src/PVE/AccessControl.pm

   1 package PVE::AccessControl;
   2
   3 use strict;
   4 use warnings;
   5 use Encode;
   6 use Crypt::OpenSSL::Random;
   7 use Crypt::OpenSSL::RSA;
   8 use Net::SSLeay;
   9 use Net::IP;
  10 use MIME::Base64;
  11 use Digest::SHA;
  12 use IO::File;
  13 use File::stat;
  14 use JSON;
  15
  16 use PVE::OTP;
  17 use PVE::Ticket;
  18 use PVE::Tools qw(run_command lock_file file_get_contents split_list safe_print);
  19 use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file);
  20 use PVE::JSONSchema qw(register_standard_option get_standard_option);
  21
  22 use PVE::RS::TFA;
  23
  24 use PVE::Auth::Plugin;
  25 use PVE::Auth::AD;
  26 use PVE::Auth::LDAP;
  27 use PVE::Auth::PVE;
  28 use PVE::Auth::PAM;
  29 use PVE::Auth::OpenId;
  30
  31 # load and initialize all plugins
  32
  33 PVE::Auth::AD->register();
  34 PVE::Auth::LDAP->register();
  35 PVE::Auth::PVE->register();
  36 PVE::Auth::PAM->register();
  37 PVE::Auth::OpenId->register();
  38 PVE::Auth::Plugin->init();
  39
  40 # $authdir must be writable by root only!
  41 my $confdir = "/etc/pve";
  42 my $authdir = "$confdir/priv";
  43
  44 my $pve_www_key_fn = "$confdir/pve-www.key";
  45
  46 my $pve_auth_key_files = {
  47     priv => "$authdir/authkey.key",
  48     pub =>  "$confdir/authkey.pub",
  49     pubold => "$confdir/authkey.pub.old",
  50 };
  51
  52 my $pve_auth_key_cache = {};
  53
  54 my $ticket_lifetime = 3600 * 2; # 2 hours
  55 my $auth_graceperiod = 60 * 5; # 5 minutes
  56 my $authkey_lifetime = 3600 * 24; # rotate every 24 hours
  57
  58 Crypt::OpenSSL::RSA->import_random_seed();
  59
  60 cfs_register_file('user.cfg', \&parse_user_config, \&write_user_config);
  61 cfs_register_file('priv/tfa.cfg', \&parse_priv_tfa_config, \&write_priv_tfa_config);
  62
  63 sub verify_username {
  64     PVE::Auth::Plugin::verify_username(@_);
  65 }
  66
  67 sub pve_verify_realm {
  68     PVE::Auth::Plugin::pve_verify_realm(@_);
  69 }
  70
  71 sub lock_user_config {
  72     my ($code, $errmsg) = @_;
  73
  74     cfs_lock_file("user.cfg", undef, $code);
  75     if (my $err = $@) {
  76         $errmsg ? die "$errmsg: $err" : die $err;
  77     }
  78 }
  79
  80 sub lock_tfa_config {
  81     my ($code, $errmsg) = @_;
  82
  83     my $res = cfs_lock_file("priv/tfa.cfg", undef, $code);
  84     if (my $err = $@) {
  85         $errmsg ? die "$errmsg: $err" : die $err;
  86     }
  87
  88     return $res;
  89 }
  90
  91 my $cache_read_key = sub {
  92     my ($type) = @_;
  93
  94     my $path = $pve_auth_key_files->{$type};
  95
  96     my $read_key_and_mtime = sub {
  97         my $fh = IO::File->new($path, "r");
  98
  99         return undef if !defined($fh);
 100
 101         my $st = stat($fh);
 102         my $pem = PVE::Tools::safe_read_from($fh, 0, 0, $path);
 103
 104         close $fh;
 105
 106         my $key;
 107         if ($type eq 'pub' || $type eq 'pubold') {
 108             $key = eval { Crypt::OpenSSL::RSA->new_public_key($pem); };
 109         } elsif ($type eq 'priv') {
 110             $key = eval { Crypt::OpenSSL::RSA->new_private_key($pem); };
 111         } else {
 112             die "Invalid authkey type '$type'\n";
 113         }
 114
 115         return { key => $key, mtime => $st->mtime };
 116     };
 117
 118     if (!defined($pve_auth_key_cache->{$type})) {
 119         $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 120     } else {
 121         my $st = stat($path);
 122         if (!$st || $st->mtime != $pve_auth_key_cache->{$type}->{mtime}) {
 123             $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 124         }
 125     }
 126
 127     return $pve_auth_key_cache->{$type};
 128 };
 129
 130 sub get_pubkey {
 131     my ($old) = @_;
 132
 133     my $type = $old ? 'pubold' : 'pub';
 134
 135     my $res = $cache_read_key->($type);
 136     return undef if !defined($res);
 137
 138     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 139 }
 140
 141 sub get_privkey {
 142     my $res = $cache_read_key->('priv');
 143
 144     if (!defined($res) || !check_authkey(1)) {
 145         rotate_authkey();
 146         $res = $cache_read_key->('priv');
 147     }
 148
 149     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 150 }
 151
 152 sub check_authkey {
 153     my ($quiet) = @_;
 154
 155     # skip check if non-quorate, as rotation is not possible anyway
 156     return 1 if !PVE::Cluster::check_cfs_quorum(1);
 157
 158     my ($pub_key, $mtime) = get_pubkey();
 159     if (!$pub_key) {
 160         warn "auth key pair missing, generating new one..\n"  if !$quiet;
 161         return 0;
 162     } else {
 163         my $now = time();
 164         if ($now - $mtime >= $authkey_lifetime) {
 165             warn "auth key pair too old, rotating..\n" if !$quiet;;
 166             return 0;
 167         } elsif ($mtime > $now + $auth_graceperiod) {
 168             # a nodes RTC had a time set in the future during key generation -> ticket
 169             # validity is clamped to 0+5 min grace period until now >= mtime again
 170             my (undef, $old_mtime) = get_pubkey(1);
 171             if ($old_mtime && $mtime >= $old_mtime && $mtime - $old_mtime < $ticket_lifetime) {
 172                 warn "auth key pair generated in the future (key $mtime > host $now),"
 173                     ." but old key still exists and in valid grace period so avoid automatic"
 174                     ." fixup. Cluster time not in sync?\n" if !$quiet;
 175                 return 1;
 176             }
 177             warn "auth key pair generated in the future (key $mtime > host $now), rotating..\n" if !$quiet;
 178             return 0;
 179         } else {
 180             warn "auth key new enough, skipping rotation\n" if !$quiet;;
 181             return 1;
 182         }
 183     }
 184 }
 185
 186 sub rotate_authkey {
 187     return if $authkey_lifetime == 0;
 188
 189     PVE::Cluster::cfs_lock_authkey(undef, sub {
 190         # re-check with lock to avoid double rotation in clusters
 191         return if check_authkey();
 192
 193         my $old = get_pubkey();
 194         my $new = Crypt::OpenSSL::RSA->generate_key(2048);
 195
 196         if ($old) {
 197             eval {
 198                 my $pem = $old->get_public_key_x509_string();
 199                 # mtime is used for caching and ticket age range calculation
 200                 PVE::Tools::file_set_contents($pve_auth_key_files->{pubold}, $pem);
 201             };
 202             die "Failed to store old auth key: $@\n" if $@;
 203         }
 204
 205         eval {
 206             my $pem = $new->get_public_key_x509_string();
 207             # mtime is used for caching and ticket age range calculation,
 208             # should be close to that of pubold above
 209             PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 210         };
 211         if ($@) {
 212             if ($old) {
