1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/socket.h>
20 #include <sys/queue.h>
21 #include <sys/uio.h>
22 
23 #include <errno.h>
24 #include <event.h>
25 #include <limits.h>
26 #include <pwd.h>
27 #include <grp.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_error.h"
37 #include "got_path.h"
38 
39 #include "gotd.h"
40 #include "log.h"
41 #include "auth.h"
42 
43 static struct gotd_auth {
44 	pid_t pid;
45 	const char *title;
46 	struct gotd_repo *repo;
47 } gotd_auth;
48 
49 static void auth_shutdown(void);
50 
51 static void
52 auth_sighdlr(int sig, short event, void *arg)
53 {
54 	/*
55 	 * Normal signal handler rules don't apply because libevent
56 	 * decouples for us.
57 	 */
58 
59 	switch (sig) {
60 	case SIGHUP:
61 		break;
62 	case SIGUSR1:
63 		break;
64 	case SIGTERM:
65 	case SIGINT:
66 		auth_shutdown();
67 		/* NOTREACHED */
68 		break;
69 	default:
70 		fatalx("unexpected signal");
71 	}
72 }
73 
74 static int
75 uidcheck(const char *s, uid_t desired)
76 {
77 	uid_t uid;
78 
79 	if (gotd_parseuid(s, &uid) != 0)
80 		return -1;
81 	if (uid != desired)
82 		return -1;
83 	return 0;
84 }
85 
86 static int
87 parsegid(const char *s, gid_t *gid)
88 {
89 	struct group *gr;
90 	const char *errstr;
91 
92 	if ((gr = getgrnam(s)) != NULL) {
93 		*gid = gr->gr_gid;
94 		if (*gid == GID_MAX)
95 			return -1;
96 		return 0;
97 	}
98 	*gid = strtonum(s, 0, GID_MAX - 1, &errstr);
99 	if (errstr)
100 		return -1;
101 	return 0;
102 }
103 
104 static int
105 match_identifier(const char *identifier, gid_t *groups, int ngroups,
106     uid_t euid, gid_t egid)
107 {
108 	int i;
109 
110 	if (identifier[0] == ':') {
111 		gid_t rgid;
112 		if (parsegid(identifier + 1, &rgid) == -1)
113 			return 0;
114 		if (rgid == egid)
115 			return 1;
116 		for (i = 0; i < ngroups; i++) {
117 			if (rgid == groups[i])
118 				break;
119 		}
120 		if (i == ngroups)
121 			return 0;
122 	} else if (uidcheck(identifier, euid) != 0)
123 		return 0;
124 
125 	return 1;
126 }
127 
128 static const struct got_error *
129 auth_check(struct gotd_access_rule_list *rules, const char *repo_name,
130     uid_t euid, gid_t egid, int required_auth)
131 {
132 	struct gotd_access_rule *rule;
133 	enum gotd_access access = GOTD_ACCESS_DENIED;
134 	struct passwd *pw;
135 	gid_t groups[NGROUPS_MAX];
136 	int ngroups = NGROUPS_MAX;
137 
138 	pw = getpwuid(euid);
139 	if (pw == NULL) {
140 		if (errno)
141 			return got_error_from_errno("getpwuid");
142 		else
143 			return got_error_set_errno(EACCES, repo_name);
144 	}
145 
146 	if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
147 		log_warnx("group membership list truncated");
148 
149 	STAILQ_FOREACH(rule, rules, entry) {
150 		if (!match_identifier(rule->identifier, groups, ngroups,
151 		    euid, egid))
152 			continue;
153 
154 		access = rule->access;
155 		if (rule->access == GOTD_ACCESS_PERMITTED &&
156 		    (rule->authorization & required_auth) != required_auth)
157 			access = GOTD_ACCESS_DENIED;
158 	}
159 
160 	if (access == GOTD_ACCESS_DENIED)
161 		return got_error_set_errno(EACCES, repo_name);
162 
163 	if (access == GOTD_ACCESS_PERMITTED)
164 		return NULL;
165 
166 	/* should not happen, this would be a bug */
167 	return got_error_msg(GOT_ERR_NOT_IMPL, "bad access rule");
168 }
169 
170 static const struct got_error *
171 recv_authreq(struct imsg *imsg, struct gotd_imsgev *iev)
172 {
173 	const struct got_error *err;
174 	struct imsgbuf *ibuf = &iev->ibuf;
175 	struct gotd_imsg_auth iauth;
176 	size_t datalen;
177 	uid_t euid;
178 	gid_t egid;
179 
180 	log_debug("authentication request received");
181 
182 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
