2 729a7e24 2022-11-17 thomas * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3 729a7e24 2022-11-17 thomas * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
5 729a7e24 2022-11-17 thomas * Permission to use, copy, modify, and distribute this software for any
6 729a7e24 2022-11-17 thomas * purpose with or without fee is hereby granted, provided that the above
7 729a7e24 2022-11-17 thomas * copyright notice and this permission notice appear in all copies.
9 729a7e24 2022-11-17 thomas * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 729a7e24 2022-11-17 thomas * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 729a7e24 2022-11-17 thomas * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 729a7e24 2022-11-17 thomas * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 729a7e24 2022-11-17 thomas * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 729a7e24 2022-11-17 thomas * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 729a7e24 2022-11-17 thomas * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 729a7e24 2022-11-17 thomas #include <sys/types.h>
19 729a7e24 2022-11-17 thomas #include <sys/queue.h>
20 729a7e24 2022-11-17 thomas #include <sys/uio.h>
22 729a7e24 2022-11-17 thomas #include <errno.h>
23 729a7e24 2022-11-17 thomas #include <event.h>
24 729a7e24 2022-11-17 thomas #include <limits.h>
25 729a7e24 2022-11-17 thomas #include <pwd.h>
26 729a7e24 2022-11-17 thomas #include <grp.h>
27 729a7e24 2022-11-17 thomas #include <sha1.h>
28 729a7e24 2022-11-17 thomas #include <stdint.h>
29 729a7e24 2022-11-17 thomas #include <stdio.h>
30 729a7e24 2022-11-17 thomas #include <stdlib.h>
31 729a7e24 2022-11-17 thomas #include <imsg.h>
32 ff260661 2022-11-17 thomas #include <unistd.h>
34 729a7e24 2022-11-17 thomas #include "got_error.h"
36 729a7e24 2022-11-17 thomas #include "gotd.h"
37 ff260661 2022-11-17 thomas #include "log.h"
38 729a7e24 2022-11-17 thomas #include "auth.h"
40 729a7e24 2022-11-17 thomas static int
41 729a7e24 2022-11-17 thomas parseuid(const char *s, uid_t *uid)
43 729a7e24 2022-11-17 thomas struct passwd *pw;
44 729a7e24 2022-11-17 thomas const char *errstr;
46 729a7e24 2022-11-17 thomas if ((pw = getpwnam(s)) != NULL) {
47 729a7e24 2022-11-17 thomas *uid = pw->pw_uid;
48 729a7e24 2022-11-17 thomas if (*uid == UID_MAX)
49 729a7e24 2022-11-17 thomas return -1;
52 729a7e24 2022-11-17 thomas *uid = strtonum(s, 0, UID_MAX - 1, &errstr);
53 729a7e24 2022-11-17 thomas if (errstr)
54 729a7e24 2022-11-17 thomas return -1;
58 729a7e24 2022-11-17 thomas static int
59 729a7e24 2022-11-17 thomas uidcheck(const char *s, uid_t desired)
61 729a7e24 2022-11-17 thomas uid_t uid;
63 729a7e24 2022-11-17 thomas if (parseuid(s, &uid) != 0)
64 729a7e24 2022-11-17 thomas return -1;
65 729a7e24 2022-11-17 thomas if (uid != desired)
66 729a7e24 2022-11-17 thomas return -1;
70 729a7e24 2022-11-17 thomas static int
71 729a7e24 2022-11-17 thomas parsegid(const char *s, gid_t *gid)
73 729a7e24 2022-11-17 thomas struct group *gr;
74 729a7e24 2022-11-17 thomas const char *errstr;
