2 0ccf3acb 2022-11-16 stsp * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3 0ccf3acb 2022-11-16 stsp * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
5 0ccf3acb 2022-11-16 stsp * Permission to use, copy, modify, and distribute this software for any
6 0ccf3acb 2022-11-16 stsp * purpose with or without fee is hereby granted, provided that the above
7 0ccf3acb 2022-11-16 stsp * copyright notice and this permission notice appear in all copies.
9 0ccf3acb 2022-11-16 stsp * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 0ccf3acb 2022-11-16 stsp * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 0ccf3acb 2022-11-16 stsp * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 0ccf3acb 2022-11-16 stsp * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 0ccf3acb 2022-11-16 stsp * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 0ccf3acb 2022-11-16 stsp * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 0ccf3acb 2022-11-16 stsp * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 0ccf3acb 2022-11-16 stsp #include <sys/types.h>
19 0ccf3acb 2022-11-16 stsp #include <sys/queue.h>
20 0ccf3acb 2022-11-16 stsp #include <sys/uio.h>
22 0ccf3acb 2022-11-16 stsp #include <errno.h>
23 0ccf3acb 2022-11-16 stsp #include <event.h>
24 ddbe612c 2022-11-17 stsp #include <grp.h>
25 0ccf3acb 2022-11-16 stsp #include <limits.h>
26 0ccf3acb 2022-11-16 stsp #include <pwd.h>
27 0ccf3acb 2022-11-16 stsp #include <grp.h>
28 0ccf3acb 2022-11-16 stsp #include <sha1.h>
29 0ccf3acb 2022-11-16 stsp #include <stdint.h>
30 0ccf3acb 2022-11-16 stsp #include <stdio.h>
31 0ccf3acb 2022-11-16 stsp #include <stdlib.h>
32 0ccf3acb 2022-11-16 stsp #include <imsg.h>
33 ddbe612c 2022-11-17 stsp #include <unistd.h>
35 0ccf3acb 2022-11-16 stsp #include "got_error.h"
37 0ccf3acb 2022-11-16 stsp #include "gotd.h"
38 ddbe612c 2022-11-17 stsp #include "log.h"
39 0ccf3acb 2022-11-16 stsp #include "auth.h"
42 0ccf3acb 2022-11-16 stsp parseuid(const char *s, uid_t *uid)
44 0ccf3acb 2022-11-16 stsp struct passwd *pw;
45 0ccf3acb 2022-11-16 stsp const char *errstr;
47 0ccf3acb 2022-11-16 stsp if ((pw = getpwnam(s)) != NULL) {
48 0ccf3acb 2022-11-16 stsp *uid = pw->pw_uid;
49 0ccf3acb 2022-11-16 stsp if (*uid == UID_MAX)
53 0ccf3acb 2022-11-16 stsp *uid = strtonum(s, 0, UID_MAX - 1, &errstr);
60 0ccf3acb 2022-11-16 stsp uidcheck(const char *s, uid_t desired)
64 0ccf3acb 2022-11-16 stsp if (parseuid(s, &uid) != 0)
66 0ccf3acb 2022-11-16 stsp if (uid != desired)
72 0ccf3acb 2022-11-16 stsp parsegid(const char *s, gid_t *gid)
74 0ccf3acb 2022-11-16 stsp struct group *gr;
75 0ccf3acb 2022-11-16 stsp const char *errstr;
77 0ccf3acb 2022-11-16 stsp if ((gr = getgrnam(s)) != NULL) {
78 0ccf3acb 2022-11-16 stsp *gid = gr->gr_gid;
79 0ccf3acb 2022-11-16 stsp if (*gid == GID_MAX)
83 0ccf3acb 2022-11-16 stsp *gid = strtonum(s, 0, GID_MAX - 1, &errstr);
90 0ccf3acb 2022-11-16 stsp match_identifier(const char *identifier, gid_t *groups, int ngroups,
91 0ccf3acb 2022-11-16 stsp uid_t euid, gid_t egid)
95 0ccf3acb 2022-11-16 stsp if (identifier[0] == ':') {
97 0ccf3acb 2022-11-16 stsp if (parsegid(identifier + 1, &rgid) == -1)
99 ddbe612c 2022-11-17 stsp if (rgid == egid)
101 0ccf3acb 2022-11-16 stsp for (i = 0; i < ngroups; i++) {
102 ddbe612c 2022-11-17 stsp if (rgid == groups[i])
105 0ccf3acb 2022-11-16 stsp if (i == ngroups)
107 0ccf3acb 2022-11-16 stsp } else if (uidcheck(identifier, euid) != 0)
113 0ccf3acb 2022-11-16 stsp const struct got_error *
114 0ccf3acb 2022-11-16 stsp gotd_auth_check(struct gotd_access_rule_list *rules, const char *repo_name,
115 ddbe612c 2022-11-17 stsp uid_t euid, gid_t egid, int required_auth)
117 0ccf3acb 2022-11-16 stsp struct gotd_access_rule *rule;
118 0ccf3acb 2022-11-16 stsp enum gotd_access access = GOTD_ACCESS_DENIED;
119 ddbe612c 2022-11-17 stsp struct passwd *pw;
120 ddbe612c 2022-11-17 stsp gid_t groups[NGROUPS_MAX];
121 ddbe612c 2022-11-17 stsp int ngroups = NGROUPS_MAX;
123 ddbe612c 2022-11-17 stsp pw = getpwuid(euid);
124 ddbe612c 2022-11-17 stsp if (pw == NULL)
125 ddbe612c 2022-11-17 stsp return got_error_from_errno("getpwuid");
127 ddbe612c 2022-11-17 stsp if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
128 ddbe612c 2022-11-17 stsp log_warnx("group membership list truncated");
130 0ccf3acb 2022-11-16 stsp STAILQ_FOREACH(rule, rules, entry) {
131 0ccf3acb 2022-11-16 stsp if (!match_identifier(rule->identifier, groups, ngroups,
132 0ccf3acb 2022-11-16 stsp euid, egid))
135 0ccf3acb 2022-11-16 stsp access = rule->access;
136 0ccf3acb 2022-11-16 stsp if (rule->access == GOTD_ACCESS_PERMITTED &&
137 0ccf3acb 2022-11-16 stsp (rule->authorization & required_auth) != required_auth)
138 0ccf3acb 2022-11-16 stsp access = GOTD_ACCESS_DENIED;
141 0ccf3acb 2022-11-16 stsp if (access == GOTD_ACCESS_DENIED)
142 0ccf3acb 2022-11-16 stsp return got_error_set_errno(EACCES, repo_name);
144 0ccf3acb 2022-11-16 stsp if (access == GOTD_ACCESS_PERMITTED)
145 0ccf3acb 2022-11-16 stsp return NULL;
147 0ccf3acb 2022-11-16 stsp /* should not happen, this would be a bug */
148 0ccf3acb 2022-11-16 stsp return got_error_msg(GOT_ERR_NOT_IMPL, "bad access rule");