 213                 warn "Failed to store new auth key - $@\n";
 214                 warn "Reverting to previous auth key\n";
 215                 eval {
 216                     my $pem = $old->get_public_key_x509_string();
 217                     PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 218                 };
 219                 die "Failed to restore old auth key: $@\n" if $@;
 220             } else {
 221                 die "Failed to store new auth key - $@\n";
 222             }
 223         }
 224
 225         eval {
 226             my $pem = $new->get_private_key_string();
 227             PVE::Tools::file_set_contents($pve_auth_key_files->{priv}, $pem);
 228         };
 229         if ($@) {
 230             warn "Failed to store new auth key - $@\n";
 231             warn "Deleting auth key to force regeneration\n";
 232             unlink $pve_auth_key_files->{pub};
 233             unlink $pve_auth_key_files->{priv};
 234         }
 235     });
 236     die $@ if $@;
 237 }
 238
 239 PVE::JSONSchema::register_standard_option('tokenid', {
 240     description => "API token identifier.",
 241     type => "string",
 242     format => "pve-tokenid",
 243 });
 244
 245 our $token_subid_regex = $PVE::Auth::Plugin::realm_regex;
 246
 247 # username@realm username realm tokenid
 248 our $token_full_regex = qr/((${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex}))!(${token_subid_regex})/;
 249
 250 our $userid_or_token_regex = qr/^$PVE::Auth::Plugin::user_regex\@$PVE::Auth::Plugin::realm_regex(?:!$token_subid_regex)?$/;
 251
 252 sub split_tokenid {
 253     my ($tokenid, $noerr) = @_;
 254
 255     if ($tokenid =~ /^${token_full_regex}$/) {
 256         return ($1, $4);
 257     }
 258
 259     die "'$tokenid' is not a valid token ID - not able to split into user and token parts\n" if !$noerr;
 260
 261     return undef;
 262 }
 263
 264 sub join_tokenid {
 265     my ($username, $tokensubid) = @_;
 266
 267     my $joined = "${username}!${tokensubid}";
 268
 269     return pve_verify_tokenid($joined);
 270 }
 271
 272 PVE::JSONSchema::register_format('pve-tokenid', \&pve_verify_tokenid);
 273 sub pve_verify_tokenid {
 274     my ($tokenid, $noerr) = @_;
 275
 276     if ($tokenid =~ /^${token_full_regex}$/) {
 277         return wantarray ? ($tokenid, $2, $3, $4) : $tokenid;
 278     }
 279
 280     die "value '$tokenid' does not look like a valid token ID\n" if !$noerr;
 281
 282     return undef;
 283 }
 284
 285
 286 my $csrf_prevention_secret;
 287 my $csrf_prevention_secret_legacy;
 288 my $get_csrfr_secret = sub {
 289     if (!$csrf_prevention_secret) {
 290         my $input = PVE::Tools::file_get_contents($pve_www_key_fn);
 291         $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input);
 292         $csrf_prevention_secret_legacy = Digest::SHA::sha1_base64($input);
 293     }
 294     return $csrf_prevention_secret;
 295 };
 296
 297 sub assemble_csrf_prevention_token {
 298     my ($username) = @_;
 299
 300     my $secret =  &$get_csrfr_secret();
 301
 302     return PVE::Ticket::assemble_csrf_prevention_token ($secret, $username);
 303 }
 304
 305 sub verify_csrf_prevention_token {
 306     my ($username, $token, $noerr) = @_;
 307
 308     my $secret = $get_csrfr_secret->();
 309
 310     # FIXME: remove with PVE 7 and/or refactor all into PVE::Ticket ?
 311     if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) {
 312         my $sig = $2;
 313         if (length($sig) == 27) {
 314             # the legacy secret got populated by above get_csrfr_secret call
 315             $secret = $csrf_prevention_secret_legacy;
 316         }
 317     }
 318
 319     return PVE::Ticket::verify_csrf_prevention_token(
 320         $secret, $username, $token, -$auth_graceperiod, $ticket_lifetime, $noerr);
 321 }
 322
 323 my $get_ticket_age_range = sub {
 324     my ($now, $mtime, $rotated) = @_;
 325
 326     my $key_age = $now - $mtime;
 327     $key_age = 0 if $key_age < 0;
 328
 329     my $min = -$auth_graceperiod;
 330     my $max = $ticket_lifetime;
 331
 332     if ($rotated) {
 333         # ticket creation after rotation is not allowed
 334         $min = $key_age - $auth_graceperiod;
 335     } else {
 336         if ($key_age > $authkey_lifetime && $authkey_lifetime > 0) {
 337             if (PVE::Cluster::check_cfs_quorum(1)) {
 338                 # key should have been rotated, clamp range accordingly
 339                 $min = $key_age - $authkey_lifetime;
 340             } else {
 341                 warn "Cluster not quorate - extending auth key lifetime!\n";
 342             }
 343         }
 344
 345         $max = $key_age + $auth_graceperiod if $key_age < $ticket_lifetime;
 346     }
 347
 348     return undef if $min > $ticket_lifetime;
 349     return ($min, $max);
 350 };
 351
 352 sub assemble_ticket : prototype($;$) {
 353     my ($data, $aad) = @_;
 354
 355     my $rsa_priv = get_privkey();
 356
 357     return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PVE', $data, $aad);
 358 }
 359
 360 # Returns the username, "age" and tfa info.
 361 #
 362 # Note that for the new-style outh, tfa info is never set, as it only uses the `/ticket` api call
 363 # via the new 'tfa-challenge' parameter, so this part can go with PVE-8.
 364 #
 365 # New-style auth still uses this function, but sets `$tfa_ticket` to true when validating the tfa
 366 # ticket.
 367 sub verify_ticket : prototype($;$$) {
 368     my ($ticket, $noerr, $tfa_ticket_aad) = @_;
 369
 370     my $now = time();
 371
 372     my $check = sub {
 373         my ($old) = @_;
 374
 375         my ($rsa_pub, $rsa_mtime) = get_pubkey($old);
 376         return undef if !$rsa_pub;
 377
 378         my ($min, $max) = $get_ticket_age_range->($now, $rsa_mtime, $old);
 379         return undef if !defined($min);
 380
 381         return PVE::Ticket::verify_rsa_ticket(
 382             $rsa_pub, 'PVE', $ticket, $tfa_ticket_aad, $min, $max, 1);
 383     };
 384
 385     my ($data, $age) = $check->();
 386
 387     # check with old, rotated key if current key failed
 388     ($data, $age) = $check->(1) if !defined($data);
 389
 390     my $auth_failure = sub {
 391         if ($noerr) {
 392             return undef;
 393         } else {
 394             # raise error via undef ticket
 395             PVE::Ticket::verify_rsa_ticket(undef, 'PVE');
 396         }
 397     };
 398
 399     if (!defined($data)) {
 400         return $auth_failure->();
 401     }
 402
 403     if ($tfa_ticket_aad) {
 404         # We're validating a ticket-call's 'tfa-challenge' parameter, so just return its data.
 405         if ($data =~ /^!tfa!(.*)$/) {
 406             return $1;
 407         }
 408         die "bad ticket\n";
 409     }
 410
 411     my ($username, $tfa_info);
 412     if ($data =~ /^!tfa!(.*)$/) {
 413         # PBS style half-authenticated ticket, contains a json string form of a `TfaChallenge`
 414         # object.
 415         # This type of ticket does not contain the user name.