76 729a7e24 2022-11-17 thomas if ((gr = getgrnam(s)) != NULL) {
77 729a7e24 2022-11-17 thomas *gid = gr->gr_gid;
78 729a7e24 2022-11-17 thomas if (*gid == GID_MAX)
79 729a7e24 2022-11-17 thomas return -1;
82 729a7e24 2022-11-17 thomas *gid = strtonum(s, 0, GID_MAX - 1, &errstr);
83 729a7e24 2022-11-17 thomas if (errstr)
84 729a7e24 2022-11-17 thomas return -1;
88 729a7e24 2022-11-17 thomas static int
89 729a7e24 2022-11-17 thomas match_identifier(const char *identifier, gid_t *groups, int ngroups,
90 729a7e24 2022-11-17 thomas uid_t euid, gid_t egid)
94 729a7e24 2022-11-17 thomas if (identifier[0] == ':') {
95 729a7e24 2022-11-17 thomas gid_t rgid;
96 729a7e24 2022-11-17 thomas if (parsegid(identifier + 1, &rgid) == -1)
98 ff260661 2022-11-17 thomas if (rgid == egid)
100 729a7e24 2022-11-17 thomas for (i = 0; i < ngroups; i++) {
101 ff260661 2022-11-17 thomas if (rgid == groups[i])
104 729a7e24 2022-11-17 thomas if (i == ngroups)
105 729a7e24 2022-11-17 thomas return 0;
106 729a7e24 2022-11-17 thomas } else if (uidcheck(identifier, euid) != 0)
107 729a7e24 2022-11-17 thomas return 0;
109 729a7e24 2022-11-17 thomas return 1;
112 729a7e24 2022-11-17 thomas const struct got_error *
113 729a7e24 2022-11-17 thomas gotd_auth_check(struct gotd_access_rule_list *rules, const char *repo_name,
114 ff260661 2022-11-17 thomas uid_t euid, gid_t egid, int required_auth)
116 729a7e24 2022-11-17 thomas struct gotd_access_rule *rule;
117 729a7e24 2022-11-17 thomas enum gotd_access access = GOTD_ACCESS_DENIED;
118 ff260661 2022-11-17 thomas struct passwd *pw;
119 ff260661 2022-11-17 thomas gid_t groups[NGROUPS_MAX];
120 ff260661 2022-11-17 thomas int ngroups = NGROUPS_MAX;
122 ff260661 2022-11-17 thomas pw = getpwuid(euid);
123 9928b132 2022-11-20 thomas if (pw == NULL) {
124 9928b132 2022-11-20 thomas if (errno)
125 9928b132 2022-11-20 thomas return got_error_from_errno("getpwuid");
127 9928b132 2022-11-20 thomas return got_error_set_errno(EACCES, repo_name);
130 ff260661 2022-11-17 thomas if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
131 ff260661 2022-11-17 thomas log_warnx("group membership list truncated");
133 729a7e24 2022-11-17 thomas STAILQ_FOREACH(rule, rules, entry) {
134 729a7e24 2022-11-17 thomas if (!match_identifier(rule->identifier, groups, ngroups,
135 729a7e24 2022-11-17 thomas euid, egid))
136 729a7e24 2022-11-17 thomas continue;
138 729a7e24 2022-11-17 thomas access = rule->access;
139 729a7e24 2022-11-17 thomas if (rule->access == GOTD_ACCESS_PERMITTED &&
140 729a7e24 2022-11-17 thomas (rule->authorization & required_auth) != required_auth)
141 729a7e24 2022-11-17 thomas access = GOTD_ACCESS_DENIED;
144 729a7e24 2022-11-17 thomas if (access == GOTD_ACCESS_DENIED)
145 729a7e24 2022-11-17 thomas return got_error_set_errno(EACCES, repo_name);
147 729a7e24 2022-11-17 thomas if (access == GOTD_ACCESS_PERMITTED)
148 729a7e24 2022-11-17 thomas return NULL;
150 729a7e24 2022-11-17 thomas /* should not happen, this would be a bug */
151 729a7e24 2022-11-17 thomas return got_error_msg(GOT_ERR_NOT_IMPL, "bad access rule");
