From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 55BF664904 for ; Wed, 30 Dec 2020 12:21:50 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 44163209CE for ; Wed, 30 Dec 2020 12:21:20 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [212.186.127.180]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS id 3B50E209C3 for ; Wed, 30 Dec 2020 12:21:19 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 0957A446A6 for ; Wed, 30 Dec 2020 12:21:19 +0100 (CET) From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= To: pbs-devel@lists.proxmox.com Date: Wed, 30 Dec 2020 12:21:13 +0100 Message-Id: <20201230112114.424764-1-f.gruenbichler@proxmox.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.024 Adjusted score from AWL reputation of From: address KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] [PATCH proxmox-backup 1/2] api: improve error messages for restricted endpoints X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Dec 2020 11:21:50 -0000 the old variant attempted to parse a tokenid as userid and returned the cryptic parsing error to the client, which is rather confusing. Signed-off-by: Fabian Grünbichler --- Notes: not sure whether this is already enough repetition to have a helper somewhere? I expect the number of such API endpoints to remain rather small.. the change_password one could even be lifted with small changes.. src/api2/access.rs | 14 +++++++++----- src/api2/node.rs | 22 ++++++++++++++++++---- 2 files changed, 27 insertions(+), 9 deletions(-) diff --git a/src/api2/access.rs b/src/api2/access.rs index 2f7fb6ec..22d6ebd2 100644 --- a/src/api2/access.rs +++ b/src/api2/access.rs @@ -206,14 +206,18 @@ fn change_password( password: String, rpcenv: &mut dyn RpcEnvironment, ) -> Result { - - let current_user: Userid = rpcenv + let current_auth: Authid = rpcenv .get_auth_id() - .ok_or_else(|| format_err!("unknown user"))? + .ok_or_else(|| format_err!("no authid available"))? .parse()?; - let current_auth = Authid::from(current_user.clone()); - let mut allowed = userid == current_user; + if current_auth.is_token() { + bail!("API tokens cannot access this API endpoint"); + } + + let current_user = current_auth.user(); + + let mut allowed = userid == *current_user; if current_user == "root@pam" { allowed = true; } diff --git a/src/api2/node.rs b/src/api2/node.rs index dcde83df..b1a25e0e 100644 --- a/src/api2/node.rs +++ b/src/api2/node.rs @@ -92,11 +92,16 @@ async fn termproxy( rpcenv: &mut dyn RpcEnvironment, ) -> Result { // intentionally user only for now - let userid: Userid = rpcenv + let auth_id: Authid = rpcenv .get_auth_id() - .ok_or_else(|| format_err!("unknown user"))? + .ok_or_else(|| format_err!("no authid available"))? .parse()?; - let auth_id = Authid::from(userid.clone()); + + if auth_id.is_token() { + bail!("API tokens cannot access this API endpoint"); + } + + let userid = auth_id.user(); if userid.realm() != "pam" { bail!("only pam users can use the console"); @@ -267,7 +272,16 @@ fn upgrade_to_websocket( ) -> ApiResponseFuture { async move { // intentionally user only for now - let userid: Userid = rpcenv.get_auth_id().unwrap().parse()?; + let auth_id: Authid = rpcenv + .get_auth_id() + .ok_or_else(|| format_err!("no authid available"))? + .parse()?; + + if auth_id.is_token() { + bail!("API tokens cannot access this API endpoint"); + } + + let userid = auth_id.user(); let ticket = tools::required_string_param(¶m, "vncticket")?; let port: u16 = tools::required_integer_param(¶m, "port")? as u16; -- 2.20.1