 852     die "auth domain '$realm' does not exist\n" if !$cfg;
 853     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 854     $plugin->store_password($cfg, $realm, $username, $password);
 855 }
 856
 857 sub add_user_group {
 858     my ($username, $usercfg, $group) = @_;
 859
 860     $usercfg->{users}->{$username}->{groups}->{$group} = 1;
 861     $usercfg->{groups}->{$group}->{users}->{$username} = 1;
 862 }
 863
 864 sub delete_user_group {
 865     my ($username, $usercfg) = @_;
 866
 867     foreach my $group (keys %{$usercfg->{groups}}) {
 868
 869         delete ($usercfg->{groups}->{$group}->{users}->{$username})
 870             if $usercfg->{groups}->{$group}->{users}->{$username};
 871     }
 872 }
 873
 874 sub delete_user_acl {
 875     my ($username, $usercfg) = @_;
 876
 877     foreach my $acl (keys %{$usercfg->{acl}}) {
 878
 879         delete ($usercfg->{acl}->{$acl}->{users}->{$username})
 880             if $usercfg->{acl}->{$acl}->{users}->{$username};
 881     }
 882 }
 883
 884 sub delete_group_acl {
 885     my ($group, $usercfg) = @_;
 886
 887     foreach my $acl (keys %{$usercfg->{acl}}) {
 888
 889         delete ($usercfg->{acl}->{$acl}->{groups}->{$group})
 890             if $usercfg->{acl}->{$acl}->{groups}->{$group};
 891     }
 892 }
 893
 894 sub delete_pool_acl {
 895     my ($pool, $usercfg) = @_;
 896
 897     my $path = "/pool/$pool";
 898
 899     delete ($usercfg->{acl}->{$path})
 900 }
 901
 902 # we automatically create some predefined roles by splitting privs
 903 # into 3 groups (per category)
 904 # root: only root is allowed to do that
 905 # admin: an administrator can to that
 906 # user: a normal user/customer can to that
 907 my $privgroups = {
 908     VM => {
 909         root => [],
 910         admin => [
 911             'VM.Config.Disk',
 912             'VM.Config.CPU',
 913             'VM.Config.Memory',
 914             'VM.Config.Network',
 915             'VM.Config.HWType',
 916             'VM.Config.Options', # covers all other things
 917             'VM.Allocate',
 918             'VM.Clone',
 919             'VM.Migrate',
 920             'VM.Monitor',
 921             'VM.Snapshot',
 922             'VM.Snapshot.Rollback',
 923         ],
 924         user => [
 925             'VM.Config.CDROM', # change CDROM media
 926             'VM.Config.Cloudinit',
 927             'VM.Console',
 928             'VM.Backup',
 929             'VM.PowerMgmt',
 930         ],
 931         audit => [
 932             'VM.Audit',
 933         ],
 934     },
 935     Sys => {
 936         root => [
 937             'Sys.PowerMgmt',
 938             'Sys.Modify', # edit/change node settings
 939         ],
 940         admin => [
 941             'Permissions.Modify',
 942             'Sys.Console',
 943             'Sys.Syslog',
 944         ],
 945         user => [],
 946         audit => [
 947             'Sys.Audit',
 948         ],
 949     },
 950     Datastore => {
 951         root => [],
 952         admin => [
 953             'Datastore.Allocate',
 954             'Datastore.AllocateTemplate',
 955         ],
 956         user => [
 957             'Datastore.AllocateSpace',
 958         ],
 959         audit => [
 960             'Datastore.Audit',
 961         ],
 962     },
 963     SDN => {
 964         root => [],
 965         admin => [
 966             'SDN.Allocate',
 967             'SDN.Audit',
 968         ],
 969         audit => [
 970             'SDN.Audit',
 971         ],
 972     },
 973     User => {
 974         root => [
 975             'Realm.Allocate',
 976         ],
 977         admin => [
 978             'User.Modify',
 979             'Group.Allocate', # edit/change group settings
 980             'Realm.AllocateUser',
 981         ],
 982         user => [],
 983         audit => [],
 984     },
 985     Pool => {
 986         root => [],
 987         admin => [
 988             'Pool.Allocate', # create/delete pools
 989         ],
 990         user => [
 991             'Pool.Audit',
 992         ],
 993         audit => [
 994             'Pool.Audit',
 995         ],
