src/PVE/AccessControl.pm

   1 package PVE::AccessControl;
   2
   3 use strict;
   4 use warnings;
   5 use Encode;
   6 use Crypt::OpenSSL::Random;
   7 use Crypt::OpenSSL::RSA;
   8 use Net::SSLeay;
   9 use Net::IP;
  10 use MIME::Base64;
  11 use Digest::SHA;
  12 use IO::File;
  13 use File::stat;
  14 use JSON;
  15
  16 use PVE::OTP;
  17 use PVE::Ticket;
  18 use PVE::Tools qw(run_command lock_file file_get_contents split_list safe_print);
  19 use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file);
  20 use PVE::JSONSchema qw(register_standard_option get_standard_option);
  21
  22 use PVE::Auth::Plugin;
  23 use PVE::Auth::AD;
  24 use PVE::Auth::LDAP;
  25 use PVE::Auth::PVE;
  26 use PVE::Auth::PAM;
  27
  28 # load and initialize all plugins
  29
  30 PVE::Auth::AD->register();
  31 PVE::Auth::LDAP->register();
  32 PVE::Auth::PVE->register();
  33 PVE::Auth::PAM->register();
  34 PVE::Auth::Plugin->init();
  35
  36 # $authdir must be writable by root only!
  37 my $confdir = "/etc/pve";
  38 my $authdir = "$confdir/priv";
  39
  40 my $pve_www_key_fn = "$confdir/pve-www.key";
  41
  42 my $pve_auth_key_files = {
  43     priv => "$authdir/authkey.key",
  44     pub =>  "$confdir/authkey.pub",
  45     pubold => "$confdir/authkey.pub.old",
  46 };
  47
  48 my $pve_auth_key_cache = {};
  49
  50 my $ticket_lifetime = 3600 * 2; # 2 hours
  51 my $auth_graceperiod = 60 * 5; # 5 minutes
  52 my $authkey_lifetime = 3600 * 24; # rotate every 24 hours
  53
  54 Crypt::OpenSSL::RSA->import_random_seed();
  55
  56 cfs_register_file('user.cfg', \&parse_user_config, \&write_user_config);
  57 cfs_register_file('priv/tfa.cfg', \&parse_priv_tfa_config, \&write_priv_tfa_config);
  58
  59 sub verify_username {
  60     PVE::Auth::Plugin::verify_username(@_);
  61 }
  62
  63 sub pve_verify_realm {
  64     PVE::Auth::Plugin::pve_verify_realm(@_);
  65 }
  66
  67 sub lock_user_config {
  68     my ($code, $errmsg) = @_;
  69
  70     cfs_lock_file("user.cfg", undef, $code);
  71     if (my $err = $@) {
  72         $errmsg ? die "$errmsg: $err" : die $err;
  73     }
  74 }
  75
  76 my $cache_read_key = sub {
  77     my ($type) = @_;
  78
  79     my $path = $pve_auth_key_files->{$type};
  80
  81     my $read_key_and_mtime = sub {
  82         my $fh = IO::File->new($path, "r");
  83
  84         return undef if !defined($fh);
  85
  86         my $st = stat($fh);
  87         my $pem = PVE::Tools::safe_read_from($fh, 0, 0, $path);
  88
  89         close $fh;
  90
  91         my $key;
  92         if ($type eq 'pub' || $type eq 'pubold') {
  93             $key = eval { Crypt::OpenSSL::RSA->new_public_key($pem); };
  94         } elsif ($type eq 'priv') {
  95             $key = eval { Crypt::OpenSSL::RSA->new_private_key($pem); };
  96         } else {
  97             die "Invalid authkey type '$type'\n";
  98         }
  99
 100         return { key => $key, mtime => $st->mtime };
 101     };
 102
 103     if (!defined($pve_auth_key_cache->{$type})) {
 104         $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 105     } else {
 106         my $st = stat($path);
 107         if (!$st || $st->mtime != $pve_auth_key_cache->{$type}->{mtime}) {
 108             $pve_auth_key_cache->{$type} = $read_key_and_mtime->();
 109         }
 110     }
 111
 112     return $pve_auth_key_cache->{$type};
 113 };
 114
 115 sub get_pubkey {
 116     my ($old) = @_;
 117
 118     my $type = $old ? 'pubold' : 'pub';
 119
 120     my $res = $cache_read_key->($type);
 121     return undef if !defined($res);
 122
 123     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 124 }
 125
 126 sub get_privkey {
 127     my $res = $cache_read_key->('priv');
 128
 129     if (!defined($res) || !check_authkey(1)) {
 130         rotate_authkey();
 131         $res = $cache_read_key->('priv');
 132     }
 133
 134     return wantarray ? ($res->{key}, $res->{mtime}) : $res->{key};
 135 }
 136
 137 sub check_authkey {
 138     my ($quiet) = @_;
 139
 140     # skip check if non-quorate, as rotation is not possible anyway
 141     return 1 if !PVE::Cluster::check_cfs_quorum(1);
 142
 143     my ($pub_key, $mtime) = get_pubkey();
 144     if (!$pub_key) {
 145         warn "auth key pair missing, generating new one..\n"  if !$quiet;
 146         return 0;
 147     } else {
 148         my $now = time();
 149         if ($now - $mtime >= $authkey_lifetime) {
 150             warn "auth key pair too old, rotating..\n" if !$quiet;;
 151             return 0;
 152         } elsif ($mtime > $now + $auth_graceperiod) {
 153             # a nodes RTC had a time set in the future during key generation -> ticket
 154             # validity is clamped to 0+5 min grace period until now >= mtime again
 155             my (undef, $old_mtime) = get_pubkey(1);
 156             if ($old_mtime && $mtime >= $old_mtime && $mtime - $old_mtime < $ticket_lifetime) {
 157                 warn "auth key pair generated in the future (key $mtime > host $now),"
 158                     ." but old key still exists and in valid grace period so avoid automatic"
 159                     ." fixup. Cluster time not in sync?\n" if !$quiet;
 160                 return 1;
 161             }
 162             warn "auth key pair generated in the future (key $mtime > host $now), rotating..\n" if !$quiet;
 163             return 0;
 164         } else {
 165             warn "auth key new enough, skipping rotation\n" if !$quiet;;
 166             return 1;
 167         }
 168     }
 169 }
 170
 171 sub rotate_authkey {
 172     return if $authkey_lifetime == 0;
 173
 174     PVE::Cluster::cfs_lock_authkey(undef, sub {
 175         # re-check with lock to avoid double rotation in clusters
 176         return if check_authkey();
 177
 178         my $old = get_pubkey();
 179         my $new = Crypt::OpenSSL::RSA->generate_key(2048);
 180
 181         if ($old) {
 182             eval {
 183                 my $pem = $old->get_public_key_x509_string();
 184                 # mtime is used for caching and ticket age range calculation
 185                 PVE::Tools::file_set_contents($pve_auth_key_files->{pubold}, $pem);
 186             };
 187             die "Failed to store old auth key: $@\n" if $@;
 188         }
 189
 190         eval {
 191             my $pem = $new->get_public_key_x509_string();
 192             # mtime is used for caching and ticket age range calculation,
 193             # should be close to that of pubold above
 194             PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 195         };
 196         if ($@) {
 197             if ($old) {
 198                 warn "Failed to store new auth key - $@\n";
 199                 warn "Reverting to previous auth key\n";
 200                 eval {
 201                     my $pem = $old->get_public_key_x509_string();
 202                     PVE::Tools::file_set_contents($pve_auth_key_files->{pub}, $pem);
 203                 };
 204                 die "Failed to restore old auth key: $@\n" if $@;
 205             } else {
 206                 die "Failed to store new auth key - $@\n";
 207             }
 208         }
 209
 210         eval {
 211             my $pem = $new->get_private_key_string();
 212             PVE::Tools::file_set_contents($pve_auth_key_files->{priv}, $pem);
