Makefile- acl.c
- acl.h
- acldata.c
- acldata.h
- auth.c
- auth.h
- config.c
- config.h
- configmanager.c
- configmanager.h
- error.c
- error.h
- event.c
- event.h
- event_bsd.c
- event_bsd.h
- event_linux.c
- event_linux.h
- event_solaris.c
- event_solaris.h
- func.c
- func.h
- http.c
- http.h
- httplistener.c
- httplistener.h
- httpparser.c
- httpparser.h
- httprequest.c
- httprequest.h
- keyfile_auth.c
- keyfile_auth.h
- ldap_auth.c
- ldap_auth.h
- log.c
- log.h
- main.c
- netsite.h
- objs.mk
- protocol.c
- protocol.h
- request.c
- request.h
- session.c
- session.h
- sessionhandler.c
- sessionhandler.h
- srvctrl.c
- srvctrl.h
- threadpools.c
- threadpools.h
- vfs.c
- vfs.h
- vserver.c
- vserver.h
- webserver.c
- webserver.h
- websocket.c
- websocket.h
- ws-fn.c
/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright 2013 Olaf Wintermann. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include "../util/util.h"
#include "../util/pool.h"
#include "../util/pblock.h"
#include "../safs/auth.h"
#include "log.h"
#include "acl.h"
#define AUTH_TYPE_BASIC "basic"
void acllist_createhandle(Session *sn, Request *rq) {
ACLListHandle *handle = pool_malloc(sn->pool, sizeof(ACLListHandle));
handle->defaultauthdb = NULL;
handle->listhead = NULL;
handle->listtail = NULL;
rq->acllist = handle;
}
/*
* append or prepend an ACL
*/
void acllist_add(Session *sn, Request *rq, ACLList *acl, int append) {
if(!rq->acllist) {
acllist_createhandle(sn, rq);
}
ACLListHandle *list = rq->acllist;
if(!list->defaultauthdb && acl->authdb) {
list->defaultauthdb = acl->authdb;
}
ACLListElm *elm = pool_malloc(sn->pool, sizeof(ACLListElm));
elm->acl = acl;
elm->next = NULL;
if(list->listhead == NULL) {
list->listhead = elm;
list->listtail = elm;
} else {
if(append) {
list->listtail->next = elm;
list->listtail = elm;
} else {
elm->next = list->listhead;
list->listhead = elm;
}
}
}
void acllist_append(Session *sn, Request *rq, ACLList *acl) {
acllist_add(sn, rq, acl, 1);
}
void acllist_prepend(Session *sn, Request *rq, ACLList *acl) {
acllist_add(sn, rq, acl, 0);
}
uint32_t acl_oflag2mask(int oflags) {
/* TODO:
* maybe there is a plattform where O_RDWR is not O_RDONLY | O_WRONLY
*/
uint32_t access_mask = 0;
if((oflags & O_RDONLY) == O_RDONLY) {
access_mask |= ACL_READ_DATA;
}
if((oflags & O_WRONLY) == O_WRONLY) {
access_mask |= ACL_WRITE_DATA;
}
return access_mask;
}
User* acllist_getuser(Session *sn, Request *rq, ACLListHandle *list) {
if(!sn || !rq || !list) {
return NULL;
}
// get user
User *user = NULL;
if(list->defaultauthdb) {
char *usr;
char *pw;
if(!basicauth_getuser(sn, rq, &usr, &pw)) {
int pwok;
user = authdb_get_and_verify(list->defaultauthdb, usr, pw, &pwok);
if(!user) {
// wrong user or wrong password
return NULL;
}
// ok - user is authenticated
pblock_kvinsert(
pb_key_auth_user,
user->name,
strlen(user->name),
rq->vars);
pblock_kvinsert(
pb_key_auth_type,
AUTH_TYPE_BASIC,
sizeof(AUTH_TYPE_BASIC)-1,
rq->vars);
}
}
return user;
}
void acl_set_error_status(Session *sn, Request *rq, ACLList *acl, User *user) {
if(sn == NULL || rq == NULL) {
return;
}
if(!user) {
char *value = NULL;
if(acl->authprompt) {
size_t realmlen = strlen(acl->authprompt);
size_t len = realmlen + 16;
