move more tools for the client into subcrates

[proxmox-backup.git] / src / auth_helpers.rs

diff --git a/src/auth_helpers.rs b/src/auth_helpers.rs
index d2e0a9fa4eab0f5ae7d3fd5cd59b99332a728bad..15e782a5ba806e19e3d9dabafaf93358e3e37ec0 100644 (file)
--- a/src/auth_helpers.rs
+++ b/src/auth_helpers.rs
@@ -1,22 +1,25 @@
-use crate::tools;
+use std::path::PathBuf;
 
-use failure::*;
+use anyhow::{bail, format_err, Error};
 use lazy_static::lazy_static;
-
-use openssl::rsa::{Rsa};
-use openssl::pkey::{PKey, Public, Private};
+use openssl::pkey::{PKey, Public};
+use openssl::rsa::Rsa;
 use openssl::sha;
 
-use std::path::PathBuf;
+use proxmox::tools::fs::{file_get_contents, replace_file, CreateOptions};
+use proxmox::try_block;
+
+use pbs_buildcfg::configdir;
+use pbs_api_types::Userid;
 
 fn compute_csrf_secret_digest(
     timestamp: i64,
     secret: &[u8],
-    username: &str,
+    userid: &Userid,
 ) -> String {
 
     let mut hasher = sha::Sha256::new();
-    let data = format!("{:08X}:{}:", timestamp, username);
+    let data = format!("{:08X}:{}:", timestamp, userid);
     hasher.update(data.as_bytes());
     hasher.update(secret);
 
@@ -25,20 +28,19 @@ fn compute_csrf_secret_digest(
 
 pub fn assemble_csrf_prevention_token(
     secret: &[u8],
-    username: &str,
+    userid: &Userid,
 ) -> String {
 
-    let epoch = std::time::SystemTime::now().duration_since(
-        std::time::SystemTime::UNIX_EPOCH).unwrap().as_secs() as i64;
+    let epoch = proxmox::tools::time::epoch_i64();
 
-    let digest = compute_csrf_secret_digest(epoch, secret, username);
+    let digest = compute_csrf_secret_digest(epoch, secret, userid);
 
     format!("{:08X}:{}", epoch, digest)
 }
 
 pub fn verify_csrf_prevention_token(
     secret: &[u8],
-    username: &str,
+    userid: &Userid,
     token: &str,
     min_age: i64,
     max_age: i64,
@@ -60,14 +62,13 @@ pub fn verify_csrf_prevention_token(
         let ttime = i64::from_str_radix(timestamp, 16).
             map_err(|err| format_err!("timestamp format error - {}", err))?;
 
-        let digest = compute_csrf_secret_digest(ttime, secret, username);
+        let digest = compute_csrf_secret_digest(ttime, secret, userid);
 
         if digest != sig {
             bail!("invalid signature.");
         }
 
-        let now = std::time::SystemTime::now().duration_since(
-            std::time::SystemTime::UNIX_EPOCH)?.as_secs() as i64;
+        let now = proxmox::tools::time::epoch_i64();
 
         let age = now - ttime;
         if age < min_age {
@@ -94,12 +95,16 @@ pub fn generate_csrf_key() -> Result<(), Error> {
 
     use nix::sys::stat::Mode;
 
-    tools::file_set_contents(
-        &path, &pem, Some(Mode::from_bits_truncate(0o0640)))?;
-
-    let (_, backup_gid) = tools::getpwnam_ugid("backup")?;
+    let backup_user = crate::backup::backup_user()?;
 
-    nix::unistd::chown(&path, Some(nix::unistd::ROOT), Some(nix::unistd::Gid::from_raw(backup_gid)))?;
+    replace_file(
+        &path,
+        &pem,
+        CreateOptions::new()
+            .perm(Mode::from_bits_truncate(0o0640))
+            .owner(nix::unistd::ROOT)
+            .group(backup_user.gid),
+    )?;
 
     Ok(())
 }
@@ -119,13 +124,21 @@ pub fn generate_auth_key() -> Result<(), Error> {
 
     use nix::sys::stat::Mode;
 
-    tools::file_set_contents(
-        &priv_path, &priv_pem, Some(Mode::from_bits_truncate(0o0600)))?;
-
+    replace_file(
+        &priv_path, &priv_pem, CreateOptions::new().perm(Mode::from_bits_truncate(0o0600)))?;
 
     let public_pem = rsa.public_key_to_pem()?;
 
-    tools::file_set_contents(&public_path, &public_pem, None)?;
+    let backup_user = crate::backup::backup_user()?;
+
+    replace_file(
+        &public_path,
+        &public_pem,
+        CreateOptions::new()
+            .perm(Mode::from_bits_truncate(0o0640))
+            .owner(nix::unistd::ROOT)
+            .group(backup_user.gid),
+    )?;
 
     Ok(())
 }
@@ -134,33 +147,15 @@ pub fn csrf_secret() -> &'static [u8] {
 
     lazy_static! {
         static ref SECRET: Vec<u8> =
-            tools::file_get_contents(configdir!("/csrf.key")).unwrap();
+            file_get_contents(configdir!("/csrf.key")).unwrap();
     }
 
     &SECRET
 }
 
-fn load_private_auth_key() -> Result<PKey<Private>, Error> {
-
-    let pem = tools::file_get_contents(configdir!("/authkey.key"))?;
-    let rsa = Rsa::private_key_from_pem(&pem)?;
-    let key = PKey::from_rsa(rsa)?;
-
-    Ok(key)
-}
-
-pub fn private_auth_key() -> &'static PKey<Private> {
-
-    lazy_static! {
-        static ref KEY: PKey<Private> = load_private_auth_key().unwrap();
-    }
-
-    &KEY
-}
-
 fn load_public_auth_key() -> Result<PKey<Public>, Error> {
 
-    let pem = tools::file_get_contents(configdir!("/authkey.pub"))?;
+    let pem = file_get_contents(configdir!("/authkey.pub"))?;
     let rsa = Rsa::public_key_from_pem(&pem)?;
     let key = PKey::from_rsa(rsa)?;