 996     },
 997 };
 998
 999 my $valid_privs = {};
1000
1001 my $special_roles = {
1002     'NoAccess' => {}, # no privileges
1003     'Administrator' => $valid_privs, # all privileges
1004 };
1005
1006 sub create_roles {
1007
1008     foreach my $cat (keys %$privgroups) {
1009         my $cd = $privgroups->{$cat};
1010         foreach my $p (@{$cd->{root}}, @{$cd->{admin}},
1011                        @{$cd->{user}}, @{$cd->{audit}}) {
1012             $valid_privs->{$p} = 1;
1013         }
1014         foreach my $p (@{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
1015
1016             $special_roles->{"PVE${cat}Admin"}->{$p} = 1;
1017             $special_roles->{"PVEAdmin"}->{$p} = 1;
1018         }
1019         if (scalar(@{$cd->{user}})) {
1020             foreach my $p (@{$cd->{user}}, @{$cd->{audit}}) {
1021                 $special_roles->{"PVE${cat}User"}->{$p} = 1;
1022             }
1023         }
1024         foreach my $p (@{$cd->{audit}}) {
1025             $special_roles->{"PVEAuditor"}->{$p} = 1;
1026         }
1027     }
1028
1029     $special_roles->{"PVETemplateUser"} = { 'VM.Clone' => 1, 'VM.Audit' => 1 };
1030 };
1031
1032 create_roles();
1033
1034 sub create_priv_properties {
1035     my $properties = {};
1036     foreach my $priv (keys %$valid_privs) {
1037         $properties->{$priv} = {
1038             type => 'boolean',
1039             optional => 1,
1040         };
1041     }
1042     return $properties;
1043 }
1044
1045 sub role_is_special {
1046     my ($role) = @_;
1047     return (exists $special_roles->{$role}) ? 1 : 0;
1048 }
1049
1050 sub add_role_privs {
1051     my ($role, $usercfg, $privs) = @_;
1052
1053     return if !$privs;
1054
1055     die "role '$role' does not exist\n" if !$usercfg->{roles}->{$role};
1056
1057     foreach my $priv (split_list($privs)) {
1058         if (defined ($valid_privs->{$priv})) {
1059             $usercfg->{roles}->{$role}->{$priv} = 1;
1060         } else {
1061             die "invalid privilege '$priv'\n";
1062         }
1063     }
1064 }
1065
1066 sub lookup_username {
1067     my ($username, $noerr) = @_;
1068
1069     $username =~ m!^(${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex})$!;
1070
1071     my $realm = $2;
1072     my $domain_cfg = cfs_read_file("domains.cfg");
1073     my $casesensitive = $domain_cfg->{ids}->{$realm}->{'case-sensitive'} // 1;
1074     my $usercfg = cfs_read_file('user.cfg');
1075
1076     if (!$casesensitive) {
1077         my @matches = grep { lc $username eq lc $_ } (keys %{$usercfg->{users}});
1078
1079         die "ambiguous case insensitive match of username '$username', cannot safely grant access!\n"
1080             if scalar @matches > 1 && !$noerr;
1081
1082         return $matches[0]
1083     }
1084
1085     return $username;
1086 }
1087
1088 sub normalize_path {
1089     my $path = shift;
1090
1091     $path =~ s|/+|/|g;
1092
1093     $path =~ s|/$||;
1094
1095     $path = '/' if !$path;
1096
1097     $path = "/$path" if $path !~ m|^/|;
1098
1099     return undef if $path !~ m|^[[:alnum:]\.\-\_\/]+$|;
1100
1101     return $path;
1102 }
1103
1104 sub check_path {
1105     my ($path) = @_;
1106     return $path =~ m!^(
1107         /
1108         |/access
1109         |/access/groups
1110         |/access/groups/[[:alnum:]\.\-\_]+
1111         |/access/realm
1112         |/access/realm/[[:alnum:]\.\-\_]+
1113         |/nodes
1114         |/nodes/[[:alnum:]\.\-\_]+
1115         |/pool
1116         |/pool/[[:alnum:]\.\-\_]+
1117         |/sdn
1118         |/sdn/zones/[[:alnum:]\.\-\_]+
1119         |/sdn/vnets/[[:alnum:]\.\-\_]+
1120         |/storage
1121         |/storage/[[:alnum:]\.\-\_]+
1122         |/vms
1123         |/vms/[1-9][0-9]{2,}
1124     )$!xs;
1125 }
1126
1127 PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
1128 sub verify_groupname {
1129     my ($groupname, $noerr) = @_;
1130
1131     if ($groupname !~ m/^[A-Za-z0-9\.\-_]+$/) {
1132
1133         die "group name '$groupname' contains invalid characters\n" if !$noerr;
1134
1135         return undef;
1136     }
1137
1138     return $groupname;
1139 }
1140