value = pool_malloc(sn->pool, len);
if(value) {
snprintf(
value,
len,
"Basic realm=\"%s\"",
acl->authprompt);
}
}
if(!value) {
value = "Basic realm=\"login\"";
}
pblock_nvinsert("www-authenticate", value, rq->srvhdrs);
protocol_status(sn, rq, PROTOCOL_UNAUTHORIZED, NULL);
} else {
protocol_status(sn, rq, PROTOCOL_FORBIDDEN, NULL);
}
}
int acl_evaluate(Session *sn, Request *rq, int access_mask) {
ACLListHandle *list = rq->acllist;
if(!list) {
return REQ_PROCEED;
}
// we combine access_mask with the required access rights
access_mask |= rq->aclreqaccess;
// get user
User *user = acllist_getuser(sn, rq, list);
// evalutate all ACLs
ACLList *acl = acl_evallist(list, user, access_mask, NULL);
if(acl) {
acl_set_error_status(sn, rq, acl, user);
// TODO: don't free the user here
if(user) {
user->free(user);
}
return REQ_ABORTED;
}
// access allowed, we can free the user
if(user) {
user->free(user);
}
return REQ_PROCEED;
}
ACLList* acl_evallist(
ACLListHandle *list,
User *user,
int access_mask,
ACLList **externacl)
{
if(!list) {
return NULL;
}
if(externacl) {
*externacl = NULL;
}
// evaluate each acl until one denies access
ACLListElm *elm = list->listhead;
while(elm) {
ACLList *acl = elm->acl;
if(acl->isextern) {
// set externacl to the first external acl
if(externacl && *externacl == NULL) {
*externacl = acl;
}
} else if(!acl->check(acl, user, access_mask)) {
// the acl denies access
return acl;
}
elm = elm->next;
}
// ok - all acls allowed access
return NULL;
}
int wsacl_affects_user(WSAce *ace, User *user) {
int check_access = 0;
/*
* an ace can affect
* a named user or group (ace->who is set)
* the owner of the resource (ACL_OWNER is set)
* the owning group of the resource (ACL_GROUP is set)
* everyone (ACL_EVERYONE is set)
*
* Only one of this conditions should be true. The behavior on
* illegal flag combination is undefined. We assume that the acls
* are created correctly by the configuration loader.
*/
if(ace->who && user) {
// this ace is defined for a named user or group
if((ace->flags & ACL_IDENTIFIER_GROUP) == ACL_IDENTIFIER_GROUP) {
if(user->check_group(user, ace->who)) {
// the user is in the group
check_access = 1;
}
} else {
if(!strcmp(user->name, ace->who)) {
check_access = 1;
}
}
} else if((ace->flags & ACL_OWNER) == ACL_OWNER) {
// TODO
} else if((ace->flags & ACL_GROUP) == ACL_GROUP) {
// TODO
} else if((ace->flags & ACL_EVERYONE) == ACL_EVERYONE) {
check_access = 1;
}
return check_access;
}
int wsacl_check(WSAcl *acl, User *user, int access_mask) {
int allow = 0;
uint32_t allowed_access = 0;
// check each access control entry
for(int i=0;i<acl->acenum;i++) {
WSAce *ace = acl->ace[i];
if(wsacl_affects_user(ace, user)) {
if(ace->type == ACL_TYPE_ALLOWED) {
// add all new access rights
allowed_access |= (access_mask & ace->access_mask);
// check if we have all requested rights
if((allowed_access & access_mask) == access_mask) {
allow = 1;
break;
}
} else {
// ACL_TYPE_DENIED
if((ace->access_mask & access_mask) != 0) {
// access denied
break;
}
}
}
}
// TODO: events
return allow; // allow is 0, if no ace set it to 1
}
/* filesystem acl functions */
#if defined (__SVR4) && defined (__sun)
#include <sys/acl.h>
int solaris_acl_check(
char *path,
struct stat *s,
uint32_t mask,
