log email addresses as utf8 (postfix also do that).

[pmg-api.git] / PMG / Ticket.pm

diff --git a/PMG/Ticket.pm b/PMG/Ticket.pm
index 708478d198c90a8ad60d8ab5ccfa7cb5f8329e08..c9cf096f93d859b56bf8139b560ab4c9b0c08dd1 100644 (file)
--- a/PMG/Ticket.pm
+++ b/PMG/Ticket.pm
@@ -5,6 +5,7 @@ use warnings;
 use Net::SSLeay;
 use Digest::SHA;
 
+use PVE::SafeSyslog;
 use PVE::Tools;
 use PVE::Ticket;
 use PVE::INotify;
@@ -12,6 +13,7 @@ use PVE::INotify;
 use Crypt::OpenSSL::RSA;
 
 use PMG::Utils;
+use PMG::Config;
 
 my $min_ticket_lifetime = -60*5; # allow 5 minutes time drift
 my $max_ticket_lifetime = 60*60*2; # 2 hours
@@ -101,44 +103,53 @@ sub generate_auth_key {
     die "unable to generate pmg auth key:\n$@" if $@;
 }
 
-my $pve_auth_priv_key;
-sub get_privkey {
+my $read_rsa_priv_key = sub {
+   my ($filename, $fh) = @_;
 
-    return $pve_auth_priv_key if $pve_auth_priv_key;
+   local $/ = undef; # slurp mode
 
-    my $input = PVE::Tools::file_get_contents($authprivkeyfn);
+   my $input = <$fh>;
 
-    $pve_auth_priv_key = Crypt::OpenSSL::RSA->new_private_key($input);
+   return Crypt::OpenSSL::RSA->new_private_key($input);
 
-    return $pve_auth_priv_key;
-}
+};
 
-my $pve_auth_pub_key;
-sub get_pubkey {
+PVE::INotify::register_file('auth_priv_key', $authprivkeyfn,
+                           $read_rsa_priv_key, undef, undef,
+                           noclone => 1);
 
-    return $pve_auth_pub_key if $pve_auth_pub_key;
+my $read_rsa_pub_key = sub {
+   my ($filename, $fh) = @_;
 
-    my $input = PVE::Tools::file_get_contents($authpubkeyfn);
+   local $/ = undef; # slurp mode
 
-    $pve_auth_pub_key = Crypt::OpenSSL::RSA->new_public_key($input);
+   my $input = <$fh>;
 
-    return $pve_auth_pub_key;
-}
+   return Crypt::OpenSSL::RSA->new_public_key($input);
+};
 
-my $csrf_prevention_secret;
-my $get_csrfr_secret = sub {
-    if (!$csrf_prevention_secret) {
-       my $input = PVE::Tools::file_get_contents($pmg_csrf_key_fn);
-       $csrf_prevention_secret = Digest::SHA::sha1_base64($input);
-    }
-    return $csrf_prevention_secret;
+PVE::INotify::register_file('auth_pub_key', $authpubkeyfn,
+                           $read_rsa_pub_key, undef, undef,
+                           noclone => 1);
+
+my $read_csrf_secret = sub {
+   my ($filename, $fh) = @_;
+
+   local $/ = undef; # slurp mode
+
+   my $input = <$fh>;
+
+   return Digest::SHA::sha1_base64($input);
 };
 
+PVE::INotify::register_file('csrf_secret', $pmg_csrf_key_fn,
+                           $read_csrf_secret, undef, undef,
+                           noclone => 1);
 
 sub verify_csrf_prevention_token {
     my ($username, $token, $noerr) = @_;
 
-    my $secret =  &$get_csrfr_secret();
+    my $secret = PVE::INotify::read_file('csrf_secret');
 
     return PVE::Ticket::verify_csrf_prevention_token(
        $secret, $username, $token, $min_ticket_lifetime,
@@ -148,7 +159,7 @@ sub verify_csrf_prevention_token {
 sub assemble_csrf_prevention_token {
     my ($username) = @_;
 
-    my $secret =  &$get_csrfr_secret();
+    my $secret = PVE::INotify::read_file('csrf_secret');
 
     return PVE::Ticket::assemble_csrf_prevention_token ($secret, $username);
 }
@@ -156,7 +167,7 @@ sub assemble_csrf_prevention_token {
 sub assemble_ticket {
     my ($username) = @_;
 
-    my $rsa_priv = get_privkey();
+    my $rsa_priv = PVE::INotify::read_file('auth_priv_key');
 
     return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PMG', $username);
 }
@@ -164,7 +175,7 @@ sub assemble_ticket {
 sub verify_ticket {
     my ($ticket, $noerr) = @_;
 
-    my $rsa_pub = get_pubkey();
+    my $rsa_pub = PVE::INotify::read_file('auth_pub_key');
 
     return PVE::Ticket::verify_rsa_ticket(
        $rsa_pub, 'PMG', $ticket, undef,
@@ -177,7 +188,7 @@ sub verify_ticket {
 sub assemble_vnc_ticket {
     my ($username, $path) = @_;
 
-    my $rsa_priv = get_privkey();
+    my $rsa_priv = PVE::INotify::read_file('auth_priv_key');
 
     my $secret_data = "$username:$path";
 
@@ -188,7 +199,7 @@ sub assemble_vnc_ticket {
 sub verify_vnc_ticket {
     my ($ticket, $username, $path, $noerr) = @_;
 
-    my $rsa_pub = get_pubkey();
+    my $rsa_pub = PVE::INotify::read_file('auth_pub_key');
 
     my $secret_data = "$username:$path";
 
@@ -196,4 +207,42 @@ sub verify_vnc_ticket {
        $rsa_pub, 'PMGVNC', $ticket, $secret_data, -20, 40, $noerr);
 }
 
+# Note: we only encode $pmail into the ticket,
+# and add '@quarantine' in verify_quarantine_ticket()
+sub assemble_quarantine_ticket {
+    my ($pmail) = @_;
+
+    my $rsa_priv = PVE::INotify::read_file('auth_priv_key');
+
+    return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PMGQUAR', $pmail);
+}
+
+my $quarantine_lifetime;
+
+my $get_quarantine_lifetime = sub {
+
+    return $quarantine_lifetime if defined($quarantine_lifetime);
+
+    my $cfg = PMG::Config->new();
+
+    $quarantine_lifetime = $cfg->get('spamquar', 'lifetime');
+
+    return $quarantine_lifetime;
+};
+
+sub verify_quarantine_ticket {
+    my ($ticket, $noerr) = @_;
+
+    my $rsa_pub = PVE::INotify::read_file('auth_pub_key');
+
+    my $lifetime = $get_quarantine_lifetime->();
+
+    my ($username, $age) = PVE::Ticket::verify_rsa_ticket(
+       $rsa_pub, 'PMGQUAR', $ticket, undef, -20, $lifetime*86400, $noerr);
+
+    $username = "$username\@quarantine" if defined($username);
+
+    return wantarray ? ($username, $age) : $username;
+}
+
 1;