1141 PVE::JSONSchema::register_format('pve-roleid', \&verify_rolename);
1142 sub verify_rolename {
1143     my ($rolename, $noerr) = @_;
1144
1145     if ($rolename !~ m/^[A-Za-z0-9\.\-_]+$/) {
1146
1147         die "role name '$rolename' contains invalid characters\n" if !$noerr;
1148
1149         return undef;
1150     }
1151
1152     return $rolename;
1153 }
1154
1155 PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname);
1156 sub verify_poolname {
1157     my ($poolname, $noerr) = @_;
1158
1159     if ($poolname !~ m/^[A-Za-z0-9\.\-_]+$/) {
1160
1161         die "pool name '$poolname' contains invalid characters\n" if !$noerr;
1162
1163         return undef;
1164     }
1165
1166     return $poolname;
1167 }
1168
1169 PVE::JSONSchema::register_format('pve-priv', \&verify_privname);
1170 sub verify_privname {
1171     my ($priv, $noerr) = @_;
1172
1173     if (!$valid_privs->{$priv}) {
1174         die "invalid privilege '$priv'\n" if !$noerr;
1175
1176         return undef;
1177     }
1178
1179     return $priv;
1180 }
1181
1182 sub userconfig_force_defaults {
1183     my ($cfg) = @_;
1184
1185     foreach my $r (keys %$special_roles) {
1186         $cfg->{roles}->{$r} = $special_roles->{$r};
1187     }
1188
1189     # add root user if not exists
1190     if (!$cfg->{users}->{'root@pam'}) {
1191         $cfg->{users}->{'root@pam'}->{enable} = 1;
1192     }
1193 }
1194
1195 sub parse_user_config {
1196     my ($filename, $raw) = @_;
1197
1198     my $cfg = {};
1199
1200     userconfig_force_defaults($cfg);
1201
1202     $raw = '' if !defined($raw);
1203     while ($raw =~ /^\s*(.+?)\s*$/gm) {
1204         my $line = $1;
1205         my @data;
1206
1207         foreach my $d (split (/:/, $line)) {
1208             $d =~ s/^\s+//;
1209             $d =~ s/\s+$//;
1210             push @data, $d
1211         }
1212
1213         my $et = shift @data;
1214
1215         if ($et eq 'user') {
1216             my ($user, $enable, $expire, $firstname, $lastname, $email, $comment, $keys) = @data;
1217
1218             my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1219             if (!$realm) {
1220                 warn "user config - ignore user '$user' - invalid user name\n";
1221                 next;
1222             }
1223
1224             $enable = $enable ? 1 : 0;
1225
1226             $expire = 0 if !$expire;
1227
1228             if ($expire !~ m/^\d+$/) {
1229                 warn "user config - ignore user '$user' - (illegal characters in expire '$expire')\n";
1230                 next;
1231             }
1232             $expire = int($expire);
1233
1234             #if (!verify_groupname ($group, 1)) {
1235             #    warn "user config - ignore user '$user' - invalid characters in group name\n";
1236             #    next;
1237             #}
1238
1239             $cfg->{users}->{$user} = {
1240                 enable => $enable,
1241                 # group => $group,
1242             };
1243             $cfg->{users}->{$user}->{firstname} = PVE::Tools::decode_text($firstname) if $firstname;
1244             $cfg->{users}->{$user}->{lastname} = PVE::Tools::decode_text($lastname) if $lastname;
1245             $cfg->{users}->{$user}->{email} = $email;
1246             $cfg->{users}->{$user}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1247             $cfg->{users}->{$user}->{expire} = $expire;
1248             # keys: allowed yubico key ids or oath secrets (base32 encoded)
1249             $cfg->{users}->{$user}->{keys} = $keys if $keys;
1250
1251             #$cfg->{users}->{$user}->{groups}->{$group} = 1;
1252             #$cfg->{groups}->{$group}->{$user} = 1;
1253
1254         } elsif ($et eq 'group') {
1255             my ($group, $userlist, $comment) = @data;
1256
1257             if (!verify_groupname($group, 1)) {
1258                 warn "user config - ignore group '$group' - invalid characters in group name\n";
1259                 next;
1260             }
1261
1262             # make sure to add the group (even if there are no members)
1263             $cfg->{groups}->{$group} = { users => {} } if !$cfg->{groups}->{$group};
1264