183 	if (datalen != sizeof(iauth))
184 		return got_error(GOT_ERR_PRIVSEP_LEN);
185 
186 	memcpy(&iauth, imsg->data, datalen);
187 
188 	if (imsg->fd == -1)
189 		return got_error(GOT_ERR_PRIVSEP_NO_FD);
190 
191 	if (getpeereid(imsg->fd, &euid, &egid) == -1)
192 		return got_error_from_errno("getpeerid");
193 
194 	if (iauth.euid != euid)
195 		return got_error(GOT_ERR_UID);
196 	if (iauth.egid != egid)
197 		return got_error(GOT_ERR_GID);
198 
199 	log_debug("authenticating uid %d gid %d", euid, egid);
200 
201 	err = auth_check(&gotd_auth.repo->rules, gotd_auth.repo->name,
202 	    iauth.euid, iauth.egid, iauth.required_auth);
203 	if (err) {
204 		gotd_imsg_send_error(ibuf, PROC_AUTH, iauth.client_id, err);
205 		return err;
206 	}
207 
208 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_ACCESS_GRANTED,
209 	    PROC_AUTH, -1, NULL, 0) == -1)
210 		return got_error_from_errno("imsg compose ACCESS_GRANTED");
211 
212 	return NULL;
213 }
214 
215 static void
216 auth_dispatch(int fd, short event, void *arg)
217 {
218 	const struct got_error *err = NULL;
219 	struct gotd_imsgev *iev = arg;
220 	struct imsgbuf *ibuf = &iev->ibuf;
221 	struct imsg imsg;
222 	ssize_t n;
223 	int shut = 0;
224 
225 	if (event & EV_READ) {
226 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
227 			fatal("imsg_read error");
228 		if (n == 0)	/* Connection closed. */
229 			shut = 1;
230 	}
231 
232 	if (event & EV_WRITE) {
233 		n = msgbuf_write(&ibuf->w);
234 		if (n == -1 && errno != EAGAIN)
235 			fatal("msgbuf_write");
236 		if (n == 0)	/* Connection closed. */
237 			shut = 1;
238 	}
239 
240 	for (;;) {
241 		if ((n = imsg_get(ibuf, &imsg)) == -1)
242 			fatal("%s: imsg_get", __func__);
243 		if (n == 0)	/* No more messages. */
244 			break;
245 
246 		switch (imsg.hdr.type) {
247 		case GOTD_IMSG_AUTHENTICATE:
248 			err = recv_authreq(&imsg, iev);
249 			if (err)
250 				log_warnx("%s", err->msg);
251 			break;
252 		default:
253 			log_debug("unexpected imsg %d", imsg.hdr.type);
254 			break;
255 		}
256 
257 		imsg_free(&imsg);
258 	}
259 
260 	if (!shut) {
261 		gotd_imsg_event_add(iev);
262 	} else {
263 		/* This pipe is dead. Remove its event handler */
264 		event_del(&iev->ev);
265 		event_loopexit(NULL);
266 	}
267 }
268 
269 void
270 auth_main(const char *title, struct gotd_repolist *repos,
271     const char *repo_path)
272 {
273 	struct gotd_repo *repo = NULL;
274 	struct gotd_imsgev iev;
275 	struct event evsigint, evsigterm, evsighup, evsigusr1;
276 
277 	gotd_auth.title = title;
278 	gotd_auth.pid = getpid();
279 	TAILQ_FOREACH(repo, repos, entry) {
280 		if (got_path_cmp(repo->path, repo_path,
281 		    strlen(repo->path), strlen(repo_path)) == 0)
282 			break;
283 	}
284 	if (repo == NULL)
285 		fatalx("repository %s not found in config", repo_path);
286 	gotd_auth.repo = repo;
287 
288 	signal_set(&evsigint, SIGINT, auth_sighdlr, NULL);
289 	signal_set(&evsigterm, SIGTERM, auth_sighdlr, NULL);
290 	signal_set(&evsighup, SIGHUP, auth_sighdlr, NULL);
291 	signal_set(&evsigusr1, SIGUSR1, auth_sighdlr, NULL);
292 	signal(SIGPIPE, SIG_IGN);
293 
294 	signal_add(&evsigint, NULL);
295 	signal_add(&evsigterm, NULL);
296 	signal_add(&evsighup, NULL);
297 	signal_add(&evsigusr1, NULL);
298 
299 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
300 	iev.handler = auth_dispatch;
301 	iev.events = EV_READ;
302 	iev.handler_arg = NULL;
303 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, auth_dispatch, &iev);
304 	if (event_add(&iev.ev, NULL) == -1)
305 		fatalx("event add");
306 
307 	event_dispatch();
308 
309 	auth_shutdown();
310 }
311 
312 static void
313 auth_shutdown(void)
314 {
315 	log_debug("shutting down");
316 	exit(0);
317 }