blob: fe21a458d0a4934c324b712b8dde559ea8d32609 [file] [log] [blame]
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +01001/*
2 * User authentication & authorization
3 *
4 * Copyright 2010 Krzysztof Piotr Oledzki <ole@ans.pl>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
Willy Tarreaue5733232019-05-22 19:24:06 +020013#ifdef USE_LIBCRYPT
Willy Tarreau890a33e2010-03-04 19:10:14 +010014/* This is to have crypt() defined on Linux */
15#define _GNU_SOURCE
16
Willy Tarreaue5733232019-05-22 19:24:06 +020017#ifdef USE_CRYPT_H
Willy Tarreau890a33e2010-03-04 19:10:14 +010018/* some platforms such as Solaris need this */
19#include <crypt.h>
20#endif
Willy Tarreaue5733232019-05-22 19:24:06 +020021#endif /* USE_LIBCRYPT */
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010022
23#include <stdio.h>
24#include <stdlib.h>
25#include <string.h>
26#include <unistd.h>
27
Willy Tarreauac13aea2020-06-04 10:36:03 +020028#include <haproxy/auth-t.h>
Willy Tarreau4c7e4b72020-05-27 12:58:42 +020029#include <haproxy/api.h>
Willy Tarreauf268ee82020-06-04 17:05:57 +020030#include <haproxy/global.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020031#include <haproxy/errors.h>
Willy Tarreau225a90a2020-06-04 15:06:28 +020032#include <haproxy/pattern-t.h>
Willy Tarreau3f567e42020-05-28 15:29:19 +020033#include <haproxy/thread.h>
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010034
35#include <proto/acl.h>
36#include <proto/log.h>
37
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010038struct userlist *userlist = NULL; /* list of all existing userlists */
39
Willy Tarreaue5733232019-05-22 19:24:06 +020040#ifdef USE_LIBCRYPT
Willy Tarreau943e7ec2018-10-29 19:16:27 +010041#ifdef HA_HAVE_CRYPT_R
42/* context for crypt_r() */
43static THREAD_LOCAL struct crypt_data crypt_data = { .initialized = 0 };
44#else
45/* lock for crypt() */
Willy Tarreauaf613e82020-06-05 08:40:51 +020046__decl_thread(static HA_SPINLOCK_T auth_lock);
Willy Tarreau34d4b522018-10-29 18:02:54 +010047#endif
Willy Tarreau943e7ec2018-10-29 19:16:27 +010048#endif
Willy Tarreau34d4b522018-10-29 18:02:54 +010049
David Carlier6c00eba2019-09-01 14:59:10 +010050/* find targets for selected groups. The function returns pointer to
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010051 * the userlist struct ot NULL if name is NULL/empty or unresolvable.
52 */
53
54struct userlist *
55auth_find_userlist(char *name)
56{
57 struct userlist *l;
58
59 if (!name || !*name)
60 return NULL;
61
62 for (l = userlist; l; l = l->next)
63 if (!strcmp(l->name, name))
64 return l;
65
66 return NULL;
67}
68
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010069int check_group(struct userlist *ul, char *name)
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010070{
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010071 struct auth_groups *ag;
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010072
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010073 for (ag = ul->groups; ag; ag = ag->next)
74 if (strcmp(name, ag->name) == 0)
75 return 1;
76 return 0;
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010077}
78
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010079void
80userlist_free(struct userlist *ul)
81{
82 struct userlist *tul;
83 struct auth_users *au, *tau;
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010084 struct auth_groups_list *agl, *tagl;
85 struct auth_groups *ag, *tag;
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010086
87 while (ul) {
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010088 /* Free users. */
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010089 au = ul->users;
90 while (au) {
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +010091 /* Free groups that own current user. */
92 agl = au->u.groups;
93 while (agl) {
94 tagl = agl;
95 agl = agl->next;
96 free(tagl);
97 }
98
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +010099 tau = au;