1265             $cfg->{groups}->{$group}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1266
1267             foreach my $user (split_list($userlist)) {
1268
1269                 if (!PVE::Auth::Plugin::verify_username($user, 1)) {
1270                     warn "user config - ignore invalid group member '$user'\n";
1271                     next;
1272                 }
1273
1274                 if ($cfg->{users}->{$user}) { # user exists
1275                     $cfg->{users}->{$user}->{groups}->{$group} = 1;
1276                 } else {
1277                     warn "user config - ignore invalid group member '$user'\n";
1278                 }
1279                 $cfg->{groups}->{$group}->{users}->{$user} = 1;
1280             }
1281
1282         } elsif ($et eq 'role') {
1283             my ($role, $privlist) = @data;
1284
1285             if (!verify_rolename($role, 1)) {
1286                 warn "user config - ignore role '$role' - invalid characters in role name\n";
1287                 next;
1288             }
1289
1290             # make sure to add the role (even if there are no privileges)
1291             $cfg->{roles}->{$role} = {} if !$cfg->{roles}->{$role};
1292
1293             foreach my $priv (split_list($privlist)) {
1294                 if (defined ($valid_privs->{$priv})) {
1295                     $cfg->{roles}->{$role}->{$priv} = 1;
1296                 } else {
1297                     warn "user config - ignore invalid privilege '$priv'\n";
1298                 }
1299             }
1300
1301         } elsif ($et eq 'acl') {
1302             my ($propagate, $pathtxt, $uglist, $rolelist) = @data;
1303
1304             $propagate = $propagate ? 1 : 0;
1305
1306             if (my $path = normalize_path($pathtxt)) {
1307                 foreach my $role (split_list($rolelist)) {
1308
1309                     if (!verify_rolename($role, 1)) {
1310                         warn "user config - ignore invalid role name '$role' in acl\n";
1311                         next;
1312                     }
1313
1314                     if (!$cfg->{roles}->{$role}) {
1315                         warn "user config - ignore invalid acl role '$role'\n";
1316                         next;
1317                     }
1318
1319                     foreach my $ug (split_list($uglist)) {
1320                         my ($group) = $ug =~ m/^@(\S+)$/;
1321
1322                         if ($group && verify_groupname($group, 1)) {
1323                             if (!$cfg->{groups}->{$group}) { # group does not exist
1324                                 warn "user config - ignore invalid acl group '$group'\n";
1325                             }
1326                             $cfg->{acl}->{$path}->{groups}->{$group}->{$role} = $propagate;
1327                         } elsif (PVE::Auth::Plugin::verify_username($ug, 1)) {
1328                             if (!$cfg->{users}->{$ug}) { # user does not exist
1329                                 warn "user config - ignore invalid acl member '$ug'\n";
1330                             }
1331                             $cfg->{acl}->{$path}->{users}->{$ug}->{$role} = $propagate;
1332                         } elsif (my ($user, $token) = split_tokenid($ug, 1)) {
1333                             if (check_token_exist($cfg, $user, $token, 1)) {
1334                                 $cfg->{acl}->{$path}->{tokens}->{$ug}->{$role} = $propagate;
1335                             } else {
1336                                 warn "user config - ignore invalid acl token '$ug'\n";
1337                             }
1338                         } else {
1339                             warn "user config - invalid user/group '$ug' in acl\n";
1340                         }
1341                     }
1342                 }
1343             } else {
1344                 warn "user config - ignore invalid path in acl '$pathtxt'\n";
1345             }
1346         } elsif ($et eq 'pool') {
1347             my ($pool, $comment, $vmlist, $storelist) = @data;
1348
1349             if (!verify_poolname($pool, 1)) {