 416         return { type => 'new', data => $1 };
 417     }
 418     if ($data =~ m{^u2f!([^!]+)!([0-9a-zA-Z/.=_\-+]+)$}) {
 419         # Ticket for u2f-users:
 420         ($username, my $challenge) = ($1, $2);
 421         if ($challenge eq 'verified') {
 422             # u2f challenge was completed
 423             $challenge = undef;
 424         } elsif (!wantarray) {
 425             # The caller is not aware there could be an ongoing challenge,
 426             # so we treat this ticket as invalid:
 427             return $auth_failure->();
 428         }
 429         $tfa_info = {
 430             type => 'u2f',
 431             challenge => $challenge,
 432         };
 433     } elsif ($data =~ /^tfa!(.*)$/) {
 434         # TOTP and Yubico don't require a challenge so this is the generic
 435         # 'missing 2nd factor ticket'
 436         $username = $1;
 437         $tfa_info = { type => 'tfa' };
 438     } else {
 439         # Regular ticket (full access)
 440         $username = $data;
 441     }
 442
 443     return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
 444
 445     return wantarray ? ($username, $age, $tfa_info) : $username;
 446 }
 447
 448 sub verify_token {
 449     my ($api_token) = @_;
 450
 451     die "no API token specified\n" if !$api_token;
 452
 453     my ($tokenid, $value);
 454     if ($api_token =~ /^(.*)=(.*)$/) {
 455         $tokenid = $1;
 456         $value = $2;
 457     } else {
 458         die "no tokenid specified\n";
 459     }
 460
 461     my ($username, $token) = split_tokenid($tokenid);
 462
 463     my $usercfg = cfs_read_file('user.cfg');
 464     check_user_enabled($usercfg, $username);
 465     check_token_exist($usercfg, $username, $token);
 466
 467     my $user = $usercfg->{users}->{$username};
 468     my $token_info = $user->{tokens}->{$token};
 469
 470     my $ctime = time();
 471     die "token expired\n" if $token_info->{expire} && ($token_info->{expire} < $ctime);
 472
 473     die "invalid token value!\n" if !PVE::Cluster::verify_token($tokenid, $value);
 474
 475     return wantarray ? ($tokenid) : $tokenid;
 476 }
 477
 478
 479 # VNC tickets
 480 # - they do not contain the username in plain text
 481 # - they are restricted to a specific resource path (example: '/vms/100')
 482 sub assemble_vnc_ticket {
 483     my ($username, $path) = @_;
 484
 485     my $rsa_priv = get_privkey();
 486
 487     $path = normalize_path($path);
 488
 489     my $secret_data = "$username:$path";
 490
 491     return PVE::Ticket::assemble_rsa_ticket(
 492         $rsa_priv, 'PVEVNC', undef, $secret_data);
 493 }
 494
 495 sub verify_vnc_ticket {
 496     my ($ticket, $username, $path, $noerr) = @_;
 497
 498     my $secret_data = "$username:$path";
 499
 500     my ($rsa_pub, $rsa_mtime) = get_pubkey();
 501     if (!$rsa_pub || (time() - $rsa_mtime > $authkey_lifetime && $authkey_lifetime > 0)) {
 502         if ($noerr) {
 503             return undef;
 504         } else {
 505             # raise error via undef ticket
 506             PVE::Ticket::verify_rsa_ticket($rsa_pub, 'PVEVNC');
 507         }
 508     }
 509
 510     return PVE::Ticket::verify_rsa_ticket(
 511         $rsa_pub, 'PVEVNC', $ticket, $secret_data, -20, 40, $noerr);
 512 }
 513
 514 sub assemble_spice_ticket {
 515     my ($username, $vmid, $node) = @_;
 516
 517     my $secret = &$get_csrfr_secret();
 518
 519     return PVE::Ticket::assemble_spice_ticket(
 520         $secret, $username, $vmid, $node);
 521 }
 522
 523 sub verify_spice_connect_url {
 524     my ($connect_str) = @_;
 525
 526     my $secret = &$get_csrfr_secret();
 527
 528     return PVE::Ticket::verify_spice_connect_url($secret, $connect_str);
 529 }
 530
 531 sub read_x509_subject_spice {
 532     my ($filename) = @_;
 533
 534     # read x509 subject
 535     my $bio = Net::SSLeay::BIO_new_file($filename, 'r');
 536     die "Could not open $filename using OpenSSL\n"
 537         if !$bio;
 538
 539     my $x509 = Net::SSLeay::PEM_read_bio_X509($bio);
 540     Net::SSLeay::BIO_free($bio);
 541
 542     die "Could not parse X509 certificate in $filename\n"
 543         if !$x509;
 544
 545     my $nameobj = Net::SSLeay::X509_get_subject_name($x509);
 546     my $subject = Net::SSLeay::X509_NAME_oneline($nameobj);
 547     Net::SSLeay::X509_free($x509);
 548
 549     # remote-viewer wants comma as seperator (not '/')
 550     $subject =~ s!^/!!;
 551     $subject =~ s!/(\w+=)!,$1!g;
 552
 553     return $subject;
 554 }
 555
 556 # helper to generate SPICE remote-viewer configuration
 557 sub remote_viewer_config {
 558     my ($authuser, $vmid, $node, $proxy, $title, $port) = @_;
 559
 560     if (!$proxy) {
 561         my $host = `hostname -f` || PVE::INotify::nodename();
 562         chomp $host;
 563         $proxy = $host;
 564     }
 565
 566     my ($ticket, $proxyticket) = assemble_spice_ticket($authuser, $vmid, $node);
 567
 568     my $filename = "/etc/pve/local/pve-ssl.pem";
 569     my $subject = read_x509_subject_spice($filename);
 570
 571     my $cacert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192);
 572     $cacert =~ s/\n/\\n/g;
 573
 574     $proxy = "[$proxy]" if Net::IP::ip_is_ipv6($proxy);
 575     my $config = {
 576         'secure-attention' => "Ctrl+Alt+Ins",
 577         'toggle-fullscreen' => "Shift+F11",
 578         'release-cursor' => "Ctrl+Alt+R",
 579         type => 'spice',
 580         title => $title,
 581         host => $proxyticket, # this breaks tls hostname verification, so we need to use 'host-subject'
 582         proxy => "http://$proxy:3128",
 583         'tls-port' => $port,
 584         'host-subject' => $subject,
 585         ca => $cacert,
 586         password => $ticket,
 587         'delete-this-file' => 1,
 588     };
 589
 590     return ($ticket, $proxyticket, $config);
 591 }
 592
 593 sub check_user_exist {
 594     my ($usercfg, $username, $noerr) = @_;
 595
 596     $username = PVE::Auth::Plugin::verify_username($username, $noerr);
 597     return undef if !$username;
 598
 599     return $usercfg->{users}->{$username} if $usercfg && $usercfg->{users}->{$username};
 600
 601     die "no such user ('$username')\n" if !$noerr;
 602
 603     return undef;
 604 }
 605
 606 sub check_user_enabled {
 607     my ($usercfg, $username, $noerr) = @_;
 608
 609     my $data = check_user_exist($usercfg, $username, $noerr);
 610     return undef if !$data;
 611
 612     return 1 if $data->{enable};
 613
 614     die "user '$username' is disabled\n" if !$noerr;
 615
 616     my $ctime = time();
 617     my $expire = $usercfg->{users}->{$username}->{expire};
 618
 619     die "account expired\n" if $expire && ($expire < $ctime);
 620
 621     return undef;
 622 }
 623
 624 sub check_token_exist {
 625     my ($usercfg, $username, $tokenid, $noerr) = @_;
 626
 627     my $user = check_user_exist($usercfg, $username, $noerr);
 628     return undef if !$user;
 629
 630     return $user->{tokens}->{$tokenid}
 631         if defined($user->{tokens}) && $user->{tokens}->{$tokenid};
 632
 633     die "no such token '$tokenid' for user '$username'\n" if !$noerr;
 634
 635     return undef;
 636 }
 637
 638 # deprecated
 639 sub verify_one_time_pw {
 640     my ($type, $username, $keys, $tfa_cfg, $otp) = @_;
 641
 642     die "missing one time password for two-factor authentication '$type'\n" if !$otp;
 643
 644     # fixme: proxy support?
 645     my $proxy;
 646
 647     if ($type eq 'yubico') {
 648         PVE::OTP::yubico_verify_otp($otp, $keys, $tfa_cfg->{url},
 649                                     $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
 650     } elsif ($type eq 'oath') {
 651         PVE::OTP::oath_verify_otp($otp, $keys, $tfa_cfg->{step}, $tfa_cfg->{digits});
 652     } else {
 653         die "unknown tfa type '$type'\n";
 654     }
 655 }
 656
 657 # password should be utf8 encoded
 658 # Note: some plugins delay/sleep if auth fails
 659 sub authenticate_user : prototype($$$$;$) {
 660     my ($username, $password, $otp, $new_format, $tfa_challenge) = @_;
 661
 662     die "no username specified\n" if !$username;
 663
 664     my ($ruid, $realm);
 665
 666     ($username, $ruid, $realm) = PVE::Auth::Plugin::verify_username($username);
 667
 668     my $usercfg = cfs_read_file('user.cfg');
 669
 670     check_user_enabled($usercfg, $username);
 671
 672     my $domain_cfg = cfs_read_file('domains.cfg');
 673
 674     my $cfg = $domain_cfg->{ids}->{$realm};
 675     die "auth domain '$realm' does not exist\n" if !$cfg;
 676     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 677
 678     if ($tfa_challenge) {
 679         # This is the 2nd factor, use the password for the OTP response.