 213         };
 214         if ($@) {
 215             warn "Failed to store new auth key - $@\n";
 216             warn "Deleting auth key to force regeneration\n";
 217             unlink $pve_auth_key_files->{pub};
 218             unlink $pve_auth_key_files->{priv};
 219         }
 220     });
 221     die $@ if $@;
 222 }
 223
 224 PVE::JSONSchema::register_standard_option('tokenid', {
 225     description => "API token identifier.",
 226     type => "string",
 227     format => "pve-tokenid",
 228 });
 229
 230 our $token_subid_regex = $PVE::Auth::Plugin::realm_regex;
 231
 232 # username@realm username realm tokenid
 233 our $token_full_regex = qr/((${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex}))!(${token_subid_regex})/;
 234
 235 our $userid_or_token_regex = qr/^$PVE::Auth::Plugin::user_regex\@$PVE::Auth::Plugin::realm_regex(?:!$token_subid_regex)?$/;
 236
 237 sub split_tokenid {
 238     my ($tokenid, $noerr) = @_;
 239
 240     if ($tokenid =~ /^${token_full_regex}$/) {
 241         return ($1, $4);
 242     }
 243
 244     die "'$tokenid' is not a valid token ID - not able to split into user and token parts\n" if !$noerr;
 245
 246     return undef;
 247 }
 248
 249 sub join_tokenid {
 250     my ($username, $tokensubid) = @_;
 251
 252     my $joined = "${username}!${tokensubid}";
 253
 254     return pve_verify_tokenid($joined);
 255 }
 256
 257 PVE::JSONSchema::register_format('pve-tokenid', \&pve_verify_tokenid);
 258 sub pve_verify_tokenid {
 259     my ($tokenid, $noerr) = @_;
 260
 261     if ($tokenid =~ /^${token_full_regex}$/) {
 262         return wantarray ? ($tokenid, $2, $3, $4) : $tokenid;
 263     }
 264
 265     die "value '$tokenid' does not look like a valid token ID\n" if !$noerr;
 266
 267     return undef;
 268 }
 269
 270
 271 my $csrf_prevention_secret;
 272 my $csrf_prevention_secret_legacy;
 273 my $get_csrfr_secret = sub {
 274     if (!$csrf_prevention_secret) {
 275         my $input = PVE::Tools::file_get_contents($pve_www_key_fn);
 276         $csrf_prevention_secret = Digest::SHA::hmac_sha256_base64($input);
 277         $csrf_prevention_secret_legacy = Digest::SHA::sha1_base64($input);
 278     }
 279     return $csrf_prevention_secret;
 280 };
 281
 282 sub assemble_csrf_prevention_token {
 283     my ($username) = @_;
 284
 285     my $secret =  &$get_csrfr_secret();
 286
 287     return PVE::Ticket::assemble_csrf_prevention_token ($secret, $username);
 288 }
 289
 290 sub verify_csrf_prevention_token {
 291     my ($username, $token, $noerr) = @_;
 292
 293     my $secret = $get_csrfr_secret->();
 294
 295     # FIXME: remove with PVE 7 and/or refactor all into PVE::Ticket ?
 296     if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) {
 297         my $sig = $2;
 298         if (length($sig) == 27) {
 299             # the legacy secret got populated by above get_csrfr_secret call
 300             $secret = $csrf_prevention_secret_legacy;
 301         }
 302     }
 303
 304     return PVE::Ticket::verify_csrf_prevention_token(
 305         $secret, $username, $token, -$auth_graceperiod, $ticket_lifetime, $noerr);
 306 }
 307
 308 my $get_ticket_age_range = sub {
 309     my ($now, $mtime, $rotated) = @_;
 310
 311     my $key_age = $now - $mtime;
 312     $key_age = 0 if $key_age < 0;
 313
 314     my $min = -$auth_graceperiod;
 315     my $max = $ticket_lifetime;
 316
 317     if ($rotated) {
 318         # ticket creation after rotation is not allowed
 319         $min = $key_age - $auth_graceperiod;
 320     } else {
 321         if ($key_age > $authkey_lifetime && $authkey_lifetime > 0) {
 322             if (PVE::Cluster::check_cfs_quorum(1)) {
 323                 # key should have been rotated, clamp range accordingly
 324                 $min = $key_age - $authkey_lifetime;
 325             } else {
 326                 warn "Cluster not quorate - extending auth key lifetime!\n";
 327             }
 328         }
 329
 330         $max = $key_age + $auth_graceperiod if $key_age < $ticket_lifetime;
 331     }
 332
 333     return undef if $min > $ticket_lifetime;
 334     return ($min, $max);
 335 };
 336
 337 sub assemble_ticket {
 338     my ($data) = @_;
 339
 340     my $rsa_priv = get_privkey();
 341
 342     return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PVE', $data);
 343 }
 344
 345 sub verify_ticket {
 346     my ($ticket, $noerr) = @_;
 347
 348     my $now = time();
 349
 350     my $check = sub {
 351         my ($old) = @_;
 352
 353         my ($rsa_pub, $rsa_mtime) = get_pubkey($old);
 354         return undef if !$rsa_pub;
 355
 356         my ($min, $max) = $get_ticket_age_range->($now, $rsa_mtime, $old);
 357         return undef if !defined($min);
 358
 359         return PVE::Ticket::verify_rsa_ticket(
 360             $rsa_pub, 'PVE', $ticket, undef, $min, $max, 1);
 361     };
 362
 363     my ($data, $age) = $check->();
 364
 365     # check with old, rotated key if current key failed
 366     ($data, $age) = $check->(1) if !defined($data);
 367
 368     my $auth_failure = sub {
 369         if ($noerr) {
 370             return undef;
 371         } else {
 372             # raise error via undef ticket
 373             PVE::Ticket::verify_rsa_ticket(undef, 'PVE');
 374         }
 375     };
 376
 377     if (!defined($data)) {
 378         return $auth_failure->();
 379     }
 380
 381     my ($username, $tfa_info);
 382     if ($data =~ m{^u2f!([^!]+)!([0-9a-zA-Z/.=_\-+]+)$}) {
 383         # Ticket for u2f-users:
 384         ($username, my $challenge) = ($1, $2);
 385         if ($challenge eq 'verified') {
 386             # u2f challenge was completed
 387             $challenge = undef;
 388         } elsif (!wantarray) {
 389             # The caller is not aware there could be an ongoing challenge,
 390             # so we treat this ticket as invalid:
 391             return $auth_failure->();
 392         }
 393         $tfa_info = {
 394             type => 'u2f',
 395             challenge => $challenge,
 396         };
 397     } elsif ($data =~ /^tfa!(.*)$/) {
 398         # TOTP and Yubico don't require a challenge so this is the generic
 399         # 'missing 2nd factor ticket'
 400         $username = $1;
 401         $tfa_info = { type => 'tfa' };
 402     } else {
 403         # Regular ticket (full access)
 404         $username = $data;
 405     }
 406
 407     return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
 408
 409     return wantarray ? ($username, $age, $tfa_info) : $username;
 410 }
 411
 412 sub verify_token {
 413     my ($api_token) = @_;
 414
 415     die "no API token specified\n" if !$api_token;
 416
 417     my ($tokenid, $value);
 418     if ($api_token =~ /^(.*)=(.*)$/) {
 419         $tokenid = $1;
 420         $value = $2;
 421     } else {
 422         die "no tokenid specified\n";
 423     }
 424
 425     my ($username, $token) = split_tokenid($tokenid);
 426
 427     my $usercfg = cfs_read_file('user.cfg');
 428     check_user_enabled($usercfg, $username);
 429     check_token_exist($usercfg, $username, $token);
 430
 431     my $user = $usercfg->{users}->{$username};
 432     my $token_info = $user->{tokens}->{$token};
 433
 434     my $ctime = time();