1350                 warn "user config - ignore pool '$pool' - invalid characters in pool name\n";
1351                 next;
1352             }
1353
1354             # make sure to add the pool (even if there are no members)
1355             $cfg->{pools}->{$pool} = { vms => {}, storage => {} } if !$cfg->{pools}->{$pool};
1356
1357             $cfg->{pools}->{$pool}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1358
1359             foreach my $vmid (split_list($vmlist)) {
1360                 if ($vmid !~ m/^\d+$/) {
1361                     warn "user config - ignore invalid vmid '$vmid' in pool '$pool'\n";
1362                     next;
1363                 }
1364                 $vmid = int($vmid);
1365
1366                 if ($cfg->{vms}->{$vmid}) {
1367                     warn "user config - ignore duplicate vmid '$vmid' in pool '$pool'\n";
1368                     next;
1369                 }
1370
1371                 $cfg->{pools}->{$pool}->{vms}->{$vmid} = 1;
1372
1373                 # record vmid ==> pool relation
1374                 $cfg->{vms}->{$vmid} = $pool;
1375             }
1376
1377             foreach my $storeid (split_list($storelist)) {
1378                 if ($storeid !~ m/^[a-z][a-z0-9\-\_\.]*[a-z0-9]$/i) {
1379                     warn "user config - ignore invalid storage '$storeid' in pool '$pool'\n";
1380                     next;
1381                 }
1382                 $cfg->{pools}->{$pool}->{storage}->{$storeid} = 1;
1383             }
1384         } elsif ($et eq 'token') {
1385             my ($tokenid, $expire, $privsep, $comment) = @data;
1386
1387             my ($user, $token) = split_tokenid($tokenid, 1);
1388             if (!($user && $token)) {
1389                 warn "user config - ignore invalid tokenid '$tokenid'\n";
1390                 next;
1391             }
1392
1393             $privsep = $privsep ? 1 : 0;
1394
1395             $expire = 0 if !$expire;
1396
1397             if ($expire !~ m/^\d+$/) {
1398                 warn "user config - ignore token '$tokenid' - (illegal characters in expire '$expire')\n";
1399                 next;
1400             }
1401             $expire = int($expire);
1402
1403             if (my $user_cfg = $cfg->{users}->{$user}) { # user exists
1404                 $user_cfg->{tokens}->{$token} = {} if !$user_cfg->{tokens}->{$token};
1405                 my $token_cfg = $user_cfg->{tokens}->{$token};
1406                 $token_cfg->{privsep} = $privsep;
1407                 $token_cfg->{expire} = $expire;
1408                 $token_cfg->{comment} = PVE::Tools::decode_text($comment) if $comment;
1409             } else {
1410                 warn "user config - ignore token '$tokenid' - user does not exist\n";
1411             }
1412         } else {
1413             warn "user config - ignore config line: $line\n";
1414         }
1415     }
1416
1417     userconfig_force_defaults($cfg);
1418
1419     return $cfg;
1420 }
1421
1422 sub write_user_config {
1423     my ($filename, $cfg) = @_;
1424
1425     my $data = '';
1426
1427     foreach my $user (sort keys %{$cfg->{users}}) {
1428         my $d = $cfg->{users}->{$user};
1429         my $firstname = $d->{firstname} ? PVE::Tools::encode_text($d->{firstname}) : '';
1430         my $lastname = $d->{lastname} ? PVE::Tools::encode_text($d->{lastname}) : '';
1431         my $email = $d->{email} || '';
1432         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1433         my $expire = int($d->{expire} || 0);
1434         my $enable = $d->{enable} ? 1 : 0;
1435         my $keys = $d->{keys} ? $d->{keys} : '';
1436         $data .= "user:$user:$enable:$expire:$firstname:$lastname:$email:$comment:$keys:\n";
1437
1438         my $user_tokens = $d->{tokens};
1439         foreach my $token (sort keys %$user_tokens) {
1440             my $td = $user_tokens->{$token};
1441             my $full_tokenid = join_tokenid($user, $token);
1442             my $comment = $td->{comment} ? PVE::Tools::encode_text($td->{comment}) : '';
1443             my $expire = int($td->{expire} || 0);
1444             my $privsep = $td->{privsep} ? 1 : 0;
1445             $data .= "token:$full_tokenid:$expire:$privsep:$comment:\n";