uid_t uid,
gid_t gid);
int solaris_acl_affects_user(
ace_t *ace,
uid_t uid,
gid_t gid,
uid_t owner,
gid_t owninggroup);
int fs_acl_check(SysACL *acl, User *user, char *path, uint32_t access_mask) {
sstr_t p;
if(path[0] != '/') {
size_t n = 128;
char *cwd = malloc(n);
while(!getcwd(cwd, n)) {
if(errno == ERANGE) {
n *= 2;
cwd = realloc(cwd, n);
} else {
free(cwd);
return 0;
}
}
sstr_t wd = sstr(cwd);
sstr_t pp = sstr(path);
p = sstrcat(3, wd, sstrn("/", 1), pp);
} else {
p = sstrdup(sstr(path));
}
if(p.ptr[p.length-1] == '/') {
p.ptr[p.length-1] = 0;
p.length--;
}
// get uid/gid
struct passwd pw;
if(user) {
char *pwbuf = malloc(DEF_PWBUF);
if(pwbuf == NULL) {
free(p.ptr);
return 0;
}
if(!util_getpwnam(user->name, &pw, pwbuf, DEF_PWBUF)) {
free(pwbuf);
free(p.ptr);
return 0;
}
free(pwbuf);
acl->user_uid = pw.pw_uid;
acl->user_gid = pw.pw_gid;
} else {
acl->user_uid = -1;
acl->user_gid = -1;
}
// translate access_mask
uint32_t mask = 0;
if((access_mask & ACL_READ_DATA) == ACL_READ_DATA) {
mask |= ACE_READ_DATA;
}
if((access_mask & ACL_WRITE_DATA) == ACL_WRITE_DATA) {
mask |= ACE_WRITE_DATA;
}
if((access_mask & ACL_ADD_FILE) == ACL_ADD_FILE) {
mask |= ACE_ADD_FILE;
}
if((access_mask & ACL_READ_XATTR) == ACL_READ_XATTR) {
mask |= ACE_READ_NAMED_ATTRS;
}
if((access_mask & ACL_WRITE_XATTR) == ACL_WRITE_XATTR) {
mask |= ACE_WRITE_NAMED_ATTRS;
}
if((access_mask & ACL_EXECUTE) == ACL_EXECUTE) {
mask |= ACE_EXECUTE;
}
if((access_mask & ACL_DELETE) == ACL_DELETE) {
mask |= ACE_DELETE_CHILD;
}
if((access_mask & ACL_READ_ATTRIBUTES) == ACL_READ_ATTRIBUTES) {
mask |= ACE_READ_ATTRIBUTES;
}
if((access_mask & ACL_WRITE_ATTRIBUTES) == ACL_WRITE_ATTRIBUTES) {
mask |= ACE_WRITE_ATTRIBUTES;
}
if((access_mask & ACL_LIST) == ACL_LIST) {
mask |= ACE_LIST_DIRECTORY;
}
if((access_mask & ACL_READ_ACL) == ACL_READ_ACL) {
mask |= ACE_READ_ACL;
}
if((access_mask & ACL_WRITE_ACL) == ACL_WRITE_ACL) {
mask |= ACE_WRITE_ACL;
}
if((access_mask & ACL_WRITE_OWNER) == ACL_WRITE_OWNER) {
mask |= ACE_WRITE_OWNER;
}
if((access_mask & ACL_SYNCHRONIZE) == ACL_SYNCHRONIZE) {
mask |= ACE_SYNCHRONIZE;
}
/*
* If the vfs wants to create new files, path does not name an existing
* file. In this case, we check if the user has the ACE_ADD_FILE
* permission for the parent directory
*/
struct stat s;
if(stat(p.ptr, &s)) {
if(errno != ENOENT) {
perror("fs_acl_check: stat");
free(p.ptr);
return 0;
} else {
mask = ACE_ADD_FILE;
p = util_path_remove_last(p);
if(stat(p.ptr, &s)) {
free(p.ptr);
return 0;
}
}
}
/*
* perform a acl check for the path and each parent directory
* we don't check the file system root
*
* after the first check, we check only search permission for the
* directories
*/
if(!solaris_acl_check(p.ptr, &s, mask, pw.pw_uid, pw.pw_gid)) {
free(p.ptr);
return 0;
}
p = util_path_remove_last(p);
mask = ACE_LIST_DIRECTORY;
while(p.length > 1) {
if(stat(p.ptr, &s)) {
free(p.ptr);
return 0;
}
if(!solaris_acl_check(p.ptr, &s, mask, pw.pw_uid, pw.pw_gid)) {
free(p.ptr);
return 0;
}
// cut the last file name from the path
p = util_path_remove_last(p);
}
return 1;
}
int solaris_acl_check(
char *path,
struct stat *s,
uint32_t mask,
uid_t uid,
gid_t gid)
{
//printf("solaris_acl_check %s\n", path);
int nace = acl(path, ACE_GETACLCNT, 0, NULL);