 435     die "token expired\n" if $token_info->{expire} && ($token_info->{expire} < $ctime);
 436
 437     die "invalid token value!\n" if !PVE::Cluster::verify_token($tokenid, $value);
 438
 439     return wantarray ? ($tokenid) : $tokenid;
 440 }
 441
 442
 443 # VNC tickets
 444 # - they do not contain the username in plain text
 445 # - they are restricted to a specific resource path (example: '/vms/100')
 446 sub assemble_vnc_ticket {
 447     my ($username, $path) = @_;
 448
 449     my $rsa_priv = get_privkey();
 450
 451     $path = normalize_path($path);
 452
 453     my $secret_data = "$username:$path";
 454
 455     return PVE::Ticket::assemble_rsa_ticket(
 456         $rsa_priv, 'PVEVNC', undef, $secret_data);
 457 }
 458
 459 sub verify_vnc_ticket {
 460     my ($ticket, $username, $path, $noerr) = @_;
 461
 462     my $secret_data = "$username:$path";
 463
 464     my ($rsa_pub, $rsa_mtime) = get_pubkey();
 465     if (!$rsa_pub || (time() - $rsa_mtime > $authkey_lifetime && $authkey_lifetime > 0)) {
 466         if ($noerr) {
 467             return undef;
 468         } else {
 469             # raise error via undef ticket
 470             PVE::Ticket::verify_rsa_ticket($rsa_pub, 'PVEVNC');
 471         }
 472     }
 473
 474     return PVE::Ticket::verify_rsa_ticket(
 475         $rsa_pub, 'PVEVNC', $ticket, $secret_data, -20, 40, $noerr);
 476 }
 477
 478 sub assemble_spice_ticket {
 479     my ($username, $vmid, $node) = @_;
 480
 481     my $secret = &$get_csrfr_secret();
 482
 483     return PVE::Ticket::assemble_spice_ticket(
 484         $secret, $username, $vmid, $node);
 485 }
 486
 487 sub verify_spice_connect_url {
 488     my ($connect_str) = @_;
 489
 490     my $secret = &$get_csrfr_secret();
 491
 492     return PVE::Ticket::verify_spice_connect_url($secret, $connect_str);
 493 }
 494
 495 sub read_x509_subject_spice {
 496     my ($filename) = @_;
 497
 498     # read x509 subject
 499     my $bio = Net::SSLeay::BIO_new_file($filename, 'r');
 500     die "Could not open $filename using OpenSSL\n"
 501         if !$bio;
 502
 503     my $x509 = Net::SSLeay::PEM_read_bio_X509($bio);
 504     Net::SSLeay::BIO_free($bio);
 505
 506     die "Could not parse X509 certificate in $filename\n"
 507         if !$x509;
 508
 509     my $nameobj = Net::SSLeay::X509_get_subject_name($x509);
 510     my $subject = Net::SSLeay::X509_NAME_oneline($nameobj);
 511     Net::SSLeay::X509_free($x509);
 512
 513     # remote-viewer wants comma as seperator (not '/')
 514     $subject =~ s!^/!!;
 515     $subject =~ s!/(\w+=)!,$1!g;
 516
 517     return $subject;
 518 }
 519
 520 # helper to generate SPICE remote-viewer configuration
 521 sub remote_viewer_config {
 522     my ($authuser, $vmid, $node, $proxy, $title, $port) = @_;
 523
 524     if (!$proxy) {
 525         my $host = `hostname -f` || PVE::INotify::nodename();
 526         chomp $host;
 527         $proxy = $host;
 528     }
 529
 530     my ($ticket, $proxyticket) = assemble_spice_ticket($authuser, $vmid, $node);
 531
 532     my $filename = "/etc/pve/local/pve-ssl.pem";
 533     my $subject = read_x509_subject_spice($filename);
 534
 535     my $cacert = PVE::Tools::file_get_contents("/etc/pve/pve-root-ca.pem", 8192);
 536     $cacert =~ s/\n/\\n/g;
 537
 538     $proxy = "[$proxy]" if Net::IP::ip_is_ipv6($proxy);
 539     my $config = {
 540         'secure-attention' => "Ctrl+Alt+Ins",
 541         'toggle-fullscreen' => "Shift+F11",
 542         'release-cursor' => "Ctrl+Alt+R",
 543         type => 'spice',
 544         title => $title,
 545         host => $proxyticket, # this breaks tls hostname verification, so we need to use 'host-subject'
 546         proxy => "http://$proxy:3128",
 547         'tls-port' => $port,
 548         'host-subject' => $subject,
 549         ca => $cacert,
 550         password => $ticket,
 551         'delete-this-file' => 1,
 552     };
 553
 554     return ($ticket, $proxyticket, $config);
 555 }
 556
 557 sub check_user_exist {
 558     my ($usercfg, $username, $noerr) = @_;
 559
 560     $username = PVE::Auth::Plugin::verify_username($username, $noerr);
 561     return undef if !$username;
 562
 563     return $usercfg->{users}->{$username} if $usercfg && $usercfg->{users}->{$username};
 564
 565     die "no such user ('$username')\n" if !$noerr;
 566
 567     return undef;
 568 }
 569
 570 sub check_user_enabled {
 571     my ($usercfg, $username, $noerr) = @_;
 572
 573     my $data = check_user_exist($usercfg, $username, $noerr);
 574     return undef if !$data;
 575
 576     return 1 if $data->{enable};
 577
 578     die "user '$username' is disabled\n" if !$noerr;
 579
 580     my $ctime = time();
 581     my $expire = $usercfg->{users}->{$username}->{expire};
 582
 583     die "account expired\n" if $expire && ($expire < $ctime);
 584
 585     return undef;
 586 }
 587
 588 sub check_token_exist {
 589     my ($usercfg, $username, $tokenid, $noerr) = @_;
 590
 591     my $user = check_user_exist($usercfg, $username, $noerr);
 592     return undef if !$user;
 593
 594     return $user->{tokens}->{$tokenid}
 595         if defined($user->{tokens}) && $user->{tokens}->{$tokenid};
 596
 597     die "no such token '$tokenid' for user '$username'\n" if !$noerr;
 598
 599     return undef;
 600 }
 601
 602 sub verify_one_time_pw {
 603     my ($type, $username, $keys, $tfa_cfg, $otp) = @_;
 604
 605     die "missing one time password for two-factor authentication '$type'\n" if !$otp;
 606
 607     # fixme: proxy support?
 608     my $proxy;
 609
 610     if ($type eq 'yubico') {
 611         PVE::OTP::yubico_verify_otp($otp, $keys, $tfa_cfg->{url},
 612                                     $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
 613     } elsif ($type eq 'oath') {
 614         PVE::OTP::oath_verify_otp($otp, $keys, $tfa_cfg->{step}, $tfa_cfg->{digits});
 615     } else {
 616         die "unknown tfa type '$type'\n";
 617     }
 618 }
 619
 620 # password should be utf8 encoded
 621 # Note: some plugins delay/sleep if auth fails
 622 sub authenticate_user {
 623     my ($username, $password, $otp) = @_;
 624
 625     die "no username specified\n" if !$username;
 626
 627     my ($ruid, $realm);
 628
 629     ($username, $ruid, $realm) = PVE::Auth::Plugin::verify_username($username);
 630
 631     my $usercfg = cfs_read_file('user.cfg');
 632
 633     check_user_enabled($usercfg, $username);
 634
 635     my $domain_cfg = cfs_read_file('domains.cfg');
 636
 637     my $cfg = $domain_cfg->{ids}->{$realm};
 638     die "auth domain '$realm' does not exist\n" if !$cfg;
 639     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 640     $plugin->authenticate_user($cfg, $realm, $ruid, $password);
 641
 642     my ($type, $tfa_data) = user_get_tfa($username, $realm);
 643     if ($type) {
 644         if ($type eq 'u2f') {
 645             # Note that if the user did not manage to complete the initial u2f registration
 646             # challenge we have a hash containing a 'challenge' entry in the user's tfa.cfg entry:
 647             $tfa_data = undef if exists $tfa_data->{challenge};
 648         } elsif (!defined($otp)) {
 649             # The user requires a 2nd factor but has not provided one. Return success but
 650             # don't clear $tfa_data.