1446         }
1447     }
1448
1449     $data .= "\n";
1450
1451     foreach my $group (sort keys %{$cfg->{groups}}) {
1452         my $d = $cfg->{groups}->{$group};
1453         my $list = join (',', sort keys %{$d->{users}});
1454         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1455         $data .= "group:$group:$list:$comment:\n";
1456     }
1457
1458     $data .= "\n";
1459
1460     foreach my $pool (sort keys %{$cfg->{pools}}) {
1461         my $d = $cfg->{pools}->{$pool};
1462         my $vmlist = join (',', sort keys %{$d->{vms}});
1463         my $storelist = join (',', sort keys %{$d->{storage}});
1464         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1465         $data .= "pool:$pool:$comment:$vmlist:$storelist:\n";
1466     }
1467
1468     $data .= "\n";
1469
1470     foreach my $role (sort keys %{$cfg->{roles}}) {
1471         next if $special_roles->{$role};
1472
1473         my $d = $cfg->{roles}->{$role};
1474         my $list = join (',', sort keys %$d);
1475         $data .= "role:$role:$list:\n";
1476     }
1477
1478     $data .= "\n";
1479
1480     my $collect_rolelist_members = sub {
1481         my ($acl_members, $result, $prefix, $exclude) = @_;
1482
1483         foreach my $member (keys %$acl_members) {
1484             next if $exclude && $member eq $exclude;
1485
1486             my $l0 = '';
1487             my $l1 = '';
1488             foreach my $role (sort keys %{$acl_members->{$member}}) {
1489                 my $propagate = $acl_members->{$member}->{$role};
1490                 if ($propagate) {
1491                     $l1 .= ',' if $l1;
1492                     $l1 .= $role;
1493                 } else {
1494                     $l0 .= ',' if $l0;
1495                     $l0 .= $role;
1496                 }
1497             }
1498             $result->{0}->{$l0}->{"${prefix}${member}"} = 1 if $l0;
1499             $result->{1}->{$l1}->{"${prefix}${member}"} = 1 if $l1;
1500         }
1501     };
1502
1503     foreach my $path (sort keys %{$cfg->{acl}}) {
1504         my $d = $cfg->{acl}->{$path};
1505
1506         my $rolelist_members = {};
1507
1508         $collect_rolelist_members->($d->{'groups'}, $rolelist_members, '@');
1509
1510         # no need to save 'root@pam', it is always 'Administrator'
1511         $collect_rolelist_members->($d->{'users'}, $rolelist_members, '', 'root@pam');
1512
1513         $collect_rolelist_members->($d->{'tokens'}, $rolelist_members, '');
1514
1515         foreach my $propagate (0,1) {
1516             my $filtered = $rolelist_members->{$propagate};
1517             foreach my $rolelist (sort keys %$filtered) {
1518                 my $uglist = join (',', sort keys %{$filtered->{$rolelist}});
1519                 $data .= "acl:$propagate:$path:$uglist:$rolelist:\n";
1520             }
1521
1522         }
1523     }
1524
1525     return $data;
1526 }
1527
1528 # Creates a `PVE::RS::TFA` instance from the raw config data.
1529 # Its contained hash will also support the legacy functionality.
1530 sub parse_priv_tfa_config {
1531     my ($filename, $raw) = @_;
1532
1533     $raw = '' if !defined($raw);
1534     my $cfg = PVE::RS::TFA->new($raw);
1535
1536     # Purge invalid users:
1537     foreach my $user ($cfg->users()->@*) {
1538         my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1539         if (!$realm) {
1540             warn "user tfa config - ignore user '$user' - invalid user name\n";
1541             $cfg->remove_user($user);
1542         }
1543     }
1544
1545     return $cfg;
1546 }
1547
1548 sub write_priv_tfa_config {
1549     my ($filename, $cfg) = @_;
1550
1551     # FIXME: Only allow this if the complete cluster has been upgraded to understand the json
1552     # config format.
1553     return $cfg->write();
1554 }
1555
1556 sub roles {
1557     my ($cfg, $user, $path) = @_;
1558
1559     # NOTE: we do not consider pools here.
1560     # NOTE: for privsep tokens, this does not filter roles by those that the
1561     # corresponding user has.
1562     # Use $rpcenv->permission() for any actual permission checks!
