package PVE::AccessControl;
use strict;
+use warnings;
use Encode;
use Crypt::OpenSSL::Random;
use Crypt::OpenSSL::RSA;
# private.
# The proxy need to be able to extract/verify the ticket
# Note: data needs to be lower case only, because virt-viewer needs that
- my $plain = "pvespiceproxy:$timestamp:$vmid:$node";
- my $sig = unpack("H*", $rsa_priv->sign($plain));
+ # Note: RSA signature are too long (>=256 charaters) and makes problems with remote-viewer
+
+ my $secret = &$get_csrfr_secret();
+ my $plain = "pvespiceproxy:$timestamp:$vmid:" . lc($node);
+
+ # produces 40 characters
+ my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
+
+ #my $sig = unpack("H*", $rsa_priv->sign($plain)); # this produce too long strings (512)
my $proxyticket = $plain . "::" . $sig;
return undef if !$connect_str;
- if ($connect_str =~m/^pvespiceproxy:([a-z0-9]{8}):(\d+):(\S+)::([a-z0-9]{512}):(\d+)$/) {
+ if ($connect_str =~m/^pvespiceproxy:([a-z0-9]{8}):(\d+):(\S+)::([a-z0-9]{40}):(\d+)$/) {
my ($timestamp, $vmid, $node, $hexsig, $port) = ($1, $2, $3, $4, $5, $6);
my $ttime = hex($timestamp);
my $age = time() - $ttime;
# use very limited lifetime - is this enough?
return undef if !(($age > -20) && ($age < 40));
- my $sig = pack("H*", $hexsig);
-
- my $rsa_pub = get_pubkey();
-
my $plain = "pvespiceproxy:$timestamp:$vmid:$node";
+ my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
- if ($rsa_pub->verify($plain, $sig)) {
+ if ($sig eq $hexsig) {
return ($vmid, $node, $port);
}
}
}
# password should be utf8 encoded
+# Note: some pluging delay/sleep if auth fails
sub authenticate_user {
my ($username, $password) = @_;
my $usercfg = cfs_read_file('user.cfg');
- eval { check_user_enabled($usercfg, $username); };
- if (my $err = $@) {
- sleep(2);
- die $err;
- }
+ check_user_enabled($usercfg, $username);
my $ctime = time();
my $expire = $usercfg->{users}->{$username}->{expire};
- if ($expire && ($expire < $ctime)) {
- sleep(2);
- die "account expired\n"
- }
+ die "account expired\n" if $expire && ($expire < $ctime);
my $domain_cfg = cfs_read_file('domains.cfg');
- eval {
- my $cfg = $domain_cfg->{ids}->{$realm};
- die "auth domain '$realm' does not exists\n" if !$cfg;
- my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
- $plugin->authenticate_user($cfg, $realm, $ruid, $password);
- };
- if (my $err = $@) {
- sleep(2); # timeout after failed auth
- die $err;
- }
+ my $cfg = $domain_cfg->{ids}->{$realm};
+ die "auth domain '$realm' does not exists\n" if !$cfg;
+ my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
+ $plugin->authenticate_user($cfg, $realm, $ruid, $password);
return $username;
}