100 au = au->next;
101 free(tau->user);
102 free(tau->pass);
103 free(tau);
104 }
105
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100106 /* Free grouplist. */
107 ag = ul->groups;
108 while (ag) {
109 tag = ag;
110 ag = ag->next;
111 free(tag->name);
112 free(tag);
113 }
114
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100115 tul = ul;
116 ul = ul->next;
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100117 free(tul->name);
118 free(tul);
119 };
120}
121
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100122int userlist_postinit()
123{
124 struct userlist *curuserlist = NULL;
125
126 /* Resolve usernames and groupnames. */
127 for (curuserlist = userlist; curuserlist; curuserlist = curuserlist->next) {
128 struct auth_groups *ag;
129 struct auth_users *curuser;
130 struct auth_groups_list *grl;
131
132 for (curuser = curuserlist->users; curuser; curuser = curuser->next) {
133 char *group = NULL;
134 struct auth_groups_list *groups = NULL;
135
136 if (!curuser->u.groups_names)
137 continue;
138
139 while ((group = strtok(group?NULL:curuser->u.groups_names, ","))) {
140 for (ag = curuserlist->groups; ag; ag = ag->next) {
141 if (!strcmp(ag->name, group))
142 break;
143 }
144
145 if (!ag) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100146 ha_alert("userlist '%s': no such group '%s' specified in user '%s'\n",
147 curuserlist->name, group, curuser->user);
Dirkjan Bussink07fcaaa2014-04-28 22:57:16 +0000148 free(groups);
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100149 return ERR_ALERT | ERR_FATAL;
150 }
151
152 /* Add this group at the group userlist. */
153 grl = calloc(1, sizeof(*grl));
154 if (!grl) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100155 ha_alert("userlist '%s': no more memory when trying to allocate the user groups.\n",
156 curuserlist->name);
Dirkjan Bussink07fcaaa2014-04-28 22:57:16 +0000157 free(groups);
158 return ERR_ALERT | ERR_FATAL;
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100159 }
160
161 grl->group = ag;
162 grl->next = groups;
163 groups = grl;
164 }
165
166 free(curuser->u.groups);
167 curuser->u.groups = groups;
168 }
169
170 for (ag = curuserlist->groups; ag; ag = ag->next) {
171 char *user = NULL;
172
173 if (!ag->groupusers)
174 continue;
175
176 while ((user = strtok(user?NULL:ag->groupusers, ","))) {
177 for (curuser = curuserlist->users; curuser; curuser = curuser->next) {
178 if (!strcmp(curuser->user, user))
179 break;
180 }
181
182 if (!curuser) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100183 ha_alert("userlist '%s': no such user '%s' specified in group '%s'\n",
184 curuserlist->name, user, ag->name);
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100185 return ERR_ALERT | ERR_FATAL;
186 }
187
188 /* Add this group at the group userlist. */
189 grl = calloc(1, sizeof(*grl));
190 if (!grl) {
Christopher Faulet767a84b2017-11-24 16:50:31 +0100191 ha_alert("userlist '%s': no more memory when trying to allocate the user groups.\n",
192 curuserlist->name);
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100193 return ERR_ALERT | ERR_FATAL;
194 }
195
196 grl->group = ag;
197 grl->next = curuser->u.groups;
198 curuser->u.groups = grl;
199 }
200
201 free(ag->groupusers);
202 ag->groupusers = NULL;
203 }
204
205#ifdef DEBUG_AUTH
206 for (ag = curuserlist->groups; ag; ag = ag->next) {
207 struct auth_groups_list *agl;
208
209 fprintf(stderr, "group %s, id %p, users:", ag->name, ag);
210 for (curuser = curuserlist->users; curuser; curuser = curuser->next) {
211 for (agl = curuser->u.groups; agl; agl = agl->next) {
212 if (agl->group == ag)
213 fprintf(stderr, " %s", curuser->user);
214 }
215 }
216 fprintf(stderr, "\n");
217 }
218#endif
219 }
220
221 return ERR_NONE;
222}
223
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100224/*
225 * Authenticate and authorize user; return 1 if OK, 0 if case of error.