 680         my $tfa_challenge = authenticate_2nd_new($username, $realm, $password, $tfa_challenge);
 681         return wantarray ? ($username, $tfa_challenge) : $username;
 682     }
 683
 684     $plugin->authenticate_user($cfg, $realm, $ruid, $password);
 685
 686     if ($new_format) {
 687         # This is the first factor with an optional immediate 2nd factor for TOTP:
 688         my $tfa_challenge = authenticate_2nd_new($username, $realm, $otp, $tfa_challenge);
 689         return wantarray ? ($username, $tfa_challenge) : $username;
 690     } else {
 691         return authenticate_2nd_old($username, $realm, $otp);
 692     }
 693 }
 694
 695 sub authenticate_2nd_old : prototype($$$) {
 696     my ($username, $realm, $otp) = @_;
 697
 698     my ($type, $tfa_data) = user_get_tfa($username, $realm, 0);
 699     if ($type) {
 700         if ($type eq 'u2f') {
 701             # Note that if the user did not manage to complete the initial u2f registration
 702             # challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
 703             $tfa_data = undef if exists $tfa_data->{challenge};
 704         } elsif (!defined($otp)) {
 705             # The user requires a 2nd factor but has not provided one. Return success but
 706             # don't clear $tfa_data.
 707         } else {
 708             my $keys = $tfa_data->{keys};
 709             my $tfa_cfg = $tfa_data->{config};
 710             verify_one_time_pw($type, $username, $keys, $tfa_cfg, $otp);
 711             $tfa_data = undef;
 712         }
 713
 714         # Return the type along with the rest:
 715         if ($tfa_data) {
 716             $tfa_data = {
 717                 type => $type,
 718                 data => $tfa_data,
 719             };
 720         }
 721     }
 722
 723     return wantarray ? ($username, $tfa_data) : $username;
 724 }
 725
 726 # Returns a tfa challenge or undef.
 727 sub authenticate_2nd_new : prototype($$$$) {
 728     my ($username, $realm, $otp, $tfa_challenge) = @_;
 729
 730     my $result = lock_tfa_config(sub {
 731         my ($tfa_cfg, $realm_tfa) = user_get_tfa($username, $realm, 1);
 732
 733         if (!defined($tfa_cfg)) {
 734             return undef;
 735         }
 736
 737         my $realm_type = $realm_tfa && $realm_tfa->{type};
 738         if (defined($realm_type) && $realm_type eq 'yubico') {
 739             # Yubico auth will not be supported in rust for now...
 740             if (!defined($tfa_challenge)) {
 741                 my $challenge = { yubico => JSON::true };
 742                 # Even with yubico auth we do allow recovery keys to be used:
 743                 if (my $recovery = $tfa_cfg->recovery_state($username)) {
 744                     $challenge->{recovery} = $recovery;
 745                 }
 746                 return to_json($challenge);
 747             }
 748
 749             if ($otp =~ /^yubico:(.*)$/) {
 750                 $otp = $1;
 751                 # Defer to after unlocking the TFA config:
 752                 return sub {
 753                     authenticate_yubico_new($tfa_cfg, $username, $realm_tfa, $tfa_challenge, $otp);
 754                 };
 755             }
 756
 757             # Beside the realm configured auth we only allow recovery keys:
 758             if ($otp !~ /^recovery:/) {
 759                 die "realm requires yubico authentication\n";
 760             }
 761         }
 762
 763         configure_u2f_and_wa($tfa_cfg);
 764
 765         my $must_save = 0;
 766         if (defined($tfa_challenge)) {
 767             $tfa_challenge = verify_ticket($tfa_challenge, 0, $username);
 768             $must_save = $tfa_cfg->authentication_verify($username, $tfa_challenge, $otp);
 769             $tfa_challenge = undef;
 770         } else {
 771             $tfa_challenge = $tfa_cfg->authentication_challenge($username);
 772             if (defined($otp)) {
 773                 if (defined($tfa_challenge)) {
 774                     $must_save = $tfa_cfg->authentication_verify($username, $tfa_challenge, $otp);
 775                 } else {
 776                     die "no such challenge\n";
 777                 }
 778             }
 779         }
 780
 781         if ($must_save) {
 782             cfs_write_file('priv/tfa.cfg', $tfa_cfg);
 783         }
 784
 785         return $tfa_challenge;
 786     });
 787
 788     # Yubico auth returns the authentication sub:
 789     if (ref($result) eq 'CODE') {
 790         $result = $result->();
 791     }
 792
 793     return $result;
 794 }
 795
 796 sub authenticate_yubico_new : prototype($$$) {
 797     my ($tfa_cfg, $username, $realm, $tfa_challenge, $otp) = @_;
 798
 799     $tfa_challenge = verify_ticket($tfa_challenge, 0, $username);
 800     $tfa_challenge = from_json($tfa_challenge);
 801
 802     if (!$tfa_challenge->{yubico}) {
 803         die "no such challenge\n";
 804     }
 805
 806     my $keys = $tfa_cfg->get_yubico_keys($username);
 807     die "no keys configured\n" if !defined($keys) || !length($keys);
 808
 809     authenticate_yubico_do($otp, $keys, $realm);
 810
 811     # return `undef` to clear the tfa challenge.
 812     return undef;
 813 }
 814
 815 sub authenticate_yubico_do : prototype($$$) {
 816     my ($value, $keys, $realm) = @_;
 817
 818     # fixme: proxy support?
 819     my $proxy = undef;
 820
 821     PVE::OTP::yubico_verify_otp($value, $keys, $realm->{url}, $realm->{id}, $realm->{key}, $proxy);
 822 }
 823
 824 sub configure_u2f_and_wa : prototype($) {
 825     my ($tfa_cfg) = @_;
 826
 827     my $dc = cfs_read_file('datacenter.cfg');
 828     if (my $u2f = $dc->{u2f}) {
 829         my $origin = $u2f->{origin};
 830         if (!defined($origin)) {
 831             my $rpcenv = PVE::RPCEnvironment::get();
 832             $origin = $rpcenv->get_request_host(1);
 833             if ($origin) {
 834                 $origin = "https://$origin";
 835             } else {
 836                 die "failed to figure out u2f origin\n";
 837             }
 838         }
 839         $tfa_cfg->set_u2f_config({
 840             origin => $origin,
 841             appid => $u2f->{appid},
 842         });
 843     }
 844     if (my $wa = $dc->{webauthn}) {
 845         $tfa_cfg->set_webauthn_config($wa);
 846     }
 847 }
 848
 849 sub domain_set_password {
 850     my ($realm, $username, $password) = @_;
 851
 852     die "no auth domain specified" if !$realm;
 853
 854     my $domain_cfg = cfs_read_file('domains.cfg');
 855
 856     my $cfg = $domain_cfg->{ids}->{$realm};
 857     die "auth domain '$realm' does not exist\n" if !$cfg;
 858     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 859     $plugin->store_password($cfg, $realm, $username, $password);
 860 }
 861
 862 sub add_user_group {
 863     my ($username, $usercfg, $group) = @_;
 864
 865     $usercfg->{users}->{$username}->{groups}->{$group} = 1;
 866     $usercfg->{groups}->{$group}->{users}->{$username} = 1;
 867 }
 868
 869 sub delete_user_group {
 870     my ($username, $usercfg) = @_;
 871
 872     foreach my $group (keys %{$usercfg->{groups}}) {
 873
 874         delete ($usercfg->{groups}->{$group}->{users}->{$username})
 875             if $usercfg->{groups}->{$group}->{users}->{$username};
 876     }
 877 }
 878
 879 sub delete_user_acl {
 880     my ($username, $usercfg) = @_;
 881
 882     foreach my $acl (keys %{$usercfg->{acl}}) {
 883
 884         delete ($usercfg->{acl}->{$acl}->{users}->{$username})
 885             if $usercfg->{acl}->{$acl}->{users}->{$username};
 886     }
 887 }
 888
 889 sub delete_group_acl {
 890     my ($group, $usercfg) = @_;
 891
 892     foreach my $acl (keys %{$usercfg->{acl}}) {
 893
 894         delete ($usercfg->{acl}->{$acl}->{groups}->{$group})
 895             if $usercfg->{acl}->{$acl}->{groups}->{$group};
 896     }