 651         } else {
 652             my $keys = $tfa_data->{keys};
 653             my $tfa_cfg = $tfa_data->{config};
 654             verify_one_time_pw($type, $username, $keys, $tfa_cfg, $otp);
 655             $tfa_data = undef;
 656         }
 657
 658         # Return the type along with the rest:
 659         if ($tfa_data) {
 660             $tfa_data = {
 661                 type => $type,
 662                 data => $tfa_data,
 663             };
 664         }
 665     }
 666
 667     return wantarray ? ($username, $tfa_data) : $username;
 668 }
 669
 670 sub domain_set_password {
 671     my ($realm, $username, $password) = @_;
 672
 673     die "no auth domain specified" if !$realm;
 674
 675     my $domain_cfg = cfs_read_file('domains.cfg');
 676
 677     my $cfg = $domain_cfg->{ids}->{$realm};
 678     die "auth domain '$realm' does not exist\n" if !$cfg;
 679     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 680     $plugin->store_password($cfg, $realm, $username, $password);
 681 }
 682
 683 sub add_user_group {
 684     my ($username, $usercfg, $group) = @_;
 685
 686     $usercfg->{users}->{$username}->{groups}->{$group} = 1;
 687     $usercfg->{groups}->{$group}->{users}->{$username} = 1;
 688 }
 689
 690 sub delete_user_group {
 691     my ($username, $usercfg) = @_;
 692
 693     foreach my $group (keys %{$usercfg->{groups}}) {
 694
 695         delete ($usercfg->{groups}->{$group}->{users}->{$username})
 696             if $usercfg->{groups}->{$group}->{users}->{$username};
 697     }
 698 }
 699
 700 sub delete_user_acl {
 701     my ($username, $usercfg) = @_;
 702
 703     foreach my $acl (keys %{$usercfg->{acl}}) {
 704
 705         delete ($usercfg->{acl}->{$acl}->{users}->{$username})
 706             if $usercfg->{acl}->{$acl}->{users}->{$username};
 707     }
 708 }
 709
 710 sub delete_group_acl {
 711     my ($group, $usercfg) = @_;
 712
 713     foreach my $acl (keys %{$usercfg->{acl}}) {
 714
 715         delete ($usercfg->{acl}->{$acl}->{groups}->{$group})
 716             if $usercfg->{acl}->{$acl}->{groups}->{$group};
 717     }
 718 }
 719
 720 sub delete_pool_acl {
 721     my ($pool, $usercfg) = @_;
 722
 723     my $path = "/pool/$pool";
 724
 725     delete ($usercfg->{acl}->{$path})
 726 }
 727
 728 # we automatically create some predefined roles by splitting privs
 729 # into 3 groups (per category)
 730 # root: only root is allowed to do that
 731 # admin: an administrator can to that
 732 # user: a normal user/customer can to that
 733 my $privgroups = {
 734     VM => {
 735         root => [],
 736         admin => [
 737             'VM.Config.Disk',
 738             'VM.Config.CPU',
 739             'VM.Config.Memory',
 740             'VM.Config.Network',
 741             'VM.Config.HWType',
 742             'VM.Config.Options', # covers all other things
 743             'VM.Allocate',
 744             'VM.Clone',
 745             'VM.Migrate',
 746             'VM.Monitor',
 747             'VM.Snapshot',
 748             'VM.Snapshot.Rollback',
 749         ],
 750         user => [
 751             'VM.Config.CDROM', # change CDROM media
 752             'VM.Config.Cloudinit',
 753             'VM.Console',
 754             'VM.Backup',
 755             'VM.PowerMgmt',
 756         ],
 757         audit => [
 758             'VM.Audit',
 759         ],
 760     },
 761     Sys => {
 762         root => [
 763             'Sys.PowerMgmt',
 764             'Sys.Modify', # edit/change node settings
 765         ],
 766         admin => [
 767             'Permissions.Modify',
 768             'Sys.Console',
 769             'Sys.Syslog',
 770         ],
 771         user => [],
 772         audit => [
 773             'Sys.Audit',
 774         ],
 775     },
 776     Datastore => {
 777         root => [],
 778         admin => [
 779             'Datastore.Allocate',
 780             'Datastore.AllocateTemplate',
 781         ],
 782         user => [
 783             'Datastore.AllocateSpace',
 784         ],
 785         audit => [
 786             'Datastore.Audit',
 787         ],
 788     },
 789     SDN => {
 790         root => [],
 791         admin => [
 792             'SDN.Allocate',
 793             'SDN.Audit',
 794         ],
 795         audit => [
 796             'SDN.Audit',
 797         ],
 798     },
 799     User => {
 800         root => [
 801             'Realm.Allocate',
 802         ],
 803         admin => [
 804             'User.Modify',
 805             'Group.Allocate', # edit/change group settings
 806             'Realm.AllocateUser',
 807         ],
 808         user => [],
 809         audit => [],
 810     },
 811     Pool => {
 812         root => [],
 813         admin => [
 814             'Pool.Allocate', # create/delete pools
 815         ],
 816         user => [
 817             'Pool.Audit',
 818         ],
 819         audit => [
 820             'Pool.Audit',
 821         ],
 822     },
 823 };
 824
 825 my $valid_privs = {};
 826
 827 my $special_roles = {
 828     'NoAccess' => {}, # no privileges
 829     'Administrator' => $valid_privs, # all privileges
 830 };
 831
 832 sub create_roles {
 833
 834     foreach my $cat (keys %$privgroups) {
 835         my $cd = $privgroups->{$cat};
 836         foreach my $p (@{$cd->{root}}, @{$cd->{admin}},
 837                        @{$cd->{user}}, @{$cd->{audit}}) {
 838             $valid_privs->{$p} = 1;
 839         }
 840         foreach my $p (@{$cd->{admin}}, @{$cd->{user}}, @{$cd->{audit}}) {
 841
 842             $special_roles->{"PVE${cat}Admin"}->{$p} = 1;
 843             $special_roles->{"PVEAdmin"}->{$p} = 1;
 844         }
 845         if (scalar(@{$cd->{user}})) {
 846             foreach my $p (@{$cd->{user}}, @{$cd->{audit}}) {
 847                 $special_roles->{"PVE${cat}User"}->{$p} = 1;
 848             }
 849         }
 850         foreach my $p (@{$cd->{audit}}) {
 851             $special_roles->{"PVEAuditor"}->{$p} = 1;
 852         }
 853     }
 854
 855     $special_roles->{"PVETemplateUser"} = { 'VM.Clone' => 1, 'VM.Audit' => 1 };
 856 };
 857
 858 create_roles();
 859
 860 sub create_priv_properties {
 861     my $properties = {};
 862     foreach my $priv (keys %$valid_privs) {
 863         $properties->{$priv} = {
 864             type => 'boolean',
 865             optional => 1,
 866         };
 867     }
 868     return $properties;
 869 }
 870
 871 sub role_is_special {
 872     my ($role) = @_;
 873     return (exists $special_roles->{$role}) ? 1 : 0;
 874 }
 875
 876 sub add_role_privs {
 877     my ($role, $usercfg, $privs) = @_;
 878
 879     return if !$privs;
 880
 881     die "role '$role' does not exist\n" if !$usercfg->{roles}->{$role};
 882
 883     foreach my $priv (split_list($privs)) {
 884         if (defined ($valid_privs->{$priv})) {
 885             $usercfg->{roles}->{$role}->{$priv} = 1;
 886         } else {
 887             die "invalid privilege '$priv'\n";
 888         }
 889     }
 890 }
 891
 892 sub lookup_username {
 893     my ($username, $noerr) = @_;
 894
 895     $username =~ m!^(${PVE::Auth::Plugin::user_regex})\@(${PVE::Auth::Plugin::realm_regex})$!;
 896
 897     my $realm = $2;
 898     my $domain_cfg = cfs_read_file("domains.cfg");
 899     my $casesensitive = $domain_cfg->{ids}->{$realm}->{'case-sensitive'} // 1;
 900     my $usercfg = cfs_read_file('user.cfg');
 901
 902     if (!$casesensitive) {
 903         my @matches = grep { lc $username eq lc $_ } (keys %{$usercfg->{users}});
 904
 905         die "ambiguous case insensitive match of username '$username', cannot safely grant access!\n"
 906             if scalar @matches > 1 && !$noerr;
 907
 908         return $matches[0]
 909     }
 910
 911     return $username;
 912 }
 913
 914 sub normalize_path {
 915     my $path = shift;
 916
 917     $path =~ s|/+|/|g;
 918
 919     $path =~ s|/$||;
 920
 921     $path = '/' if !$path;
 922
 923     $path = "/$path" if $path !~ m|^/|;
 924
 925     return undef if $path !~ m|^[[:alnum:]\.\-\_\/]+$|;
 926
 927     return $path;
 928 }
 929
 930 sub check_path {
 931     my ($path) = @_;
 932     return $path =~ m!^(
 933         /
 934         |/access