1563
1564     return 'Administrator' if $user eq 'root@pam'; # root can do anything
1565
1566     if (pve_verify_tokenid($user, 1)) {
1567         my $tokenid = $user;
1568         my ($username, $token) = split_tokenid($tokenid);
1569
1570         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
1571         return () if !$token_info;
1572
1573         my $user_roles = roles($cfg, $username, $path);
1574
1575         # return full user privileges
1576         return $user_roles if !$token_info->{privsep};
1577     }
1578
1579     my $roles = {};
1580
1581     foreach my $p (sort keys %{$cfg->{acl}}) {
1582         my $final = ($path eq $p);
1583
1584         next if !(($p eq '/') || $final || ($path =~ m|^$p/|));
1585
1586         my $acl = $cfg->{acl}->{$p};
1587
1588         #print "CHECKACL $path $p\n";
1589         #print "ACL $path = " . Dumper ($acl);
1590         if (my $ri = $acl->{tokens}->{$user}) {
1591             my $new;
1592             foreach my $role (keys %$ri) {
1593                 my $propagate = $ri->{$role};
1594                 if ($final || $propagate) {
1595                     #print "APPLY ROLE $p $user $role\n";
1596                     $new = {} if !$new;
1597                     $new->{$role} = $propagate;
1598                 }
1599             }
1600             if ($new) {
1601                 $roles = $new; # overwrite previous settings
1602                 next;
1603             }
1604         }
1605
1606         if (my $ri = $acl->{users}->{$user}) {
1607             my $new;
1608             foreach my $role (keys %$ri) {
1609                 my $propagate = $ri->{$role};
1610                 if ($final || $propagate) {
1611                     #print "APPLY ROLE $p $user $role\n";
1612                     $new = {} if !$new;
1613                     $new->{$role} = $propagate;
1614                 }
1615             }
1616             if ($new) {
1617                 $roles = $new; # overwrite previous settings
1618                 next; # user privs always override group privs
1619             }
1620         }
1621
1622         my $new;
1623         foreach my $g (keys %{$acl->{groups}}) {
1624             next if !$cfg->{groups}->{$g}->{users}->{$user};
1625             if (my $ri = $acl->{groups}->{$g}) {
1626                 foreach my $role (keys %$ri) {
1627                     my $propagate = $ri->{$role};
1628                     if ($final || $propagate) {
1629                         #print "APPLY ROLE $p \@$g $role\n";
1630                         $new = {} if !$new;
1631                         $new->{$role} = $propagate;
1632                     }
1633                 }
1634             }
1635         }
1636         if ($new) {
1637             $roles = $new; # overwrite previous settings
1638             next;
1639         }
1640     }
1641
1642     return { 'NoAccess' => $roles->{NoAccess} } if defined ($roles->{NoAccess});
1643     #return () if defined ($roles->{NoAccess});
1644
1645     #print "permission $user $path = " . Dumper ($roles);
1646
1647     #print "roles $user $path = " . join (',', @ra) . "\n";
1648
1649     return $roles;
1650 }
1651
1652 sub remove_vm_access {
1653     my ($vmid) = @_;
1654     my $delVMaccessFn = sub {
1655         my $usercfg = cfs_read_file("user.cfg");
1656         my $modified;
1657
1658         if (my $acl = $usercfg->{acl}->{"/vms/$vmid"}) {
1659             delete $usercfg->{acl}->{"/vms/$vmid"};
1660             $modified = 1;
1661         }
1662         if (my $pool = $usercfg->{vms}->{$vmid}) {
1663             if (my $data = $usercfg->{pools}->{$pool}) {
1664                 delete $data->{vms}->{$vmid};
1665                 delete $usercfg->{vms}->{$vmid};
1666                 $modified = 1;
1667             }
1668         }
1669         cfs_write_file("user.cfg", $usercfg) if $modified;
1670     };
1671
1672     lock_user_config($delVMaccessFn, "access permissions cleanup for VM $vmid failed");
1673 }
1674
1675 sub remove_storage_access {
1676     my ($storeid) = @_;
1677
1678     my $deleteStorageAccessFn = sub {
1679         my $usercfg = cfs_read_file("user.cfg");
1680         my $modified;
1681
1682         if (my $storage = $usercfg->{acl}->{"/storage/$storeid"}) {