 897 }
 898
 899 sub delete_pool_acl {
 900     my ($pool, $usercfg) = @_;
 901
 902     my $path = "/pool/$pool";
 903
 904     delete ($usercfg->{acl}->{$path})
 905 }
 906
 907 # we automatically create some predefined roles by splitting privs
 908 # into 3 groups (per category)
 909 # root: only root is allowed to do that
 910 # admin: an administrator can to that
 911 # user: a normal user/customer can to that
 912 my $privgroups = {
 913     VM => {
 914         root => [],
 915         admin => [
 916             'VM.Config.Disk',
 917             'VM.Config.CPU',
 918             'VM.Config.Memory',
 919             'VM.Config.Network',
 920             'VM.Config.HWType',
 921             'VM.Config.Options', # covers all other things
 922             'VM.Allocate',
 923             'VM.Clone',
 924             'VM.Migrate',
 925             'VM.Monitor',
 926             'VM.Snapshot',
 927             'VM.Snapshot.Rollback',
 928         ],
 929         user => [
 930             'VM.Config.CDROM', # change CDROM media
 931             'VM.Config.Cloudinit',
 932             'VM.Console',
 933             'VM.Backup',
 934             'VM.PowerMgmt',
 935         ],
 936         audit => [
 937             'VM.Audit',
 938         ],
 939     },
 940     Sys => {
 941         root => [
 942             'Sys.PowerMgmt',
 943             'Sys.Modify', # edit/change node settings
 944         ],
 945         admin => [
 946             'Permissions.Modify',
 947             'Sys.Console',
 948             'Sys.Syslog',
 949         ],
 950         user => [],
 951         audit => [
 952             'Sys.Audit',
 953         ],
 954     },
 955     Datastore => {
 956         root => [],
 957         admin => [
 958             'Datastore.Allocate',
 959             'Datastore.AllocateTemplate',
 960         ],
 961         user => [
 962             'Datastore.AllocateSpace',
 963         ],
 964         audit => [
 965             'Datastore.Audit',
 966         ],
 967     },
 968     SDN => {
 969         root => [],
 970         admin => [
 971             'SDN.Allocate',
 972             'SDN.Audit',
 973         ],
 974         audit => [
 975             'SDN.Audit',
 976         ],
 977     },
 978     User => {
 979         root => [
 980             'Realm.Allocate',
 981         ],
 982         admin => [
 983             'User.Modify',
 984             'Group.Allocate', # edit/change group settings
 985             'Realm.AllocateUser',
 986         ],
 987         user => [],
 988         audit => [],
 989     },
 990     Pool => {
 991         root => [],
 992         admin => [
 993             'Pool.Allocate', # create/delete pools
 994         ],
 995         user => [
 996             'Pool.Audit',
 997         ],
 998         audit => [
 999             'Pool.Audit',
1000         ],
1001     },
1002 };
1003
1004 my $valid_privs = {};
1005
1006 my $special_roles = {
1007     'NoAccess' => {}, # no privileges
1008     'Administrator' => $valid_privs, # all privileges
1009 };
1010
1011 sub create_roles {
1012
1013     foreach my $cat (keys %$privgroups) {
1014         my $cd = $privgroups->{$cat};
1015         foreach my $p (@{$cd->{root}}, @{$cd->{admin}},
1016                        @{$cd->{user}}, @{$cd->{audit}}) {
1017             $valid_privs->{$p} = 1;
1018         }
1019         foreach my $p (@{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
1020
1021             $special_roles->{"PVE${cat}Admin"}->{$p} = 1;
1022             $special_roles->{"PVEAdmin"}->{$p} = 1;
1023         }
1024         if (scalar(@{$cd->{user}})) {
1025             foreach my $p (@{$cd->{user}}, @{$cd->{audit}}) {
1026                 $special_roles->{"PVE${cat}User"}->{$p} = 1;
1027             }
1028         }
1029         foreach my $p (@{$cd->{audit}}) {
1030             $special_roles->{"PVEAuditor"}->{$p} = 1;
1031         }
1032     }
1033
1034     $special_roles->{"PVETemplateUser"} = { 'VM.Clone' => 1, 'VM.Audit' => 1 };
1035 };
1036
1037 create_roles();
1038
1039 sub create_priv_properties {
1040     my $properties = {};
1041     foreach my $priv (keys %$valid_privs) {
1042         $properties->{$priv} = {
1043             type => 'boolean',
1044             optional => 1,
1045         };
1046     }
1047     return $properties;
1048 }
1049
1050 sub role_is_special {
1051     my ($role) = @_;
1052     return (exists $special_roles->{$role}) ? 1 : 0;
1053 }
1054
1055 sub add_role_privs {
1056     my ($role, $usercfg, $privs) = @_;
1057
1058     return if !$privs;
1059
1060     die "role '$role' does not exist\n" if !$usercfg->{roles}->{$role};
1061
1062     foreach my $priv (split_list($privs)) {
1063         if (defined ($valid_privs->{$priv})) {
1064             $usercfg->{roles}->{$role}->{$priv} = 1;
1065         } else {
1066             die "invalid privilege '$priv'\n";
1067         }
1068     }
1069 }
1070
1071 sub lookup_username {
1072     my ($username, $noerr) = @_;
1073
1074     $username =~ m!^(${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex})$!;
1075
1076     my $realm = $2;
1077     my $domain_cfg = cfs_read_file("domains.cfg");
1078     my $casesensitive = $domain_cfg->{ids}->{$realm}->{'case-sensitive'} // 1;
1079     my $usercfg = cfs_read_file('user.cfg');
1080
1081     if (!$casesensitive) {
1082         my @matches = grep { lc $username eq lc $_ } (keys %{$usercfg->{users}});
1083
1084         die "ambiguous case insensitive match of username '$username', cannot safely grant access!\n"
1085             if scalar @matches > 1 && !$noerr;
1086
1087         return $matches[0]
1088     }
1089
1090     return $username;
1091 }
1092
1093 sub normalize_path {
1094     my $path = shift;
1095
1096     $path =~ s|/+|/|g;
1097
1098     $path =~ s|/$||;
1099
1100     $path = '/' if !$path;
1101
1102     $path = "/$path" if $path !~ m|^/|;
1103
1104     return undef if $path !~ m|^[[:alnum:]\.\-\_\/]+$|;
1105
1106     return $path;
1107 }
1108
1109 sub check_path {
1110     my ($path) = @_;
1111     return $path =~ m!^(
1112         /
1113         |/access
1114         |/access/groups
1115         |/access/groups/[[:alnum:]\.\-\_]+
1116         |/access/realm
1117         |/access/realm/[[:alnum:]\.\-\_]+
1118         |/nodes
1119         |/nodes/[[:alnum:]\.\-\_]+
1120         |/pool
1121         |/pool/[[:alnum:]\.\-\_]+
1122         |/sdn
1123         |/sdn/zones/[[:alnum:]\.\-\_]+
1124         |/sdn/vnets/[[:alnum:]\.\-\_]+
1125         |/storage
1126         |/storage/[[:alnum:]\.\-\_]+
1127         |/vms
1128         |/vms/[1-9][0-9]{2,}
1129     )$!xs;
1130 }
1131
1132 PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
1133 sub verify_groupname {
1134     my ($groupname, $noerr) = @_;
1135
1136     if ($groupname !~ m/^[A-Za-z0-9\.\-_]+$/) {
1137
1138         die "group name '$groupname' contains invalid characters\n" if !$noerr;
1139
1140         return undef;
1141     }
1142
1143     return $groupname;
1144 }
1145
1146 PVE::JSONSchema::register_format('pve-roleid', \&verify_rolename);
1147 sub verify_rolename {
1148     my ($rolename, $noerr) = @_;
1149
1150     if ($rolename !~ m/^[A-Za-z0-9\.\-_]+$/) {
1151
1152         die "role name '$rolename' contains invalid characters\n" if !$noerr;
1153
1154         return undef;
1155     }
1156
1157     return $rolename;
1158 }
1159
1160 PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname);
1161 sub verify_poolname {
1162     my ($poolname, $noerr) = @_;
1163
1164     if ($poolname !~ m/^[A-Za-z0-9\.\-_]+$/) {
1165
1166         die "pool name '$poolname' contains invalid characters\n" if !$noerr;
1167
1168         return undef;
1169     }
1170
1171     return $poolname;
1172 }
1173
1174 PVE::JSONSchema::register_format('pve-priv', \&verify_privname);
1175 sub verify_privname {
1176     my ($priv, $noerr) = @_;
1177
