X-Git-Url: https://git.proxmox.com/?p=pve-access-control.git;a=blobdiff_plain;f=PVE%2FAccessControl.pm;h=44fc0aa924849f11780f427c8d891f26ea975dab;hp=0b6437404f38c5e324881d1e35d8745fb959034f;hb=b54b7474bbd31dfea36a773b848a343d2d13aedd;hpb=5426494b105d5949695962a34ddbf75719f56333

diff --git a/PVE/AccessControl.pm b/PVE/AccessControl.pm
index 0b64374..44fc0aa 100644
--- a/PVE/AccessControl.pm
+++ b/PVE/AccessControl.pm
@@ -8,13 +8,13 @@ use Crypt::OpenSSL::RSA;
 use Net::SSLeay;
 use Net::IP;
 use MIME::Base64;
-use MIME::Base32 qw(RFC); #libmime-base32-perl
 use Digest::SHA;
-use URI::Escape;
-use LWP::UserAgent;
+
+use PVE::OTP;
+use PVE::Ticket;
 use PVE::Tools qw(run_command lock_file file_get_contents split_list safe_print);
 use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file cfs_lock_file);
-use PVE::JSONSchema;
+use PVE::JSONSchema qw(register_standard_option get_standard_option);
 
 use PVE::Auth::Plugin;
 use PVE::Auth::AD;
@@ -22,8 +22,6 @@ use PVE::Auth::LDAP;
 use PVE::Auth::PVE;
 use PVE::Auth::PAM;
 
-use Data::Dumper; # fixme: remove
-
 # load and initialize all plugins
 
 PVE::Auth::AD->register();
@@ -47,7 +45,6 @@ cfs_register_file('user.cfg',
 		  \&parse_user_config,
 		  \&write_user_config);
 
-
 sub verify_username {
     PVE::Auth::Plugin::verify_username(@_);
 }
@@ -89,30 +86,18 @@ my $get_csrfr_secret = sub {
 sub assemble_csrf_prevention_token {
     my ($username) = @_;
 
-    my $timestamp = sprintf("%08X", time());
-
-    my $digest = Digest::SHA::sha1_base64("$timestamp:$username", &$get_csrfr_secret());
+    my $secret =  &$get_csrfr_secret();
 
-    return "$timestamp:$digest";
+    return PVE::Ticket::assemble_csrf_prevention_token ($secret, $username);
 }
 
 sub verify_csrf_prevention_token {
     my ($username, $token, $noerr) = @_;
 
-    if ($token =~ m/^([A-Z0-9]{8}):(\S+)$/) {
-	my $sig = $2;
-	my $timestamp = $1;
-	my $ttime = hex($timestamp);
-
-	my $digest = Digest::SHA::sha1_base64("$timestamp:$username", &$get_csrfr_secret());
-
-	my $age = time() - $ttime;
-	return if ($digest eq $sig) && ($age > -300) && ($age < $ticket_lifetime);
-    }
-
-    die "Permission denied - invalid csrf token\n" if !$noerr;
+    my $secret =  &$get_csrfr_secret();
 
-    return undef;
+    return PVE::Ticket::verify_csrf_prevention_token(
+	$secret, $username, $token, -300, $ticket_lifetime, $noerr);
 }
 
 my $pve_auth_priv_key;
@@ -132,42 +117,22 @@ sub assemble_ticket {
 
     my $rsa_priv = get_privkey();
 
-    my $timestamp = sprintf("%08X", time());
-
-    my $plain = "PVE:$username:$timestamp";
-
-    my $ticket = $plain . "::" . encode_base64($rsa_priv->sign($plain), '');
-
-    return $ticket;
+    return PVE::Ticket::assemble_rsa_ticket($rsa_priv, 'PVE', $username);
 }
 
 sub verify_ticket {
     my ($ticket, $noerr) = @_;
 
-    if ($ticket && $ticket =~ m/^(PVE:\S+)::([^:\s]+)$/) {
-	my $plain = $1;
-	my $sig = $2;
+    my $rsa_pub = get_pubkey();
 
-	my $rsa_pub = get_pubkey();
-	if ($rsa_pub->verify($plain, decode_base64($sig))) {
-	    if ($plain =~ m/^PVE:(\S+):([A-Z0-9]{8})$/) {
-		my $username = $1;
-		my $timestamp = $2;
-		my $ttime = hex($timestamp);
+    my ($username, $age) = PVE::Ticket::verify_rsa_ticket(
+	$rsa_pub, 'PVE', $ticket, undef, -300, $ticket_lifetime, $noerr);
 