1683             delete $usercfg->{acl}->{"/storage/$storeid"};
1684             $modified = 1;
1685         }
1686         foreach my $pool (keys %{$usercfg->{pools}}) {
1687             delete $usercfg->{pools}->{$pool}->{storage}->{$storeid};
1688             $modified = 1;
1689         }
1690         cfs_write_file("user.cfg", $usercfg) if $modified;
1691     };
1692
1693     lock_user_config($deleteStorageAccessFn,
1694                      "access permissions cleanup for storage $storeid failed");
1695 }
1696
1697 sub add_vm_to_pool {
1698     my ($vmid, $pool) = @_;
1699
1700     my $addVMtoPoolFn = sub {
1701         my $usercfg = cfs_read_file("user.cfg");
1702         if (my $data = $usercfg->{pools}->{$pool}) {
1703             $data->{vms}->{$vmid} = 1;
1704             $usercfg->{vms}->{$vmid} = $pool;
1705             cfs_write_file("user.cfg", $usercfg);
1706         }
1707     };
1708
1709     lock_user_config($addVMtoPoolFn, "can't add VM $vmid to pool '$pool'");
1710 }
1711
1712 sub remove_vm_from_pool {
1713     my ($vmid) = @_;
1714
1715     my $delVMfromPoolFn = sub {
1716         my $usercfg = cfs_read_file("user.cfg");
1717         if (my $pool = $usercfg->{vms}->{$vmid}) {
1718             if (my $data = $usercfg->{pools}->{$pool}) {
1719                 delete $data->{vms}->{$vmid};
1720                 delete $usercfg->{vms}->{$vmid};
1721                 cfs_write_file("user.cfg", $usercfg);
1722             }
1723         }
1724     };
1725
1726     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
1727 }
1728
1729 my $USER_CONTROLLED_TFA_TYPES = {
1730     u2f => 1,
1731     oath => 1,
1732 };
1733
1734 sub assert_new_tfa_config_available() {
1735     # FIXME: Assert cluster-wide new-tfa-config support!
1736 }
1737
1738 sub user_get_tfa : prototype($$$) {
1739     my ($username, $realm, $new_format) = @_;
1740
1741     my $user_cfg = cfs_read_file('user.cfg');
1742     my $user = $user_cfg->{users}->{$username}
1743         or die "user '$username' not found\n";
1744
1745     my $keys = $user->{keys};
1746
1747     my $domain_cfg = cfs_read_file('domains.cfg');
1748     my $realm_cfg = $domain_cfg->{ids}->{$realm};
1749     die "auth domain '$realm' does not exist\n" if !$realm_cfg;
1750
1751     my $realm_tfa = $realm_cfg->{tfa};
1752     $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa)
1753         if $realm_tfa;
1754
1755     if (!$keys) {
1756         return if !$realm_tfa;
1757         die "missing required 2nd keys\n";
1758     }
1759
1760     # new style config starts with an 'x' and optionally contains a !<type> suffix
1761     if ($keys !~ /^x(?:!.*)?$/) {
1762         # old style config, find the type via the realm
1763         return if !$realm_tfa;
1764         return ($realm_tfa->{type}, {
1765             keys => $keys,
1766             config => $realm_tfa,
1767         });
1768     } else {
1769         my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
1770         if ($new_format) {
1771             return ($tfa_cfg, $realm_tfa);
1772         } else {
1773             my $tfa = $tfa_cfg->{users}->{$username};
1774             return if !$tfa; # should not happen (user.cfg wasn't cleaned up?)
1775
1776             if ($realm_tfa) {
1777                 # if the realm has a tfa setting we need to verify the type:
1778                 die "auth domain '$realm' and user have mismatching TFA settings\n"
1779                     if $realm_tfa && $realm_tfa->{type} ne $tfa->{type};
1780             }
1781
1782             return ($tfa->{type}, $tfa->{data});
1783         }
1784     }
1785 }
1786
1787 # bash completion helpers
1788
1789 register_standard_option('userid-completed',
1790     get_standard_option('userid', { completion => \&complete_username}),
1791 );
1792
1793 sub complete_username {
1794
1795     my $user_cfg = cfs_read_file('user.cfg');
1796
1797     return [ keys %{$user_cfg->{users}} ];
1798 }
1799
1800 sub complete_group {
1801
1802     my $user_cfg = cfs_read_file('user.cfg');
1803
1804     return [ keys %{$user_cfg->{groups}} ];
1805 }
1806
1807 sub complete_realm {
1808
1809     my $domain_cfg = cfs_read_file('domains.cfg');
1810
1811     return [ keys %{$domain_cfg->{ids}} ];
1812 }
1813
1814 1;