1178     if (!$valid_privs->{$priv}) {
1179         die "invalid privilege '$priv'\n" if !$noerr;
1180
1181         return undef;
1182     }
1183
1184     return $priv;
1185 }
1186
1187 sub userconfig_force_defaults {
1188     my ($cfg) = @_;
1189
1190     foreach my $r (keys %$special_roles) {
1191         $cfg->{roles}->{$r} = $special_roles->{$r};
1192     }
1193
1194     # add root user if not exists
1195     if (!$cfg->{users}->{'root@pam'}) {
1196         $cfg->{users}->{'root@pam'}->{enable} = 1;
1197     }
1198 }
1199
1200 sub parse_user_config {
1201     my ($filename, $raw) = @_;
1202
1203     my $cfg = {};
1204
1205     userconfig_force_defaults($cfg);
1206
1207     $raw = '' if !defined($raw);
1208     while ($raw =~ /^\s*(.+?)\s*$/gm) {
1209         my $line = $1;
1210         my @data;
1211
1212         foreach my $d (split (/:/, $line)) {
1213             $d =~ s/^\s+//;
1214             $d =~ s/\s+$//;
1215             push @data, $d
1216         }
1217
1218         my $et = shift @data;
1219
1220         if ($et eq 'user') {
1221             my ($user, $enable, $expire, $firstname, $lastname, $email, $comment, $keys) = @data;
1222
1223             my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1224             if (!$realm) {
1225                 warn "user config - ignore user '$user' - invalid user name\n";
1226                 next;
1227             }
1228
1229             $enable = $enable ? 1 : 0;
1230
1231             $expire = 0 if !$expire;
1232
1233             if ($expire !~ m/^\d+$/) {
1234                 warn "user config - ignore user '$user' - (illegal characters in expire '$expire')\n";
1235                 next;
1236             }
1237             $expire = int($expire);
1238
1239             #if (!verify_groupname ($group, 1)) {
1240             #    warn "user config - ignore user '$user' - invalid characters in group name\n";
1241             #    next;
1242             #}
1243
1244             $cfg->{users}->{$user} = {
1245                 enable => $enable,
1246                 # group => $group,
1247             };
1248             $cfg->{users}->{$user}->{firstname} = PVE::Tools::decode_text($firstname) if $firstname;
1249             $cfg->{users}->{$user}->{lastname} = PVE::Tools::decode_text($lastname) if $lastname;
1250             $cfg->{users}->{$user}->{email} = $email;
1251             $cfg->{users}->{$user}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1252             $cfg->{users}->{$user}->{expire} = $expire;
1253             # keys: allowed yubico key ids or oath secrets (base32 encoded)
1254             $cfg->{users}->{$user}->{keys} = $keys if $keys;
1255
1256             #$cfg->{users}->{$user}->{groups}->{$group} = 1;
1257             #$cfg->{groups}->{$group}->{$user} = 1;
1258
1259         } elsif ($et eq 'group') {
1260             my ($group, $userlist, $comment) = @data;
1261
1262             if (!verify_groupname($group, 1)) {
1263                 warn "user config - ignore group '$group' - invalid characters in group name\n";
1264                 next;
1265             }
1266
1267             # make sure to add the group (even if there are no members)
1268             $cfg->{groups}->{$group} = { users => {} } if !$cfg->{groups}->{$group};
1269
1270             $cfg->{groups}->{$group}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1271
1272             foreach my $user (split_list($userlist)) {
1273
1274                 if (!PVE::Auth::Plugin::verify_username($user, 1)) {
1275                     warn "user config - ignore invalid group member '$user'\n";
1276                     next;
1277                 }
1278
1279                 if ($cfg->{users}->{$user}) { # user exists
1280                     $cfg->{users}->{$user}->{groups}->{$group} = 1;
1281                 } else {
1282                     warn "user config - ignore invalid group member '$user'\n";
1283                 }
1284                 $cfg->{groups}->{$group}->{users}->{$user} = 1;
1285             }
1286
1287         } elsif ($et eq 'role') {
1288             my ($role, $privlist) = @data;
1289
1290             if (!verify_rolename($role, 1)) {
1291                 warn "user config - ignore role '$role' - invalid characters in role name\n";
1292                 next;
1293             }
1294
1295             # make sure to add the role (even if there are no privileges)
1296             $cfg->{roles}->{$role} = {} if !$cfg->{roles}->{$role};
1297
1298             foreach my $priv (split_list($privlist)) {
1299                 if (defined ($valid_privs->{$priv})) {
1300                     $cfg->{roles}->{$role}->{$priv} = 1;
1301                 } else {
1302                     warn "user config - ignore invalid privilege '$priv'\n";
1303                 }
1304             }
1305
1306         } elsif ($et eq 'acl') {
1307             my ($propagate, $pathtxt, $uglist, $rolelist) = @data;
1308
1309             $propagate = $propagate ? 1 : 0;
1310
1311             if (my $path = normalize_path($pathtxt)) {
1312                 foreach my $role (split_list($rolelist)) {
1313
1314                     if (!verify_rolename($role, 1)) {
1315                         warn "user config - ignore invalid role name '$role' in acl\n";
1316                         next;
1317                     }
1318
1319                     if (!$cfg->{roles}->{$role}) {
1320                         warn "user config - ignore invalid acl role '$role'\n";
1321                         next;
1322                     }
1323
1324                     foreach my $ug (split_list($uglist)) {
1325                         my ($group) = $ug =~ m/^@(\S+)$/;
1326
1327                         if ($group && verify_groupname($group, 1)) {
1328                             if (!$cfg->{groups}->{$group}) { # group does not exist
1329                                 warn "user config - ignore invalid acl group '$group'\n";
1330                             }
1331                             $cfg->{acl}->{$path}->{groups}->{$group}->{$role} = $propagate;
1332                         } elsif (PVE::Auth::Plugin::verify_username($ug, 1)) {
1333                             if (!$cfg->{users}->{$ug}) { # user does not exist
1334                                 warn "user config - ignore invalid acl member '$ug'\n";
1335                             }
1336                             $cfg->{acl}->{$path}->{users}->{$ug}->{$role} = $propagate;
1337                         } elsif (my ($user, $token) = split_tokenid($ug, 1)) {
1338                             if (check_token_exist($cfg, $user, $token, 1)) {
1339                                 $cfg->{acl}->{$path}->{tokens}->{$ug}->{$role} = $propagate;
1340                             } else {
1341                                 warn "user config - ignore invalid acl token '$ug'\n";
1342                             }
1343                         } else {
1344                             warn "user config - invalid user/group '$ug' in acl\n";
1345                         }
1346                     }
1347                 }
1348             } else {
1349                 warn "user config - ignore invalid path in acl '$pathtxt'\n";
1350             }
1351         } elsif ($et eq 'pool') {
1352             my ($pool, $comment, $vmlist, $storelist) = @data;
1353
1354             if (!verify_poolname($pool, 1)) {
1355                 warn "user config - ignore pool '$pool' - invalid characters in pool name\n";
1356                 next;
1357             }
1358
1359             # make sure to add the pool (even if there are no members)
1360             $cfg->{pools}->{$pool} = { vms => {}, storage => {} } if !$cfg->{pools}->{$pool};
1361
1362             $cfg->{pools}->{$pool}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1363
1364             foreach my $vmid (split_list($vmlist)) {