-		my $age = time() - $ttime;
+    return undef if $noerr && !defined($username);
 
-		if (PVE::Auth::Plugin::verify_username($username, 1) &&
-		    ($age > -300) && ($age < $ticket_lifetime)) {
-		    return wantarray ? ($username, $age) : $username;
-		}
-	    }
-	}
-    }
+    return undef if !PVE::Auth::Plugin::verify_username($username, $noerr);
 
-    die "permission denied - invalid ticket\n" if !$noerr;
-
-    return undef;
+    return wantarray ? ($username, $age) : $username;
 }
 
 # VNC tickets
@@ -178,108 +143,40 @@ sub assemble_vnc_ticket {
 
     my $rsa_priv = get_privkey();
 
-    my $timestamp = sprintf("%08X", time());
-
-    my $plain = "PVEVNC:$timestamp";
-
     $path = normalize_path($path);
 
-    my $full = "$plain:$username:$path";
-
-    my $ticket = $plain . "::" . encode_base64($rsa_priv->sign($full), '');
+    my $secret_data = "$username:$path";
 
-    return $ticket;
+    return PVE::Ticket::assemble_rsa_ticket(
+	$rsa_priv, 'PVEVNC', undef, $secret_data);
 }
 
 sub verify_vnc_ticket {
     my ($ticket, $username, $path, $noerr) = @_;
 
-    if ($ticket && $ticket =~ m/^(PVEVNC:\S+)::([^:\s]+)$/) {
-	my $plain = $1;
-	my $sig = $2;
-	my $full = "$plain:$username:$path";
+    my $rsa_pub = get_pubkey();
 
-	my $rsa_pub = get_pubkey();
-	# Note: sign only match if $username and  $path is correct
-	if ($rsa_pub->verify($full, decode_base64($sig))) {
-	    if ($plain =~ m/^PVEVNC:([A-Z0-9]{8})$/) {
-		my $ttime = hex($1);
-
-		my $age = time() - $ttime;
-
-		if (($age > -20) && ($age < 40)) {
-		    return 1;
-		}
-	    }
-	}
-    }
+    my $secret_data = "$username:$path";
 
-    die "permission denied - invalid vnc ticket\n" if !$noerr;
-
-    return undef;
+    return PVE::Ticket::verify_rsa_ticket(
+	$rsa_pub, 'PVEVNC', $ticket, $secret_data, -20, 40, $noerr);
 }
 
 sub assemble_spice_ticket {
     my ($username, $vmid, $node) = @_;
 
-    my $rsa_priv = get_privkey();
-
-    my $timestamp = sprintf("%08x", time());
-
-    my $randomstr = "PVESPICE:$timestamp:$vmid:$node:" . rand(10);
-
-    # this should be used as one-time password
-    # max length is 60 chars (spice limit)
-    # we pass this to qemu set_pasword and limit lifetime there
-    # keep this secret
-    my $ticket = Digest::SHA::sha1_hex($rsa_priv->sign($randomstr));
-
-    # Note: spice proxy connects with HTTP, so $proxyticket is exposed to public
-    # we use a signature/timestamp to make sure nobody can fake such a ticket
-    # an attacker can use this $proxyticket, but he will fail because $ticket is
-    # private.
-    # The proxy needs to be able to extract/verify the ticket
-    # Note: data needs to be lower case only, because virt-viewer needs that
-    # Note: RSA signature are too long (>=256 charaters) and make problems with remote-viewer
-
     my $secret = &$get_csrfr_secret();
-    my $plain = "pvespiceproxy:$timestamp:$vmid:" . lc($node);
-
-    # produces 40 characters
-    my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
-
-    #my $sig =  unpack("H*", $rsa_priv->sign($plain)); # this produce too long strings (512)
 
-    my $proxyticket = $plain . "::" . $sig;
-
-    return ($ticket, $proxyticket);
+    return PVE::Ticket::assemble_spice_ticket(
+	$secret, $username, $vmid, $node);
 }
 
 sub verify_spice_connect_url {
     my ($connect_str) = @_;
 