 935         |/access/groups
 936         |/access/groups/[[:alnum:]\.\-\_]+
 937         |/access/realm
 938         |/access/realm/[[:alnum:]\.\-\_]+
 939         |/nodes
 940         |/nodes/[[:alnum:]\.\-\_]+
 941         |/pool
 942         |/pool/[[:alnum:]\.\-\_]+
 943         |/sdn
 944         |/sdn/zones/[[:alnum:]\.\-\_]+
 945         |/storage
 946         |/storage/[[:alnum:]\.\-\_]+
 947         |/vms
 948         |/vms/[1-9][0-9]{2,}
 949     )$!xs;
 950 }
 951
 952 PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
 953 sub verify_groupname {
 954     my ($groupname, $noerr) = @_;
 955
 956     if ($groupname !~ m/^[A-Za-z0-9\.\-_]+$/) {
 957
 958         die "group name '$groupname' contains invalid characters\n" if !$noerr;
 959
 960         return undef;
 961     }
 962
 963     return $groupname;
 964 }
 965
 966 PVE::JSONSchema::register_format('pve-roleid', \&verify_rolename);
 967 sub verify_rolename {
 968     my ($rolename, $noerr) = @_;
 969
 970     if ($rolename !~ m/^[A-Za-z0-9\.\-_]+$/) {
 971
 972         die "role name '$rolename' contains invalid characters\n" if !$noerr;
 973
 974         return undef;
 975     }
 976
 977     return $rolename;
 978 }
 979
 980 PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname);
 981 sub verify_poolname {
 982     my ($poolname, $noerr) = @_;
 983
 984     if ($poolname !~ m/^[A-Za-z0-9\.\-_]+$/) {
 985
 986         die "pool name '$poolname' contains invalid characters\n" if !$noerr;
 987
 988         return undef;
 989     }
 990
 991     return $poolname;
 992 }
 993
 994 PVE::JSONSchema::register_format('pve-priv', \&verify_privname);
 995 sub verify_privname {
 996     my ($priv, $noerr) = @_;
 997
 998     if (!$valid_privs->{$priv}) {
 999         die "invalid privilege '$priv'\n" if !$noerr;
1000
1001         return undef;
1002     }
1003
1004     return $priv;
1005 }
1006
1007 sub userconfig_force_defaults {
1008     my ($cfg) = @_;
1009
1010     foreach my $r (keys %$special_roles) {
1011         $cfg->{roles}->{$r} = $special_roles->{$r};
1012     }
1013
1014     # add root user if not exists
1015     if (!$cfg->{users}->{'root@pam'}) {
1016         $cfg->{users}->{'root@pam'}->{enable} = 1;
1017     }
1018 }
1019
1020 sub parse_user_config {
1021     my ($filename, $raw) = @_;
1022
1023     my $cfg = {};
1024
1025     userconfig_force_defaults($cfg);
1026
1027     $raw = '' if !defined($raw);
1028     while ($raw =~ /^\s*(.+?)\s*$/gm) {
1029         my $line = $1;
1030         my @data;
1031
1032         foreach my $d (split (/:/, $line)) {
1033             $d =~ s/^\s+//;
1034             $d =~ s/\s+$//;
1035             push @data, $d
1036         }
1037
1038         my $et = shift @data;
1039
1040         if ($et eq 'user') {
1041             my ($user, $enable, $expire, $firstname, $lastname, $email, $comment, $keys) = @data;
1042
1043             my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1044             if (!$realm) {
1045                 warn "user config - ignore user '$user' - invalid user name\n";
1046                 next;
1047             }
1048
1049             $enable = $enable ? 1 : 0;
1050
1051             $expire = 0 if !$expire;
1052
1053             if ($expire !~ m/^\d+$/) {
1054                 warn "user config - ignore user '$user' - (illegal characters in expire '$expire')\n";
1055                 next;
1056             }
1057             $expire = int($expire);
1058
1059             #if (!verify_groupname ($group, 1)) {
1060             #    warn "user config - ignore user '$user' - invalid characters in group name\n";
1061             #    next;
1062             #}
1063
1064             $cfg->{users}->{$user} = {
1065                 enable => $enable,
1066                 # group => $group,
1067             };
1068             $cfg->{users}->{$user}->{firstname} = PVE::Tools::decode_text($firstname) if $firstname;
1069             $cfg->{users}->{$user}->{lastname} = PVE::Tools::decode_text($lastname) if $lastname;
1070             $cfg->{users}->{$user}->{email} = $email;
1071             $cfg->{users}->{$user}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1072             $cfg->{users}->{$user}->{expire} = $expire;
1073             # keys: allowed yubico key ids or oath secrets (base32 encoded)
1074             $cfg->{users}->{$user}->{keys} = $keys if $keys;
1075
1076             #$cfg->{users}->{$user}->{groups}->{$group} = 1;
1077             #$cfg->{groups}->{$group}->{$user} = 1;
1078
1079         } elsif ($et eq 'group') {
1080             my ($group, $userlist, $comment) = @data;
1081
1082             if (!verify_groupname($group, 1)) {
1083                 warn "user config - ignore group '$group' - invalid characters in group name\n";
1084                 next;
1085             }
1086
1087             # make sure to add the group (even if there are no members)
1088             $cfg->{groups}->{$group} = { users => {} } if !$cfg->{groups}->{$group};
1089
1090             $cfg->{groups}->{$group}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1091
1092             foreach my $user (split_list($userlist)) {
1093
1094                 if (!PVE::Auth::Plugin::verify_username($user, 1)) {
1095                     warn "user config - ignore invalid group member '$user'\n";
1096                     next;
1097                 }
1098
1099                 if ($cfg->{users}->{$user}) { # user exists
1100                     $cfg->{users}->{$user}->{groups}->{$group} = 1;
1101                 } else {
1102                     warn "user config - ignore invalid group member '$user'\n";
1103                 }
1104                 $cfg->{groups}->{$group}->{users}->{$user} = 1;
1105             }
1106
1107         } elsif ($et eq 'role') {
1108             my ($role, $privlist) = @data;
1109
1110             if (!verify_rolename($role, 1)) {
1111                 warn "user config - ignore role '$role' - invalid characters in role name\n";
1112                 next;
1113             }
1114
1115             # make sure to add the role (even if there are no privileges)
1116             $cfg->{roles}->{$role} = {} if !$cfg->{roles}->{$role};
1117
1118             foreach my $priv (split_list($privlist)) {
1119                 if (defined ($valid_privs->{$priv})) {
1120                     $cfg->{roles}->{$role}->{$priv} = 1;
1121                 } else {
1122                     warn "user config - ignore invalid privilege '$priv'\n";
1123                 }
1124             }
1125
1126         } elsif ($et eq 'acl') {
1127             my ($propagate, $pathtxt, $uglist, $rolelist) = @data;
1128
1129             $propagate = $propagate ? 1 : 0;
1130
1131             if (my $path = normalize_path($pathtxt)) {
1132                 foreach my $role (split_list($rolelist)) {
1133
1134                     if (!verify_rolename($role, 1)) {
1135                         warn "user config - ignore invalid role name '$role' in acl\n";
1136                         next;
1137                     }
1138
1139                     if (!$cfg->{roles}->{$role}) {
1140                         warn "user config - ignore invalid acl role '$role'\n";
1141                         next;
1142                     }
1143
1144                     foreach my $ug (split_list($uglist)) {
1145                         my ($group) = $ug =~ m/^@(\S+)$/;
1146
1147                         if ($group && verify_groupname($group, 1)) {
1148                             if (!$cfg->{groups}->{$group}) { # group does not exist
1149                                 warn "user config - ignore invalid acl group '$group'\n";
1150                             }
1151                             $cfg->{acl}->{$path}->{groups}->{$group}->{$role} = $propagate;
1152                         } elsif (PVE::Auth::Plugin::verify_username($ug, 1)) {
1153                             if (!$cfg->{users}->{$ug}) { # user does not exist
1154                                 warn "user config - ignore invalid acl member '$ug'\n";
1155                             }
1156                             $cfg->{acl}->{$path}->{users}->{$ug}->{$role} = $propagate;
1157                         } elsif (my ($user, $token) = split_tokenid($ug, 1)) {