1365                 if ($vmid !~ m/^\d+$/) {
1366                     warn "user config - ignore invalid vmid '$vmid' in pool '$pool'\n";
1367                     next;
1368                 }
1369                 $vmid = int($vmid);
1370
1371                 if ($cfg->{vms}->{$vmid}) {
1372                     warn "user config - ignore duplicate vmid '$vmid' in pool '$pool'\n";
1373                     next;
1374                 }
1375
1376                 $cfg->{pools}->{$pool}->{vms}->{$vmid} = 1;
1377
1378                 # record vmid ==> pool relation
1379                 $cfg->{vms}->{$vmid} = $pool;
1380             }
1381
1382             foreach my $storeid (split_list($storelist)) {
1383                 if ($storeid !~ m/^[a-z][a-z0-9\-\_\.]*[a-z0-9]$/i) {
1384                     warn "user config - ignore invalid storage '$storeid' in pool '$pool'\n";
1385                     next;
1386                 }
1387                 $cfg->{pools}->{$pool}->{storage}->{$storeid} = 1;
1388             }
1389         } elsif ($et eq 'token') {
1390             my ($tokenid, $expire, $privsep, $comment) = @data;
1391
1392             my ($user, $token) = split_tokenid($tokenid, 1);
1393             if (!($user && $token)) {
1394                 warn "user config - ignore invalid tokenid '$tokenid'\n";
1395                 next;
1396             }
1397
1398             $privsep = $privsep ? 1 : 0;
1399
1400             $expire = 0 if !$expire;
1401
1402             if ($expire !~ m/^\d+$/) {
1403                 warn "user config - ignore token '$tokenid' - (illegal characters in expire '$expire')\n";
1404                 next;
1405             }
1406             $expire = int($expire);
1407
1408             if (my $user_cfg = $cfg->{users}->{$user}) { # user exists
1409                 $user_cfg->{tokens}->{$token} = {} if !$user_cfg->{tokens}->{$token};
1410                 my $token_cfg = $user_cfg->{tokens}->{$token};
1411                 $token_cfg->{privsep} = $privsep;
1412                 $token_cfg->{expire} = $expire;
1413                 $token_cfg->{comment} = PVE::Tools::decode_text($comment) if $comment;
1414             } else {
1415                 warn "user config - ignore token '$tokenid' - user does not exist\n";
1416             }
1417         } else {
1418             warn "user config - ignore config line: $line\n";
1419         }
1420     }
1421
1422     userconfig_force_defaults($cfg);
1423
1424     return $cfg;
1425 }
1426
1427 sub write_user_config {
1428     my ($filename, $cfg) = @_;
1429
1430     my $data = '';
1431
1432     foreach my $user (sort keys %{$cfg->{users}}) {
1433         my $d = $cfg->{users}->{$user};
1434         my $firstname = $d->{firstname} ? PVE::Tools::encode_text($d->{firstname}) : '';
1435         my $lastname = $d->{lastname} ? PVE::Tools::encode_text($d->{lastname}) : '';
1436         my $email = $d->{email} || '';
1437         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1438         my $expire = int($d->{expire} || 0);
1439         my $enable = $d->{enable} ? 1 : 0;
1440         my $keys = $d->{keys} ? $d->{keys} : '';
1441         $data .= "user:$user:$enable:$expire:$firstname:$lastname:$email:$comment:$keys:\n";
1442
1443         my $user_tokens = $d->{tokens};
1444         foreach my $token (sort keys %$user_tokens) {
1445             my $td = $user_tokens->{$token};
1446             my $full_tokenid = join_tokenid($user, $token);
1447             my $comment = $td->{comment} ? PVE::Tools::encode_text($td->{comment}) : '';
1448             my $expire = int($td->{expire} || 0);
1449             my $privsep = $td->{privsep} ? 1 : 0;
1450             $data .= "token:$full_tokenid:$expire:$privsep:$comment:\n";
1451         }
1452     }
1453
1454     $data .= "\n";
1455
1456     foreach my $group (sort keys %{$cfg->{groups}}) {
1457         my $d = $cfg->{groups}->{$group};
1458         my $list = join (',', sort keys %{$d->{users}});
1459         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1460         $data .= "group:$group:$list:$comment:\n";
1461     }
1462
1463     $data .= "\n";
1464
1465     foreach my $pool (sort keys %{$cfg->{pools}}) {
1466         my $d = $cfg->{pools}->{$pool};
1467         my $vmlist = join (',', sort keys %{$d->{vms}});
1468         my $storelist = join (',', sort keys %{$d->{storage}});
1469         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1470         $data .= "pool:$pool:$comment:$vmlist:$storelist:\n";
1471     }
1472
1473     $data .= "\n";
1474
1475     foreach my $role (sort keys %{$cfg->{roles}}) {
1476         next if $special_roles->{$role};
1477
1478         my $d = $cfg->{roles}->{$role};
1479         my $list = join (',', sort keys %$d);
1480         $data .= "role:$role:$list:\n";
1481     }
1482
1483     $data .= "\n";
1484
1485     my $collect_rolelist_members = sub {
1486         my ($acl_members, $result, $prefix, $exclude) = @_;
1487
1488         foreach my $member (keys %$acl_members) {
1489             next if $exclude && $member eq $exclude;
1490
1491             my $l0 = '';
1492             my $l1 = '';
1493             foreach my $role (sort keys %{$acl_members->{$member}}) {
1494                 my $propagate = $acl_members->{$member}->{$role};
1495                 if ($propagate) {
1496                     $l1 .= ',' if $l1;
1497                     $l1 .= $role;
1498                 } else {
1499                     $l0 .= ',' if $l0;
1500                     $l0 .= $role;
1501                 }
1502             }
1503             $result->{0}->{$l0}->{"${prefix}${member}"} = 1 if $l0;
1504             $result->{1}->{$l1}->{"${prefix}${member}"} = 1 if $l1;
1505         }
1506     };
1507
1508     foreach my $path (sort keys %{$cfg->{acl}}) {
1509         my $d = $cfg->{acl}->{$path};
1510
1511         my $rolelist_members = {};
1512
1513         $collect_rolelist_members->($d->{'groups'}, $rolelist_members, '@');
1514
1515         # no need to save 'root@pam', it is always 'Administrator'
1516         $collect_rolelist_members->($d->{'users'}, $rolelist_members, '', 'root@pam');
1517
1518         $collect_rolelist_members->($d->{'tokens'}, $rolelist_members, '');
1519
1520         foreach my $propagate (0,1) {
1521             my $filtered = $rolelist_members->{$propagate};
1522             foreach my $rolelist (sort keys %$filtered) {
1523                 my $uglist = join (',', sort keys %{$filtered->{$rolelist}});
1524                 $data .= "acl:$propagate:$path:$uglist:$rolelist:\n";
1525             }
1526
1527         }
1528     }
1529
1530     return $data;
1531 }
1532
1533 # Creates a `PVE::RS::TFA` instance from the raw config data.
1534 # Its contained hash will also support the legacy functionality.
1535 sub parse_priv_tfa_config {
1536     my ($filename, $raw) = @_;
1537
1538     $raw = '' if !defined($raw);
1539     my $cfg = PVE::RS::TFA->new($raw);
1540
1541     # Purge invalid users:
1542     foreach my $user ($cfg->users()->@*) {
1543         my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1544         if (!$realm) {
1545             warn "user tfa config - ignore user '$user' - invalid user name\n";
1546             $cfg->remove_user($user);
1547         }
1548     }
1549
1550     return $cfg;
1551 }
1552
1553 sub write_priv_tfa_config {
1554     my ($filename, $cfg) = @_;
1555
1556     # FIXME: Only allow this if the complete cluster has been upgraded to understand the json
1557     # config format.
1558     return $cfg->write();
1559 }
1560
1561 sub roles {
1562     my ($cfg, $user, $path) = @_;
1563
1564     # NOTE: we do not consider pools here.
1565     # NOTE: for privsep tokens, this does not filter roles by those that the
1566     # corresponding user has.
1567     # Use $rpcenv->permission() for any actual permission checks!