-    # Note: we pass the spice ticket as 'host', so the
-    # spice viewer connects with "$ticket:$port"
-
-    return undef if !$connect_str;
-
-    if ($connect_str =~m/^pvespiceproxy:([a-z0-9]{8}):(\d+):(\S+)::([a-z0-9]{40}):(\d+)$/) {
-	my ($timestamp, $vmid, $node, $hexsig, $port) = ($1, $2, $3, $4, $5, $6);
-	my $ttime = hex($timestamp);
-	my $age = time() - $ttime;
-
-	# use very limited lifetime - is this enough?
-	return undef if !(($age > -20) && ($age < 40));
-
-	my $plain = "pvespiceproxy:$timestamp:$vmid:$node";
-	my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
-
-	if ($sig eq $hexsig) {
-	    return ($vmid, $node, $port);
-	}
-    }
+    my $secret = &$get_csrfr_secret();
 
-    return undef;
+    return PVE::Ticket::verify_spice_connect_url($secret, $connect_str);
 }
 
 sub read_x509_subject_spice {
@@ -382,10 +279,11 @@ sub verify_one_time_pw {
 
     if ($type eq 'yubico') {
 	my $keys = $usercfg->{users}->{$username}->{keys};
-	yubico_verify_otp($otp, $keys, $tfa_cfg->{url}, $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
+	PVE::OTP::yubico_verify_otp($otp, $keys, $tfa_cfg->{url},
+				    $tfa_cfg->{id}, $tfa_cfg->{key}, $proxy);
     } elsif ($type eq 'oath') {
 	my $keys = $usercfg->{users}->{$username}->{keys};
-	oath_verify_otp($otp, $keys, $tfa_cfg->{step}, $tfa_cfg->{digits});
+	PVE::OTP::oath_verify_otp($otp, $keys, $tfa_cfg->{step}, $tfa_cfg->{digits});
     } else {
 	die "unknown tfa type '$type'\n";
     }
@@ -504,6 +402,7 @@ my $privgroups = {
 	    'VM.Migrate',
 	    'VM.Monitor',
 	    'VM.Snapshot',
+	    'VM.Snapshot.Rollback',
 	],
 	user => [
 	    'VM.Config.CDROM', # change CDROM media
@@ -600,6 +499,11 @@ sub create_roles {
 
 create_roles();
 
+sub role_is_special {
+    my ($role) = @_;
+    return (exists $special_roles->{$role}) ? 1 : 0;
+}
+
 sub add_role_privs {
     my ($role, $usercfg, $privs) = @_;
 
@@ -632,7 +536,6 @@ sub normalize_path {
     return $path;
 }
 
-
 PVE::JSONSchema::register_format('pve-groupid', \&verify_groupname);
 sub verify_groupname {
     my ($groupname, $noerr) = @_;
@@ -661,7 +564,7 @@ sub verify_rolename {
     return $rolename;
 }
 
-PVE::JSONSchema::register_format('pve-poolid', \&verify_groupname);
+PVE::JSONSchema::register_format('pve-poolid', \&verify_poolname);
 sub verify_poolname {
     my ($poolname, $noerr) = @_;
 
@@ -1173,154 +1076,12 @@ sub remove_vm_from_pool {
     lock_user_config($delVMfromPoolFn, "pool cleanup for VM $vmid failed");
 }
 