1158                             if (check_token_exist($cfg, $user, $token, 1)) {
1159                                 $cfg->{acl}->{$path}->{tokens}->{$ug}->{$role} = $propagate;
1160                             } else {
1161                                 warn "user config - ignore invalid acl token '$ug'\n";
1162                             }
1163                         } else {
1164                             warn "user config - invalid user/group '$ug' in acl\n";
1165                         }
1166                     }
1167                 }
1168             } else {
1169                 warn "user config - ignore invalid path in acl '$pathtxt'\n";
1170             }
1171         } elsif ($et eq 'pool') {
1172             my ($pool, $comment, $vmlist, $storelist) = @data;
1173
1174             if (!verify_poolname($pool, 1)) {
1175                 warn "user config - ignore pool '$pool' - invalid characters in pool name\n";
1176                 next;
1177             }
1178
1179             # make sure to add the pool (even if there are no members)
1180             $cfg->{pools}->{$pool} = { vms => {}, storage => {} } if !$cfg->{pools}->{$pool};
1181
1182             $cfg->{pools}->{$pool}->{comment} = PVE::Tools::decode_text($comment) if $comment;
1183
1184             foreach my $vmid (split_list($vmlist)) {
1185                 if ($vmid !~ m/^\d+$/) {
1186                     warn "user config - ignore invalid vmid '$vmid' in pool '$pool'\n";
1187                     next;
1188                 }
1189                 $vmid = int($vmid);
1190
1191                 if ($cfg->{vms}->{$vmid}) {
1192                     warn "user config - ignore duplicate vmid '$vmid' in pool '$pool'\n";
1193                     next;
1194                 }
1195
1196                 $cfg->{pools}->{$pool}->{vms}->{$vmid} = 1;
1197
1198                 # record vmid ==> pool relation
1199                 $cfg->{vms}->{$vmid} = $pool;
1200             }
1201
1202             foreach my $storeid (split_list($storelist)) {
1203                 if ($storeid !~ m/^[a-z][a-z0-9\-\_\.]*[a-z0-9]$/i) {
1204                     warn "user config - ignore invalid storage '$storeid' in pool '$pool'\n";
1205                     next;
1206                 }
1207                 $cfg->{pools}->{$pool}->{storage}->{$storeid} = 1;
1208             }
1209         } elsif ($et eq 'token') {
1210             my ($tokenid, $expire, $privsep, $comment) = @data;
1211
1212             my ($user, $token) = split_tokenid($tokenid, 1);
1213             if (!($user && $token)) {
1214                 warn "user config - ignore invalid tokenid '$tokenid'\n";
1215                 next;
1216             }
1217
1218             $privsep = $privsep ? 1 : 0;
1219
1220             $expire = 0 if !$expire;
1221
1222             if ($expire !~ m/^\d+$/) {
1223                 warn "user config - ignore token '$tokenid' - (illegal characters in expire '$expire')\n";
1224                 next;
1225             }
1226             $expire = int($expire);
1227
1228             if (my $user_cfg = $cfg->{users}->{$user}) { # user exists
1229                 $user_cfg->{tokens}->{$token} = {} if !$user_cfg->{tokens}->{$token};
1230                 my $token_cfg = $user_cfg->{tokens}->{$token};
1231                 $token_cfg->{privsep} = $privsep;
1232                 $token_cfg->{expire} = $expire;
1233                 $token_cfg->{comment} = PVE::Tools::decode_text($comment) if $comment;
1234             } else {
1235                 warn "user config - ignore token '$tokenid' - user does not exist\n";
1236             }
1237         } else {
1238             warn "user config - ignore config line: $line\n";
1239         }
1240     }
1241
1242     userconfig_force_defaults($cfg);
1243
1244     return $cfg;
1245 }
1246
1247 sub write_user_config {
1248     my ($filename, $cfg) = @_;
1249
1250     my $data = '';
1251
1252     foreach my $user (sort keys %{$cfg->{users}}) {
1253         my $d = $cfg->{users}->{$user};
1254         my $firstname = $d->{firstname} ? PVE::Tools::encode_text($d->{firstname}) : '';
1255         my $lastname = $d->{lastname} ? PVE::Tools::encode_text($d->{lastname}) : '';
1256         my $email = $d->{email} || '';
1257         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1258         my $expire = int($d->{expire} || 0);
1259         my $enable = $d->{enable} ? 1 : 0;
1260         my $keys = $d->{keys} ? $d->{keys} : '';
1261         $data .= "user:$user:$enable:$expire:$firstname:$lastname:$email:$comment:$keys:\n";
1262
1263         my $user_tokens = $d->{tokens};
1264         foreach my $token (sort keys %$user_tokens) {
1265             my $td = $user_tokens->{$token};
1266             my $full_tokenid = join_tokenid($user, $token);
1267             my $comment = $td->{comment} ? PVE::Tools::encode_text($td->{comment}) : '';
1268             my $expire = int($td->{expire} || 0);
1269             my $privsep = $td->{privsep} ? 1 : 0;
1270             $data .= "token:$full_tokenid:$expire:$privsep:$comment:\n";
1271         }
1272     }
1273
1274     $data .= "\n";
1275
1276     foreach my $group (sort keys %{$cfg->{groups}}) {
1277         my $d = $cfg->{groups}->{$group};
1278         my $list = join (',', sort keys %{$d->{users}});
1279         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1280         $data .= "group:$group:$list:$comment:\n";
1281     }
1282
1283     $data .= "\n";
1284
1285     foreach my $pool (sort keys %{$cfg->{pools}}) {
1286         my $d = $cfg->{pools}->{$pool};
1287         my $vmlist = join (',', sort keys %{$d->{vms}});
1288         my $storelist = join (',', sort keys %{$d->{storage}});
1289         my $comment = $d->{comment} ? PVE::Tools::encode_text($d->{comment}) : '';
1290         $data .= "pool:$pool:$comment:$vmlist:$storelist:\n";
1291     }
1292
1293     $data .= "\n";
1294
1295     foreach my $role (sort keys %{$cfg->{roles}}) {
1296         next if $special_roles->{$role};
1297
1298         my $d = $cfg->{roles}->{$role};
1299         my $list = join (',', sort keys %$d);
1300         $data .= "role:$role:$list:\n";
1301     }
1302
1303     $data .= "\n";
1304
1305     my $collect_rolelist_members = sub {
1306         my ($acl_members, $result, $prefix, $exclude) = @_;
1307
1308         foreach my $member (keys %$acl_members) {
1309             next if $exclude && $member eq $exclude;
1310
1311             my $l0 = '';
1312             my $l1 = '';
1313             foreach my $role (sort keys %{$acl_members->{$member}}) {
1314                 my $propagate = $acl_members->{$member}->{$role};
1315                 if ($propagate) {
1316                     $l1 .= ',' if $l1;
1317                     $l1 .= $role;
1318                 } else {
1319                     $l0 .= ',' if $l0;
1320                     $l0 .= $role;
1321                 }
1322             }
1323             $result->{0}->{$l0}->{"${prefix}${member}"} = 1 if $l0;
1324             $result->{1}->{$l1}->{"${prefix}${member}"} = 1 if $l1;
1325         }
1326     };
1327
1328     foreach my $path (sort keys %{$cfg->{acl}}) {
1329         my $d = $cfg->{acl}->{$path};
1330
1331         my $rolelist_members = {};
1332
1333         $collect_rolelist_members->($d->{'groups'}, $rolelist_members, '@');
1334
1335         # no need to save 'root@pam', it is always 'Administrator'
1336         $collect_rolelist_members->($d->{'users'}, $rolelist_members, '', 'root@pam');
1337
1338         $collect_rolelist_members->($d->{'tokens'}, $rolelist_members, '');
1339
1340         foreach my $propagate (0,1) {
1341             my $filtered = $rolelist_members->{$propagate};
1342             foreach my $rolelist (sort keys %$filtered) {
1343                 my $uglist = join (',', sort keys %{$filtered->{$rolelist}});
1344                 $data .= "acl:$propagate:$path:$uglist:$rolelist:\n";
1345             }
1346
1347         }
1348     }
1349
1350     return $data;
1351 }
1352
1353 # The TFA configuration in priv/tfa.cfg format contains one line per user of
1354 # the form:
1355 #     USER:TYPE:DATA
1356 # DATA is a base64 encoded json string and its format depends on the type.