226 */
227int
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100228check_user(struct userlist *ul, const char *user, const char *pass)
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100229{
230
231 struct auth_users *u;
CJ Ess6eac32e2015-05-02 16:35:24 -0400232#ifdef DEBUG_AUTH
233 struct auth_groups_list *agl;
234#endif
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100235 const char *ep;
236
237#ifdef DEBUG_AUTH
CJ Ess6eac32e2015-05-02 16:35:24 -0400238 fprintf(stderr, "req: userlist=%s, user=%s, pass=%s\n",
239 ul->name, user, pass);
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100240#endif
241
242 for (u = ul->users; u; u = u->next)
243 if (!strcmp(user, u->user))
244 break;
245
246 if (!u)
247 return 0;
248
249#ifdef DEBUG_AUTH
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100250 fprintf(stderr, "cfg: user=%s, pass=%s, flags=%X, groups=",
251 u->user, u->pass, u->flags);
252 for (agl = u->u.groups; agl; agl = agl->next)
253 fprintf(stderr, " %s", agl->group->name);
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100254#endif
255
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100256 if (!(u->flags & AU_O_INSECURE)) {
Willy Tarreaue5733232019-05-22 19:24:06 +0200257#ifdef USE_LIBCRYPT
Willy Tarreau943e7ec2018-10-29 19:16:27 +0100258#ifdef HA_HAVE_CRYPT_R
259 ep = crypt_r(pass, u->pass, &crypt_data);
260#else
Willy Tarreau34d4b522018-10-29 18:02:54 +0100261 HA_SPIN_LOCK(AUTH_LOCK, &auth_lock);
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100262 ep = crypt(pass, u->pass);
Willy Tarreau34d4b522018-10-29 18:02:54 +0100263 HA_SPIN_UNLOCK(AUTH_LOCK, &auth_lock);
Willy Tarreau943e7ec2018-10-29 19:16:27 +0100264#endif
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100265#else
266 return 0;
267#endif
268 } else
269 ep = pass;
270
271#ifdef DEBUG_AUTH
272 fprintf(stderr, ", crypt=%s\n", ep);
273#endif
274
Cyril Bontéc82279c2014-08-29 20:20:01 +0200275 if (ep && strcmp(ep, u->pass) == 0)
Krzysztof Piotr Oledzki96105042010-01-29 17:50:44 +0100276 return 1;
277 else
278 return 0;
279}
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100280
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100281struct pattern *
282pat_match_auth(struct sample *smp, struct pattern_expr *expr, int fill)
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100283{
Willy Tarreau37406352012-04-23 16:16:37 +0200284 struct userlist *ul = smp->ctx.a[0];
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100285 struct pattern_list *lst;
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100286 struct auth_users *u;
287 struct auth_groups_list *agl;
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100288 struct pattern *pattern;
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100289
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100290 /* Check if the userlist is present in the context data. */
291 if (!ul)
Willy Tarreau86e0fc12014-04-29 19:52:16 +0200292 return NULL;
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100293
294 /* Browse the userlist for searching user. */
295 for (u = ul->users; u; u = u->next) {
Willy Tarreau843b7cb2018-07-13 10:54:26 +0200296 if (strcmp(smp->data.u.str.area, u->user) == 0)
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100297 break;
298 }
299 if (!u)
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100300 return NULL;
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100301
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100302 /* Browse each pattern. */
303 list_for_each_entry(lst, &expr->patterns, list) {
304 pattern = &lst->pat;
305
306 /* Browse each group for searching group name that match the pattern. */
307 for (agl = u->u.groups; agl; agl = agl->next) {
308 if (strcmp(agl->group->name, pattern->ptr.str) == 0)
309 return pattern;
310 }
Thierry FOURNIER9eec0a62014-01-22 18:38:02 +0100311 }
Thierry FOURNIER5338eea2013-12-16 14:22:13 +0100312 return NULL;
Krzysztof Piotr Oledzkif9423ae2010-01-29 19:26:18 +0100313}
Willy Tarreaue8692b42016-12-21 19:36:25 +0100314
Willy Tarreau80713382018-11-26 10:19:54 +0100315REGISTER_BUILD_OPTS("Encrypted password support via crypt(3): yes");