-# hotp/totp code
-
-sub hotp($$;$) {
-	my ($binsecret, $number, $digits) = @_;
-
-	$digits = 6 if !defined($digits);
-
-	my $bincounter = pack('Q>', $number);
-	my $hmac = Digest::SHA::hmac_sha1($bincounter, $binsecret);
-
-	my $offset = unpack('C', substr($hmac,19) & pack('C', 0x0F));
-	my $part = substr($hmac, $offset, 4);
-	my $otp = unpack('N', $part);
-	my $value = ($otp & 0x7fffffff) % (10**$digits);
-	return sprintf("%0${digits}d", $value);
-}
-
-# experimental code for yubico OTP verification
-
-sub yubico_compute_param_sig {
-    my ($param, $api_key) = @_;
-
-    my $paramstr = '';
-    foreach my $key (sort keys %$param) {
-	$paramstr .= '&' if $paramstr;
-	$paramstr .= "$key=$param->{$key}";
-    }
-
-    # hmac_sha1_base64 does not add '=' padding characters, so we use encode_base64
-    my $sig = uri_escape(encode_base64(Digest::SHA::hmac_sha1($paramstr, decode_base64($api_key || '')), ''));
-
-    return ($paramstr, $sig);
-}
-
-sub yubico_verify_otp {
-    my ($otp, $keys, $url, $api_id, $api_key, $proxy) = @_;
-
-    die "yubico: missing password\n" if !defined($otp);
-    die "yubico: missing API ID\n" if !defined($api_id);
-    die "yubico: missing API KEY\n" if !defined($api_key);
-    die "yubico: no associated yubico keys\n" if $keys =~ m/^\s+$/;
-
-    die "yubico: wrong OTP length\n" if (length($otp) < 32) || (length($otp) > 48);
-
-    $url = 'http://api2.yubico.com/wsapi/2.0/verify' if !defined($url);
-
-    my $params = {
-	nonce =>  Digest::SHA::hmac_sha1_hex(time(), rand()),
-	id => $api_id,
-	otp => uri_escape($otp),
-	timestamp => 1,
-    };
-
-    my ($paramstr, $sig) = yubico_compute_param_sig($params, $api_key);
-
-    $paramstr .= "&h=$sig" if $api_key;
-
-    my $req = HTTP::Request->new('GET' => "$url?$paramstr");
-
-    my $ua = LWP::UserAgent->new(protocols_allowed => ['http', 'https'], timeout => 30);
-
-    if ($proxy) {
-	$ua->proxy(['http', 'https'], $proxy);
-    } else {
-	$ua->env_proxy;
-    }
-
-    my $response = $ua->request($req);
-    my $code = $response->code;
-
-    if ($code != 200) {
-	my $msg = $response->message || 'unknown';
-	die "Invalid response from server: $code $msg\n";
-    }
-
-    my $raw = $response->decoded_content;
-
-    my $result = {};
-    foreach my $kvpair (split(/\n/, $raw)) {
-	chomp $kvpair;
-	if($kvpair =~ /^\S+=/) {
-	    my ($k, $v) = split(/=/, $kvpair, 2);
-	    $v =~ s/\s//g;
-	    $result->{$k} = $v;
-        }
-    }
-
-    my $rsig = $result->{h};
-    delete $result->{h};
-
-    if ($api_key) {
-	my ($datastr, $vsig) = yubico_compute_param_sig($result, $api_key);
-	$vsig = uri_unescape($vsig);
-	die "yubico: result signature verification failed\n" if $rsig ne $vsig;
-    }
-
-    die "yubico auth failed: $result->{status}\n" if $result->{status} ne 'OK';
-
-    my $publicid = $result->{publicid} = substr(lc($result->{otp}), 0, 12);
-
-    my $found;
-    foreach my $k (PVE::Tools::split_list($keys)) {
-	if ($k eq $publicid) {
-	    $found = 1;
-	    last;
-	}
-    }
-
-    die "yubico auth failed: key does not belong to user\n" if !$found;
-
-    return $result;
-}
-
-sub oath_verify_otp {
-    my ($otp, $keys, $step, $digits) = @_;
-
-    die "oath: missing password\n" if !defined($otp);
-    die "oath: no associated oath keys\n" if $keys =~ m/^\s+$/;
-
-    $step = 30 if !$step;
-    $digits = 6 if !$digits;
-
-    my $found;
-    foreach my $k (PVE::Tools::split_list($keys)) {
-	# Note: we generate 3 values to allow small time drift
-	my $binkey;
-	if ($k =~ /^[A-Z2-7=]{16}$/) {
-	    $binkey = MIME::Base32::decode_rfc3548($k);
-	} elsif ($k =~ /^[A-Fa-f0-9]{40}$/) {
-	    $binkey = pack('H*', $k);
-	} else {
-	    die "unrecognized key format, must be hex or base32 encoded\n";
-	}
-
-	# force integer division for time/step
-	use integer;
-	my $now = time()/$step - 1;
-	$found = 1 if $otp eq hotp($binkey, $now+0, $digits);
-	$found = 1 if $otp eq hotp($binkey, $now+1, $digits);
-	$found = 1 if $otp eq hotp($binkey, $now+2, $digits);
-	last if $found;
-    }
-
-    die "oath auth failed\n" if !$found;
-}
-
 # bash completion helpers
 
+register_standard_option('userid-completed',
+    get_standard_option('userid', { completion => \&complete_username}),
+);
+
 sub complete_username {
 
     my $user_cfg = cfs_read_file('user.cfg');