1568
1569     return 'Administrator' if $user eq 'root@pam'; # root can do anything
1570
1571     if (pve_verify_tokenid($user, 1)) {
1572         my $tokenid = $user;
1573         my ($username, $token) = split_tokenid($tokenid);
1574
1575         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
1576         return () if !$token_info;
1577
1578         my $user_roles = roles($cfg, $username, $path);
1579
1580         # return full user privileges
1581         return $user_roles if !$token_info->{privsep};
1582     }
1583
1584     my $roles = {};
1585
1586     foreach my $p (sort keys %{$cfg->{acl}}) {
1587         my $final = ($path eq $p);
1588
1589         next if !(($p eq '/') || $final || ($path =~ m|^$p/|));
1590
1591         my $acl = $cfg->{acl}->{$p};
1592
1593         #print "CHECKACL $path $p\n";
1594         #print "ACL $path = " . Dumper ($acl);
1595         if (my $ri = $acl->{tokens}->{$user}) {
1596             my $new;
1597             foreach my $role (keys %$ri) {
1598                 my $propagate = $ri->{$role};
1599                 if ($final || $propagate) {
1600                     #print "APPLY ROLE $p $user $role\n";
1601                     $new = {} if !$new;
1602                     $new->{$role} = $propagate;
1603                 }
1604             }
1605             if ($new) {
1606                 $roles = $new; # overwrite previous settings
1607                 next;
1608             }
1609         }
1610
1611         if (my $ri = $acl->{users}->{$user}) {
1612             my $new;
1613             foreach my $role (keys %$ri) {
1614                 my $propagate = $ri->{$role};
1615                 if ($final || $propagate) {
1616                     #print "APPLY ROLE $p $user $role\n";
1617                     $new = {} if !$new;
1618                     $new->{$role} = $propagate;
1619                 }
1620             }
1621             if ($new) {
1622                 $roles = $new; # overwrite previous settings
1623                 next; # user privs always override group privs
1624             }
1625         }
1626
1627         my $new;
1628         foreach my $g (keys %{$acl->{groups}}) {
1629             next if !$cfg->{groups}->{$g}->{users}->{$user};
1630             if (my $ri = $acl->{groups}->{$g}) {
1631                 foreach my $role (keys %$ri) {
1632                     my $propagate = $ri->{$role};
1633                     if ($final || $propagate) {
1634                         #print "APPLY ROLE $p \@$g $role\n";
1635                         $new = {} if !$new;
1636                         $new->{$role} = $propagate;
1637                     }
1638                 }
1639             }
1640         }
1641         if ($new) {
1642             $roles = $new; # overwrite previous settings
1643             next;
1644         }
1645     }
1646
1647     return { 'NoAccess' => $roles->{NoAccess} } if defined ($roles->{NoAccess});
1648     #return () if defined ($roles->{NoAccess});
1649
1650     #print "permission $user $path = " . Dumper ($roles);
1651
1652     #print "roles $user $path = " . join (',', @ra) . "\n";
1653
1654     return $roles;
1655 }
1656
1657 sub remove_vm_access {
1658     my ($vmid) = @_;
1659     my $delVMaccessFn = sub {
1660         my $usercfg = cfs_read_file("user.cfg");
1661         my $modified;
1662
1663         if (my $acl = $usercfg->{acl}->{"/vms/$vmid"}) {
1664             delete $usercfg->{acl}->{"/vms/$vmid"};
1665             $modified = 1;
1666         }
1667         if (my $pool = $usercfg->{vms}->{$vmid}) {
1668             if (my $data = $usercfg->{pools}->{$pool}) {
1669                 delete $data->{vms}->{$vmid};
1670                 delete $usercfg->{vms}->{$vmid};
1671                 $modified = 1;
1672             }
1673         }
1674         cfs_write_file("user.cfg", $usercfg) if $modified;
1675     };
1676
1677     lock_user_config($delVMaccessFn, "access permissions cleanup for VM $vmid failed");
1678 }
1679
1680 sub remove_storage_access {
1681     my ($storeid) = @_;
1682
1683     my $deleteStorageAccessFn = sub {
1684         my $usercfg = cfs_read_file("user.cfg");
1685         my $modified;
1686
1687         if (my $storage = $usercfg->{acl}->{"/storage/$storeid"}) {
1688             delete $usercfg->{acl}->{"/storage/$storeid"};
1689             $modified = 1;
1690         }
1691         foreach my $pool (keys %{$usercfg->{pools}}) {
1692             delete $usercfg->{pools}->{$pool}->{storage}->{$storeid};
1693             $modified = 1;
1694         }
1695         cfs_write_file("user.cfg", $usercfg) if $modified;
1696     };
1697
1698     lock_user_config($deleteStorageAccessFn,
1699                      "access permissions cleanup for storage $storeid failed");
1700 }
1701
1702 sub add_vm_to_pool {
1703     my ($vmid, $pool) = @_;
1704
1705     my $addVMtoPoolFn = sub {
1706         my $usercfg = cfs_read_file("user.cfg");
1707         if (my $data = $usercfg->{pools}->{$pool}) {
1708             $data->{vms}->{$vmid} = 1;
1709             $usercfg->{vms}->{$vmid} = $pool;
1710             cfs_write_file("user.cfg", $usercfg);
1711         }
1712     };
1713
1714     lock_user_config($addVMtoPoolFn, "can't add VM $vmid to pool '$pool'");
1715 }
1716
1717 sub remove_vm_from_pool {
1718     my ($vmid) = @_;
1719
1720     my $delVMfromPoolFn = sub {
1721         my $usercfg = cfs_read_file("user.cfg");
1722         if (my $pool = $usercfg->{vms}->{$vmid}) {
1723             if (my $data = $usercfg->{pools}->{$pool}) {
1724                 delete $data->{vms}->{$vmid};
1725                 delete $usercfg->{vms}->{$vmid};
1726                 cfs_write_file("user.cfg", $usercfg);
1727             }
1728         }
1729     };
1730
1731     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
1732 }
1733
1734 my $USER_CONTROLLED_TFA_TYPES = {
1735     u2f => 1,
1736     oath => 1,
1737 };
1738
1739 sub assert_new_tfa_config_available() {
1740     # FIXME: Assert cluster-wide new-tfa-config support!
1741 }
1742
1743 sub user_remove_tfa : prototype($) {
1744     my ($userid) = @_;
1745
1746     assert_new_tfa_config_available();
1747
1748     my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
1749     $tfa_cfg->remove_user($userid);
1750     cfs_write_file('priv/tfa.cfg', $tfa_cfg);
1751 }
1752
1753 sub user_get_tfa : prototype($$$) {
1754     my ($username, $realm, $new_format) = @_;
1755
1756     my $user_cfg = cfs_read_file('user.cfg');
1757     my $user = $user_cfg->{users}->{$username}
1758         or die "user '$username' not found\n";
1759
1760     my $keys = $user->{keys};
1761
1762     my $domain_cfg = cfs_read_file('domains.cfg');
1763     my $realm_cfg = $domain_cfg->{ids}->{$realm};
1764     die "auth domain '$realm' does not exist\n" if !$realm_cfg;
1765
1766     my $realm_tfa = $realm_cfg->{tfa};
1767     $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa)
1768         if $realm_tfa;
1769
1770     if (!$keys) {
1771         return if !$realm_tfa;
1772         die "missing required 2nd keys\n";
1773     }
1774
1775     # new style config starts with an 'x' and optionally contains a !<type> suffix
1776     if ($keys !~ /^x(?:!.*)?$/) {
1777         # old style config, find the type via the realm
1778         return if !$realm_tfa;
1779         return ($realm_tfa->{type}, {
1780             keys => $keys,
1781             config => $realm_tfa,
1782         });
1783     } else {
1784         my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
1785         if ($new_format) {
1786             return ($tfa_cfg, $realm_tfa);
1787         } else {
1788             my $tfa = $tfa_cfg->{users}->{$username};
1789             return if !$tfa; # should not happen (user.cfg wasn't cleaned up?)
1790
1791             if ($realm_tfa) {
1792                 # if the realm has a tfa setting we need to verify the type:
1793                 die "auth domain '$realm' and user have mismatching TFA settings\n"
1794                     if $realm_tfa && $realm_tfa->{type} ne $tfa->{type};
1795             }
1796
1797             return ($tfa->{type}, $tfa->{data});
1798         }
1799     }
1800 }
1801
1802 # bash completion helpers
1803
1804 register_standard_option('userid-completed',
1805     get_standard_option('userid', { completion => \&complete_username}),
1806 );
1807
1808 sub complete_username {
1809
1810     my $user_cfg = cfs_read_file('user.cfg');
1811
1812     return [ keys %{$user_cfg->{users}} ];
1813 }
1814
1815 sub complete_group {
1816
1817     my $user_cfg = cfs_read_file('user.cfg');
1818
1819     return [ keys %{$user_cfg->{groups}} ];
1820 }
1821
1822 sub complete_realm {
1823
1824     my $domain_cfg = cfs_read_file('domains.cfg');
1825
1826     return [ keys %{$domain_cfg->{ids}} ];
1827 }
1828
1829 1;