if(nace == -1) {
perror("acl: ACE_GETACLCNT");
// TODO: log error
return 0;
}
ace_t *aces = calloc(nace, sizeof(ace_t));
if(acl(path, ACE_GETACL, nace, aces) == 1) {
perror("acl: ACE_GETACL");
// TODO: log error
free(aces);
return 0;
}
int allow = 0;
uint32_t allowed_access = 0;
for(int i=0;i<nace;i++) {
ace_t ace = aces[i];
if(solaris_acl_affects_user(&ace, uid, gid, s->st_uid, s->st_gid)) {
if(ace.a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) {
// add all new access rights
allowed_access |= (mask & ace.a_access_mask);
// check if we have all requested rights
if((allowed_access & mask) == mask) {
allow = 1;
break;
}
} else if(ace.a_type == ACE_ACCESS_DENIED_ACE_TYPE) {
// ACL_TYPE_DENIED
if((ace.a_access_mask & mask) != 0) {
// access denied
break;
}
}
}
}
free(aces);
//printf("return %d\n", allow);
return allow;
}
int solaris_acl_affects_user(
ace_t *ace,
uid_t uid,
gid_t gid,
uid_t owner,
gid_t owninggroup)
{
/*
* mostly the same as wsacl_affects_user
*/
int check_access = 0;
if((ace->a_flags & ACE_OWNER) == ACE_OWNER) {
if(uid == owner) {
check_access = 1;
}
} else if((ace->a_flags & ACE_GROUP) == ACE_GROUP) {
if(gid == owninggroup) {
check_access = 1;
}
} else if((ace->a_flags & ACE_EVERYONE) == ACE_EVERYONE) {
check_access = 1;
} else if(ace->a_who != -1 && uid != 0) {
// this ace is defined for a named user or group
if((ace->a_flags & ACE_IDENTIFIER_GROUP) == ACE_IDENTIFIER_GROUP) {
// TODO: check all groups
if(ace->a_who == gid) {
// the user is in the group
check_access = 1;
}
} else {
if(ace->a_who == uid) {
check_access = 1;
}
}
}
return check_access;
}
void fs_acl_finish() {
}
#endif
/*
* generic code for all non acl unices
* TODO: don't use OSX in the preprocessor directive
*/
#ifdef OSX
int fs_acl_check(SysACL *acl, User *user, char *path, uint32_t access_mask) {
return 1;
}
void fs_acl_finish() {
}
#endif
#ifdef BSD
int fs_acl_check(SysACL *acl, User *user, char *path, uint32_t access_mask) {
return 1;
}
void fs_acl_finish() {
}
#endif
#ifdef LINUX
#include <sys/fsuid.h>
int fs_acl_check(SysACL *acl, User *user, char *path, uint32_t access_mask) {
struct passwd *ws_pw = conf_getglobals()->Vuserpw;
if(!ws_pw) {
log_ereport(LOG_FAILURE, "fs_acl_check: unknown webserver uid/gid");
return 1;
}
// get uid/gid
struct passwd pw;
if(user) {
char *pwbuf = malloc(DEF_PWBUF);
if(pwbuf == NULL) {
return 0;
}
if(!util_getpwnam(user->name, &pw, pwbuf, DEF_PWBUF)) {
free(pwbuf);
return 0;
}
free(pwbuf);
acl->user_uid = pw.pw_uid;
acl->user_gid = pw.pw_gid;
} else {
acl->user_uid = 0;
acl->user_gid = 0;
}
// set fs uid/gid
if(acl->user_uid != 0) {
if(setfsuid(pw.pw_uid)) {
log_ereport(
LOG_FAILURE,
"Cannot set fsuid to uid: %u", pw.pw_uid);
}
if(setfsgid(pw.pw_gid)) {
log_ereport(
LOG_FAILURE,
"Cannot set fsgid to gid: %u", pw.pw_gid);
}
}
return 1;
}
void fs_acl_finish() {
struct passwd *pw = conf_getglobals()->Vuserpw;
if(!pw) {
log_ereport(
LOG_FAILURE,
"global configuration broken (Vuserpw is null)");
return;
}
if(setfsuid(pw->pw_uid)) {
log_ereport(
LOG_FAILURE,
"Cannot set fsuid back to server uid: %u", pw->pw_uid);
}
if(setfsgid(pw->pw_gid)) {
log_ereport(
LOG_FAILURE,
"Cannot set fsgid back to server gid: %u", pw->pw_gid);
}
}
#endif