1357 sub parse_priv_tfa_config {
1358     my ($filename, $raw) = @_;
1359
1360     my $users = {};
1361     my $cfg = { users => $users };
1362
1363     $raw = '' if !defined($raw);
1364     while ($raw =~ /^\s*(.+?)\s*$/gm) {
1365         my $line = $1;
1366         my ($user, $type, $data) = split(/:/, $line, 3);
1367
1368         my (undef, undef, $realm) = PVE::Auth::Plugin::verify_username($user, 1);
1369         if (!$realm) {
1370             warn "user tfa config - ignore user '$user' - invalid user name\n";
1371             next;
1372         }
1373
1374         $data = decode_json(decode_base64($data));
1375
1376         $users->{$user} = {
1377             type => $type,
1378             data => $data,
1379         };
1380     }
1381
1382     return $cfg;
1383 }
1384
1385 sub write_priv_tfa_config {
1386     my ($filename, $cfg) = @_;
1387
1388     my $output = '';
1389
1390     my $users = $cfg->{users};
1391     foreach my $user (sort keys %$users) {
1392         my $info = $users->{$user};
1393         next if !%$info; # skip empty entries
1394
1395         $info = {%$info}; # copy to verify contents:
1396
1397         my $type = delete $info->{type};
1398         my $data = delete $info->{data};
1399
1400         if (my @keys = keys %$info) {
1401             die "invalid keys in TFA config for user $user: " . join(', ', @keys) . "\n";
1402         }
1403
1404         $data = encode_base64(encode_json($data), '');
1405         $output .= "${user}:${type}:${data}\n";
1406     }
1407
1408     return $output;
1409 }
1410
1411 sub roles {
1412     my ($cfg, $user, $path) = @_;
1413
1414     # NOTE: we do not consider pools here.
1415     # NOTE: for privsep tokens, this does not filter roles by those that the
1416     # corresponding user has.
1417     # Use $rpcenv->permission() for any actual permission checks!
1418
1419     return 'Administrator' if $user eq 'root@pam'; # root can do anything
1420
1421     if (pve_verify_tokenid($user, 1)) {
1422         my $tokenid = $user;
1423         my ($username, $token) = split_tokenid($tokenid);
1424
1425         my $token_info = $cfg->{users}->{$username}->{tokens}->{$token};
1426         return () if !$token_info;
1427
1428         my $user_roles = roles($cfg, $username, $path);
1429
1430         # return full user privileges
1431         return $user_roles if !$token_info->{privsep};
1432     }
1433
1434     my $roles = {};
1435
1436     foreach my $p (sort keys %{$cfg->{acl}}) {
1437         my $final = ($path eq $p);
1438
1439         next if !(($p eq '/') || $final || ($path =~ m|^$p/|));
1440
1441         my $acl = $cfg->{acl}->{$p};
1442
1443         #print "CHECKACL $path $p\n";
1444         #print "ACL $path = " . Dumper ($acl);
1445         if (my $ri = $acl->{tokens}->{$user}) {
1446             my $new;
1447             foreach my $role (keys %$ri) {
1448                 my $propagate = $ri->{$role};
1449                 if ($final || $propagate) {
1450                     #print "APPLY ROLE $p $user $role\n";
1451                     $new = {} if !$new;
1452                     $new->{$role} = $propagate;
1453                 }
1454             }
1455             if ($new) {
1456                 $roles = $new; # overwrite previous settings
1457                 next;
1458             }
1459         }
1460
1461         if (my $ri = $acl->{users}->{$user}) {
1462             my $new;
1463             foreach my $role (keys %$ri) {
1464                 my $propagate = $ri->{$role};
1465                 if ($final || $propagate) {
1466                     #print "APPLY ROLE $p $user $role\n";
1467                     $new = {} if !$new;
1468                     $new->{$role} = $propagate;
1469                 }
1470             }
1471             if ($new) {
1472                 $roles = $new; # overwrite previous settings
1473                 next; # user privs always override group privs
1474             }
1475         }
1476
1477         my $new;
1478         foreach my $g (keys %{$acl->{groups}}) {
1479             next if !$cfg->{groups}->{$g}->{users}->{$user};
1480             if (my $ri = $acl->{groups}->{$g}) {
1481                 foreach my $role (keys %$ri) {
1482                     my $propagate = $ri->{$role};
1483                     if ($final || $propagate) {
1484                         #print "APPLY ROLE $p \@$g $role\n";
1485                         $new = {} if !$new;
1486                         $new->{$role} = $propagate;
1487                     }
1488                 }
1489             }
1490         }
1491         if ($new) {
1492             $roles = $new; # overwrite previous settings
1493             next;
1494         }
1495     }
1496
1497     return { 'NoAccess' => $roles->{NoAccess} } if defined ($roles->{NoAccess});
1498     #return () if defined ($roles->{NoAccess});
1499
1500     #print "permission $user $path = " . Dumper ($roles);
1501
1502     #print "roles $user $path = " . join (',', @ra) . "\n";
1503
1504     return $roles;
1505 }
1506
1507 sub remove_vm_access {
1508     my ($vmid) = @_;
1509     my $delVMaccessFn = sub {
1510         my $usercfg = cfs_read_file("user.cfg");
1511         my $modified;
1512
1513         if (my $acl = $usercfg->{acl}->{"/vms/$vmid"}) {
1514             delete $usercfg->{acl}->{"/vms/$vmid"};
1515             $modified = 1;
1516         }
1517         if (my $pool = $usercfg->{vms}->{$vmid}) {
1518             if (my $data = $usercfg->{pools}->{$pool}) {
1519                 delete $data->{vms}->{$vmid};
1520                 delete $usercfg->{vms}->{$vmid};
1521                 $modified = 1;
1522             }
1523         }
1524         cfs_write_file("user.cfg", $usercfg) if $modified;
1525     };
1526
1527     lock_user_config($delVMaccessFn, "access permissions cleanup for VM $vmid failed");
1528 }
1529
1530 sub remove_storage_access {
1531     my ($storeid) = @_;
1532
1533     my $deleteStorageAccessFn = sub {
1534         my $usercfg = cfs_read_file("user.cfg");
1535         my $modified;
1536
1537         if (my $storage = $usercfg->{acl}->{"/storage/$storeid"}) {
1538             delete $usercfg->{acl}->{"/storage/$storeid"};
1539             $modified = 1;
1540         }
1541         foreach my $pool (keys %{$usercfg->{pools}}) {
1542             delete $usercfg->{pools}->{$pool}->{storage}->{$storeid};
1543             $modified = 1;
1544         }
1545         cfs_write_file("user.cfg", $usercfg) if $modified;
