X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=PVE%2FAccessControl.pm;h=4e9deea87ae6be7802fc0c6b00953f3fb2b0f4ea;hb=406726718e3a648ca520fff9cdd0ed415113c748;hp=5de060dfced07b7d370ee451e5388a7de68bbe99;hpb=243262f1853e94bd02d0614a1ae76442ec1e85e9;p=pve-access-control.git diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm index 5de060d..4e9deea 100644 --- a/PVE/AccessControl.pm +++ b/PVE/AccessControl.pm @@ -166,18 +166,21 @@ sub rotate_authkey { return if check_authkey(); my $old = get_pubkey(); + my $new = Crypt::OpenSSL::RSA->generate_key(2048); if ($old) { eval { my $pem = $old->get_public_key_x509_string(); + # mtime is used for caching and ticket age range calculation PVE::Tools::file_set_contents($pve_auth_key_files->{pubold}, $pem); }; die "Failed to store old auth key: $@\n" if $@; } - my $new = Crypt::OpenSSL::RSA->generate_key(2048); eval { my $pem = $new->get_public_key_x509_string(); + # mtime is used for caching and ticket age range calculation, + # should be close to that of pubold above PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem); }; if ($@) { @@ -209,10 +212,12 @@ sub rotate_authkey { } my $csrf_prevention_secret; +my $csrf_prevention_secret_legacy; my $get_csrfr_secret = sub { if (!$csrf_prevention_secret) { my $input = PVE::Tools::file_get_contents($pve_www_key_fn); - $csrf_prevention_secret = Digest::SHA::sha1_base64($input); + $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input); + $csrf_prevention_secret_legacy = Digest::SHA::sha1_base64($input); } return $csrf_prevention_secret; }; @@ -228,7 +233,16 @@ sub assemble_csrf_prevention_token { sub verify_csrf_prevention_token { my ($username, $token, $noerr) = @_; - my $secret = &$get_csrfr_secret(); + my $secret = $get_csrfr_secret->(); + + # FIXME: remove with PVE 7 and/or refactor all into PVE::Ticket ? + if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) { + my $sig = $2; + if (length($sig) == 27) { + # the legacy secret got populated by above get_csrfr_secret call + $secret = $csrf_prevention_secret_legacy; + } + } return PVE::Ticket::verify_csrf_prevention_token( $secret, $username, $token, -300, $ticket_lifetime, $noerr); @@ -283,7 +297,7 @@ sub verify_ticket { return undef if !$rsa_pub; my ($min, $max) = $get_ticket_age_range->($now, $rsa_mtime, $old); - return undef if !$min; + return undef if !defined($min); return PVE::Ticket::verify_rsa_ticket( $rsa_pub, 'PVE', $ticket, undef, $min, $max, 1); @@ -669,6 +683,16 @@ my $privgroups = { 'Datastore.Audit', ], }, + SDN => { + root => [], + admin => [ + 'SDN.Allocate', + 'SDN.Audit', + ], + audit => [ + 'SDN.Audit', + ], + }, User => { root => [ 'Realm.Allocate', @@ -951,6 +975,8 @@ sub parse_user_config { } elsif ($et eq 'acl') { my ($propagate, $pathtxt, $uglist, $rolelist) = @data; + $propagate = $propagate ? 1 : 0; + if (my $path = normalize_path($pathtxt)) { foreach my $role (split_list($rolelist)) { @@ -960,8 +986,9 @@ sub parse_user_config { } foreach my $ug (split_list($uglist)) { - if ($ug =~ m/^@(\S+)$/) { - my $group = $1; + my ($group) = $ug =~ m/^@(\S+)$/; + + if ($group && verify_groupname($group, 1)) { if ($cfg->{groups}->{$group}) { # group exists $cfg->{acl}->{$path}->{groups}->{$group}->{$role} = $propagate; } else { @@ -1034,7 +1061,7 @@ sub write_user_config { my $data = ''; - foreach my $user (keys %{$cfg->{users}}) { + foreach my $user (sort keys %{$cfg->{users}}) { my $d = $cfg->{users}->{$user}; my $firstname = $d->{firstname} ? PVE::Tools::encode_text($d->{firstname}) : ''; my $lastname = $d->{lastname} ? PVE::Tools::encode_text($d->{lastname}) : ''; @@ -1048,30 +1075,30 @@ sub write_user_config { $data .= "\n"; - foreach my $group (keys %{$cfg->{groups}}) { + foreach my $group (sort keys %{$cfg->{groups}}) { my $d = $cfg->{groups}->{$group}; - my $list = join (',', keys %{$d->{users}}); + my $list = join (',', sort keys %{$d->{users}}); my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : ''; $data .= "group:$group:$list:$comment:\n"; } $data .= "\n"; - foreach my $pool (keys %{$cfg->{pools}}) { + foreach my $pool (sort keys %{$cfg->{pools}}) { my $d = $cfg->{pools}->{$pool}; - my $vmlist = join (',', keys %{$d->{vms}}); - my $storelist = join (',', keys %{$d->{storage}}); + my $vmlist = join (',', sort keys %{$d->{vms}}); + my $storelist = join (',', sort keys %{$d->{storage}}); my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : ''; $data .= "pool:$pool:$comment:$vmlist:$storelist:\n"; } $data .= "\n"; - foreach my $role (keys %{$cfg->{roles}}) { + foreach my $role (sort keys %{$cfg->{roles}}) { next if $special_roles->{$role}; my $d = $cfg->{roles}->{$role}; - my $list = join (',', keys %$d); + my $list = join (',', sort keys %$d); $data .= "role:$role:$list:\n"; } @@ -1120,11 +1147,11 @@ sub write_user_config { } foreach my $rolelist (sort keys %{$ra->{0}}) { - my $uglist = join (',', keys %{$ra->{0}->{$rolelist}}); + my $uglist = join (',', sort keys %{$ra->{0}->{$rolelist}}); $data .= "acl:0:$path:$uglist:$rolelist:\n"; } foreach my $rolelist (sort keys %{$ra->{1}}) { - my $uglist = join (',', keys %{$ra->{1}->{$rolelist}}); + my $uglist = join (',', sort keys %{$ra->{1}->{$rolelist}}); $data .= "acl:1:$path:$uglist:$rolelist:\n"; } } @@ -1258,43 +1285,6 @@ sub roles { return @ra; } -sub permission { - my ($cfg, $user, $path) = @_; - - $user = PVE::Auth::Plugin::verify_username($user, 1); - return {} if !$user; - - my @ra = roles($cfg, $user, $path); - - my $privs = {}; - - foreach my $role (@ra) { - if (my $privset = $cfg->{roles}->{$role}) { - foreach my $p (keys %$privset) { - $privs->{$p} = 1; - } - } - } - - #print "priviledges $user $path = " . Dumper ($privs); - - return $privs; -} - -sub check_permissions { - my ($username, $path, $privlist) = @_; - - $path = normalize_path($path); - my $usercfg = cfs_read_file('user.cfg'); - my $perm = permission($usercfg, $username, $path); - - foreach my $priv (split_list($privlist)) { - return undef if !$perm->{$priv}; - }; - - return 1; -} - sub remove_vm_access { my ($vmid) = @_; my $delVMaccessFn = sub {