1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  * Copyright (c) 2015 Ted Unangst <tedu@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/types.h>
19 #include <sys/queue.h>
20 #include <sys/uio.h>
21 
22 #include <errno.h>
23 #include <event.h>
24 #include <limits.h>
25 #include <pwd.h>
26 #include <grp.h>
27 #include <sha1.h>
28 #include <signal.h>
29 #include <stdint.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <string.h>
33 #include <imsg.h>
34 #include <unistd.h>
35 
36 #include "got_error.h"
37 #include "got_path.h"
38 
39 #include "gotd.h"
40 #include "log.h"
41 #include "auth.h"
42 
43 static struct gotd_auth {
44 	pid_t pid;
45 	const char *title;
46 	struct gotd_repo *repo;
47 } gotd_auth;
48 
49 static void auth_shutdown(void);
50 
51 static void
52 auth_sighdlr(int sig, short event, void *arg)
53 {
54 	/*
55 	 * Normal signal handler rules don't apply because libevent
56 	 * decouples for us.
57 	 */
58 
59 	switch (sig) {
60 	case SIGHUP:
61 		break;
62 	case SIGUSR1:
63 		break;
64 	case SIGTERM:
65 	case SIGINT:
66 		auth_shutdown();
67 		/* NOTREACHED */
68 		break;
69 	default:
70 		fatalx("unexpected signal");
71 	}
72 }
73 
74 static int
75 parseuid(const char *s, uid_t *uid)
76 {
77 	struct passwd *pw;
78 	const char *errstr;
79 
80 	if ((pw = getpwnam(s)) != NULL) {
81 		*uid = pw->pw_uid;
82 		if (*uid == UID_MAX)
83 			return -1;
84 		return 0;
85 	}
86 	*uid = strtonum(s, 0, UID_MAX - 1, &errstr);
87 	if (errstr)
88 		return -1;
89 	return 0;
90 }
91 
92 static int
93 uidcheck(const char *s, uid_t desired)
94 {
95 	uid_t uid;
96 
97 	if (parseuid(s, &uid) != 0)
98 		return -1;
99 	if (uid != desired)
100 		return -1;
101 	return 0;
102 }
103 
104 static int
105 parsegid(const char *s, gid_t *gid)
106 {
107 	struct group *gr;
108 	const char *errstr;
109 
110 	if ((gr = getgrnam(s)) != NULL) {
111 		*gid = gr->gr_gid;
112 		if (*gid == GID_MAX)
113 			return -1;
114 		return 0;
115 	}
116 	*gid = strtonum(s, 0, GID_MAX - 1, &errstr);
117 	if (errstr)
118 		return -1;
119 	return 0;
120 }
121 
122 static int
123 match_identifier(const char *identifier, gid_t *groups, int ngroups,
124     uid_t euid, gid_t egid)
125 {
126 	int i;
127 
128 	if (identifier[0] == ':') {
129 		gid_t rgid;
130 		if (parsegid(identifier + 1, &rgid) == -1)
131 			return 0;
132 		if (rgid == egid)
133 			return 1;
134 		for (i = 0; i < ngroups; i++) {
135 			if (rgid == groups[i])
136 				break;
137 		}
138 		if (i == ngroups)
139 			return 0;
140 	} else if (uidcheck(identifier, euid) != 0)
141 		return 0;
142 
143 	return 1;
144 }
145 
146 static const struct got_error *
147 auth_check(struct gotd_access_rule_list *rules, const char *repo_name,
148     uid_t euid, gid_t egid, int required_auth)
149 {
150 	struct gotd_access_rule *rule;
151 	enum gotd_access access = GOTD_ACCESS_DENIED;
152 	struct passwd *pw;
153 	gid_t groups[NGROUPS_MAX];
154 	int ngroups = NGROUPS_MAX;
155 
156 	pw = getpwuid(euid);
157 	if (pw == NULL) {
158 		if (errno)
159 			return got_error_from_errno("getpwuid");
160 		else
161 			return got_error_set_errno(EACCES, repo_name);
162 	}
163 
164 	if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups) == -1)
165 		log_warnx("group membership list truncated");
166 
167 	STAILQ_FOREACH(rule, rules, entry) {
168 		if (!match_identifier(rule->identifier, groups, ngroups,
169 		    euid, egid))
170 			continue;
171 
172 		access = rule->access;
173 		if (rule->access == GOTD_ACCESS_PERMITTED &&
174 		    (rule->authorization & required_auth) != required_auth)
175 			access = GOTD_ACCESS_DENIED;
176 	}
177 
178 	if (access == GOTD_ACCESS_DENIED)
179 		return got_error_set_errno(EACCES, repo_name);
180 
181 	if (access == GOTD_ACCESS_PERMITTED)
182 		return NULL;
183 
184 	/* should not happen, this would be a bug */
