proxmox-backup/src/auth_helpers.rs

122 lines
2.7 KiB
Rust
Raw Normal View History

use crate::tools;
use failure::*;
2019-01-29 16:21:58 +00:00
use lazy_static::lazy_static;
use openssl::rsa::{Rsa};
2019-01-29 16:21:58 +00:00
use openssl::pkey::{PKey, Public, Private};
use openssl::sha;
2019-01-29 16:21:58 +00:00
use std::path::PathBuf;
pub fn assemble_csrf_prevention_token(
secret: &[u8],
username: &str,
) -> String {
let epoch = std::time::SystemTime::now().duration_since(
std::time::SystemTime::UNIX_EPOCH).unwrap().as_secs();
let stamp = format!("{:08X}:{}:", epoch, username);
let mut hasher = sha::Sha256::new();
hasher.update(stamp.as_bytes());
hasher.update(secret);
let digest = hasher.finish();
base64::encode_config(&digest, base64::STANDARD_NO_PAD)
}
pub fn generate_csrf_key() -> Result<(), Error> {
let path = PathBuf::from("/etc/proxmox-backup/csrf.key");
if path.exists() { return Ok(()); }
let rsa = Rsa::generate(2048).unwrap();
let pem = rsa.private_key_to_pem()?;
use nix::sys::stat::Mode;
tools::file_set_contents(
&path, &pem, Some(Mode::from_bits_truncate(0o0640)))?;
nix::unistd::chown(&path, Some(nix::unistd::ROOT), Some(nix::unistd::Gid::from_raw(33)))?;
Ok(())
}
pub fn generate_auth_key() -> Result<(), Error> {
let priv_path = PathBuf::from("/etc/proxmox-backup/authkey.key");
let mut public_path = priv_path.clone();
public_path.set_extension("pub");
if priv_path.exists() && public_path.exists() { return Ok(()); }
let rsa = Rsa::generate(4096).unwrap();
let priv_pem = rsa.private_key_to_pem()?;
use nix::sys::stat::Mode;
tools::file_set_contents(
&priv_path, &priv_pem, Some(Mode::from_bits_truncate(0o0600)))?;
let public_pem = rsa.public_key_to_pem()?;
tools::file_set_contents(&public_path, &public_pem, None)?;
Ok(())
}
2019-01-29 16:21:58 +00:00
pub fn csrf_secret() -> &'static [u8] {
lazy_static! {
static ref SECRET: Vec<u8> =
tools::file_get_contents("/etc/proxmox-backup/csrf.key").unwrap();
}
&SECRET
}
fn load_private_auth_key() -> Result<PKey<Private>, Error> {
let pem = tools::file_get_contents("/etc/proxmox-backup/authkey.key")?;
let rsa = Rsa::private_key_from_pem(&pem)?;
let key = PKey::from_rsa(rsa)?;
Ok(key)
}
pub fn private_auth_key() -> &'static PKey<Private> {
lazy_static! {
static ref KEY: PKey<Private> = load_private_auth_key().unwrap();
}
&KEY
}
fn load_public_auth_key() -> Result<PKey<Public>, Error> {
let pem = tools::file_get_contents("/etc/proxmox-backup/authkey.pub")?;
let rsa = Rsa::public_key_from_pem(&pem)?;
let key = PKey::from_rsa(rsa)?;
Ok(key)
}
pub fn public_auth_key() -> &'static PKey<Public> {
lazy_static! {
static ref KEY: PKey<Public> = load_public_auth_key().unwrap();
}
&KEY
}