1546     };
1547
1548     lock_user_config($deleteStorageAccessFn,
1549                      "access permissions cleanup for storage $storeid failed");
1550 }
1551
1552 sub add_vm_to_pool {
1553     my ($vmid, $pool) = @_;
1554
1555     my $addVMtoPoolFn = sub {
1556         my $usercfg = cfs_read_file("user.cfg");
1557         if (my $data = $usercfg->{pools}->{$pool}) {
1558             $data->{vms}->{$vmid} = 1;
1559             $usercfg->{vms}->{$vmid} = $pool;
1560             cfs_write_file("user.cfg", $usercfg);
1561         }
1562     };
1563
1564     lock_user_config($addVMtoPoolFn, "can't add VM $vmid to pool '$pool'");
1565 }
1566
1567 sub remove_vm_from_pool {
1568     my ($vmid) = @_;
1569
1570     my $delVMfromPoolFn = sub {
1571         my $usercfg = cfs_read_file("user.cfg");
1572         if (my $pool = $usercfg->{vms}->{$vmid}) {
1573             if (my $data = $usercfg->{pools}->{$pool}) {
1574                 delete $data->{vms}->{$vmid};
1575                 delete $usercfg->{vms}->{$vmid};
1576                 cfs_write_file("user.cfg", $usercfg);
1577             }
1578         }
1579     };
1580
1581     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
1582 }
1583
1584 my $USER_CONTROLLED_TFA_TYPES = {
1585     u2f => 1,
1586     oath => 1,
1587 };
1588
1589 # Delete an entry by setting $data=undef in which case $type is ignored.
1590 # Otherwise both must be valid.
1591 sub user_set_tfa {
1592     my ($userid, $realm, $type, $data, $cached_usercfg, $cached_domaincfg) = @_;
1593
1594     if (defined($data) && !defined($type)) {
1595         # This is an internal usage error and should not happen
1596         die "cannot set tfa data without a type\n";
1597     }
1598
1599     my $user_cfg = $cached_usercfg || cfs_read_file('user.cfg');
1600     my $user = $user_cfg->{users}->{$userid}
1601         or die "user '$userid' not found\n";
1602
1603     my $domain_cfg = $cached_domaincfg || cfs_read_file('domains.cfg');
1604     my $realm_cfg = $domain_cfg->{ids}->{$realm};
1605     die "auth domain '$realm' does not exist\n" if !$realm_cfg;
1606
1607     my $realm_tfa = $realm_cfg->{tfa};
1608     if (defined($realm_tfa)) {
1609         $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa);
1610         # If the realm has a TFA setting, we're only allowed to use that.
1611         if (defined($data)) {
1612             my $required_type = $realm_tfa->{type};
1613             if ($required_type ne $type) {
1614                 die "realm '$realm' only allows TFA of type '$required_type\n";
1615             }
1616
1617             if (defined($data->{config})) {
1618                 # XXX: Is it enough if the type matches? Or should the configuration also match?
1619             }
1620
1621             # realm-configured tfa always uses a simple key list, so use the user.cfg
1622             $user->{keys} = $data->{keys};
1623         } else {
1624             die "realm '$realm' does not allow removing the 2nd factor\n";
1625         }
1626     } else {
1627         # Without a realm-enforced TFA setting the user can add a u2f or totp entry by themselves.
1628         # The 'yubico' type requires yubico server settings, which have to be configured on the
1629         # realm, so this is not supported here:
1630         die "domain '$realm' does not support TFA type '$type'\n"
1631             if defined($data) && !$USER_CONTROLLED_TFA_TYPES->{$type};
1632     }
1633
1634     # Custom TFA entries are stored in priv/tfa.cfg as they can be more complet: u2f uses a
1635     # public key and a key handle, TOTP requires the usual totp settings...
1636
1637     my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
1638     my $tfa = ($tfa_cfg->{users}->{$userid} //= {});
1639
1640     if (defined($data)) {
1641         $tfa->{type} = $type;
1642         $tfa->{data} = $data;
1643         cfs_write_file('priv/tfa.cfg', $tfa_cfg);
1644
1645         $user->{keys} = "x!$type";
1646     } else {
1647         delete $tfa_cfg->{users}->{$userid};
1648         cfs_write_file('priv/tfa.cfg', $tfa_cfg);
1649
1650         delete $user->{keys};
1651     }
1652
1653     cfs_write_file('user.cfg', $user_cfg);
1654 }
1655
1656 sub user_get_tfa {
1657     my ($username, $realm) = @_;
1658
1659     my $user_cfg = cfs_read_file('user.cfg');
1660     my $user = $user_cfg->{users}->{$username}
1661         or die "user '$username' not found\n";
1662
1663     my $keys = $user->{keys};
1664
1665     my $domain_cfg = cfs_read_file('domains.cfg');
1666     my $realm_cfg = $domain_cfg->{ids}->{$realm};
1667     die "auth domain '$realm' does not exist\n" if !$realm_cfg;
1668
1669     my $realm_tfa = $realm_cfg->{tfa};
1670     $realm_tfa = PVE::Auth::Plugin::parse_tfa_config($realm_tfa)
1671         if $realm_tfa;
1672
1673     if (!$keys) {
1674         return if !$realm_tfa;
1675         die "missing required 2nd keys\n";
1676     }
1677
1678     # new style config starts with an 'x' and optionally contains a !<type> suffix
1679     if ($keys !~ /^x(?:!.*)?$/) {
1680         # old style config, find the type via the realm
1681         return if !$realm_tfa;
1682         return ($realm_tfa->{type}, {
1683             keys => $keys,
1684             config => $realm_tfa,
1685         });
1686     } else {
1687         my $tfa_cfg = cfs_read_file('priv/tfa.cfg');
1688         my $tfa = $tfa_cfg->{users}->{$username};
1689         return if !$tfa; # should not happen (user.cfg wasn't cleaned up?)
1690
1691         if ($realm_tfa) {
1692             # if the realm has a tfa setting we need to verify the type:
1693             die "auth domain '$realm' and user have mismatching TFA settings\n"
1694                 if $realm_tfa && $realm_tfa->{type} ne $tfa->{type};
1695         }
1696
1697         return ($tfa->{type}, $tfa->{data});
1698     }
1699 }
1700
1701 # bash completion helpers
1702
1703 register_standard_option('userid-completed',
1704     get_standard_option('userid', { completion => \&complete_username}),
1705 );
1706
1707 sub complete_username {
1708
1709     my $user_cfg = cfs_read_file('user.cfg');
1710
1711     return [ keys %{$user_cfg->{users}} ];
1712 }
1713
1714 sub complete_group {
1715
1716     my $user_cfg = cfs_read_file('user.cfg');
1717
1718     return [ keys %{$user_cfg->{groups}} ];
1719 }
1720
1721 sub complete_realm {
1722
1723     my $domain_cfg = cfs_read_file('domains.cfg');
1724
1725     return [ keys %{$domain_cfg->{ids}} ];
1726 }
1727
1728 1;