185 	return got_error_msg(GOT_ERR_NOT_IMPL, "bad access rule");
186 }
187 
188 static const struct got_error *
189 recv_authreq(struct imsg *imsg, struct gotd_imsgev *iev)
190 {
191 	const struct got_error *err;
192 	struct imsgbuf *ibuf = &iev->ibuf;
193 	struct gotd_imsg_auth iauth;
194 	size_t datalen;
195 
196 	log_debug("authentication request received");
197 
198 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
199 	if (datalen != sizeof(iauth))
200 		return got_error(GOT_ERR_PRIVSEP_LEN);
201 
202 	memcpy(&iauth, imsg->data, datalen);
203 
204 	err = auth_check(&gotd_auth.repo->rules, gotd_auth.repo->name,
205 	    iauth.euid, iauth.egid, iauth.required_auth);
206 	if (err) {
207 		gotd_imsg_send_error(ibuf, PROC_AUTH, iauth.client_id, err);
208 		return err;
209 	}
210 
211 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_ACCESS_GRANTED,
212 	    PROC_AUTH, -1, NULL, 0) == -1)
213 		return got_error_from_errno("imsg compose ACCESS_GRANTED");
214 
215 	return NULL;
216 }
217 
218 static void
219 auth_dispatch(int fd, short event, void *arg)
220 {
221 	const struct got_error *err = NULL;
222 	struct gotd_imsgev *iev = arg;
223 	struct imsgbuf *ibuf = &iev->ibuf;
224 	struct imsg imsg;
225 	ssize_t n;
226 	int shut = 0;
227 
228 	if (event & EV_READ) {
229 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
230 			fatal("imsg_read error");
231 		if (n == 0)	/* Connection closed. */
232 			shut = 1;
233 	}
234 
235 	if (event & EV_WRITE) {
236 		n = msgbuf_write(&ibuf->w);
237 		if (n == -1 && errno != EAGAIN)
238 			fatal("msgbuf_write");
239 		if (n == 0)	/* Connection closed. */
240 			shut = 1;
241 	}
242 
243 	for (;;) {
244 		if ((n = imsg_get(ibuf, &imsg)) == -1)
245 			fatal("%s: imsg_get", __func__);
246 		if (n == 0)	/* No more messages. */
247 			break;
248 
249 		switch (imsg.hdr.type) {
250 		case GOTD_IMSG_AUTHENTICATE:
251 			err = recv_authreq(&imsg, iev);
252 			if (err)
253 				log_warnx("%s: %s", gotd_auth.title, err->msg);
254 			break;
255 		default:
256 			log_debug("%s: unexpected imsg %d", gotd_auth.title,
257 			    imsg.hdr.type);
258 			break;
259 		}
260 
261 		imsg_free(&imsg);
262 	}
263 
264 	if (!shut) {
265 		gotd_imsg_event_add(iev);
266 	} else {
267 		/* This pipe is dead. Remove its event handler */
268 		event_del(&iev->ev);
269 		event_loopexit(NULL);
270 	}
271 }
272 
273 void
274 auth_main(const char *title, struct gotd_repolist *repos,
275     const char *repo_path)
276 {
277 	struct gotd_repo *repo = NULL;
278 	struct gotd_imsgev iev;
279 	struct event evsigint, evsigterm, evsighup, evsigusr1;
280 
281 	gotd_auth.title = title;
282 	gotd_auth.pid = getpid();
283 	TAILQ_FOREACH(repo, repos, entry) {
284 		if (got_path_cmp(repo->path, repo_path,
285 		    strlen(repo->path), strlen(repo_path)) == 0)
286 			break;
287 	}
288 	if (repo == NULL)
289 		fatalx("repository %s not found in config", repo_path);
290 	gotd_auth.repo = repo;
291 
292 	signal_set(&evsigint, SIGINT, auth_sighdlr, NULL);
293 	signal_set(&evsigterm, SIGTERM, auth_sighdlr, NULL);
294 	signal_set(&evsighup, SIGHUP, auth_sighdlr, NULL);
295 	signal_set(&evsigusr1, SIGUSR1, auth_sighdlr, NULL);
296 	signal(SIGPIPE, SIG_IGN);
297 
298 	signal_add(&evsigint, NULL);
299 	signal_add(&evsigterm, NULL);
300 	signal_add(&evsighup, NULL);
301 	signal_add(&evsigusr1, NULL);
302 
303 	imsg_init(&iev.ibuf, GOTD_FILENO_MSG_PIPE);
304 	iev.handler = auth_dispatch;
305 	iev.events = EV_READ;
306 	iev.handler_arg = NULL;
307 	event_set(&iev.ev, iev.ibuf.fd, EV_READ, auth_dispatch, &iev);
308 	if (event_add(&iev.ev, NULL) == -1)
309 		fatalx("event add");
310 
311 	event_dispatch();
312 
313 	auth_shutdown();
314 }
315 
316 static void
317 auth_shutdown(void)
318 {
319 	log_debug("%s: shutting down", gotd_auth.title);
320 	exit(0);
321 }