proxmox-mirrors/proxmox
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox synced 2025-06-23 14:57:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

access-control: use ConfigDigest for digests

Browse Source 
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
This commit is contained in:
Wolfgang Bumiller 2024-07-04 14:31:24 +02:00
parent 3545d67b1f
commit e8b5ad6b45
3 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
proxmox-access-control/Cargo.toml
View File

@ -18,10 +18,11 @@ serde.workspace = true
serde_json = { workspace = true, optional = true } serde_json = { workspace = true, optional = true }
proxmox-auth-api = { workspace = true, features = [ "api-types" ] } proxmox-auth-api = { workspace = true, features = [ "api-types" ] }
proxmox-config-digest = { workspace = true, optional = true, features = [ "openssl" ] }
proxmox-product-config = { workspace = true, optional = true }
proxmox-router = { workspace = true, optional = true } proxmox-router = { workspace = true, optional = true }
proxmox-schema.workspace = true proxmox-schema.workspace = true
proxmox-section-config = { workspace = true, optional = true } proxmox-section-config = { workspace = true, optional = true }
proxmox-product-config = { workspace = true, optional = true }
proxmox-shared-memory = { workspace = true, optional = true } proxmox-shared-memory = { workspace = true, optional = true }
proxmox-sys = { workspace = true, features = [ "crypt" ], optional = true } proxmox-sys = { workspace = true, features = [ "crypt" ], optional = true }
proxmox-time = { workspace = true } proxmox-time = { workspace = true }
@ -31,6 +32,7 @@ default = []
impl = [ impl = [
"dep:nix", "dep:nix",
"dep:openssl", "dep:openssl",
"dep:proxmox-config-digest",
"dep:proxmox-product-config", "dep:proxmox-product-config",
"dep:proxmox-router", "dep:proxmox-router",
"dep:proxmox-section-config", "dep:proxmox-section-config",

7
proxmox-access-control/src/acl.rs
View File

@ -6,6 +6,7 @@ use std::sync::{Arc, OnceLock, RwLock};
use anyhow::{bail, Error}; use anyhow::{bail, Error};
use proxmox_auth_api::types::{Authid, Userid}; use proxmox_auth_api::types::{Authid, Userid};
use proxmox_config_digest::ConfigDigest;
use proxmox_product_config::{open_api_lockfile, replace_privileged_config, ApiLockGuard}; use proxmox_product_config::{open_api_lockfile, replace_privileged_config, ApiLockGuard};
use crate::init::{access_conf, acl_config, acl_config_lock}; use crate::init::{access_conf, acl_config, acl_config_lock};
@ -455,7 +456,7 @@ impl AclTree {
Ok(()) Ok(())
} }
fn load(filename: &Path) -> Result<(Self, [u8; 32]), Error> { fn load(filename: &Path) -> Result<(Self, ConfigDigest), Error> {
let mut tree = Self::new(); let mut tree = Self::new();
let raw = match std::fs::read_to_string(filename) { let raw = match std::fs::read_to_string(filename) {
@ -469,7 +470,7 @@ impl AclTree {
} }
}; };
let digest = openssl::sha::sha256(raw.as_bytes()); let digest = ConfigDigest::from_slice(raw.as_bytes());
for (linenr, line) in raw.lines().enumerate() { for (linenr, line) in raw.lines().enumerate() {
let line = line.trim(); let line = line.trim();
@ -564,7 +565,7 @@ pub fn lock_config() -> Result<ApiLockGuard, Error> {
} }
/// Reads the [`AclTree`] from the [default path](ACL_CFG_FILENAME). /// Reads the [`AclTree`] from the [default path](ACL_CFG_FILENAME).
pub fn config() -> Result<(AclTree, [u8; 32]), Error> { pub fn config() -> Result<(AclTree, ConfigDigest), Error> {
let path = acl_config(); let path = acl_config();
AclTree::load(&path) AclTree::load(&path)
} }

5
proxmox-access-control/src/user.rs
View File

@ -4,6 +4,7 @@ use std::sync::{Arc, OnceLock, RwLock};
use anyhow::{bail, Error}; use anyhow::{bail, Error};
use proxmox_auth_api::types::Authid; use proxmox_auth_api::types::Authid;
use proxmox_config_digest::ConfigDigest;
use proxmox_product_config::{open_api_lockfile, replace_privileged_config, ApiLockGuard}; use proxmox_product_config::{open_api_lockfile, replace_privileged_config, ApiLockGuard};
use proxmox_schema::*; use proxmox_schema::*;
use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin}; use proxmox_section_config::{SectionConfig, SectionConfigData, SectionConfigPlugin};
@ -44,10 +45,10 @@ pub fn lock_config() -> Result<ApiLockGuard, Error> {
open_api_lockfile(user_config_lock(), None, true) open_api_lockfile(user_config_lock(), None, true)
} }
pub fn config() -> Result<(SectionConfigData, [u8; 32]), Error> { pub fn config() -> Result<(SectionConfigData, ConfigDigest), Error> {
let content = proxmox_sys::fs::file_read_optional_string(user_config())?.unwrap_or_default(); let content = proxmox_sys::fs::file_read_optional_string(user_config())?.unwrap_or_default();
let digest = openssl::sha::sha256(content.as_bytes()); let digest = ConfigDigest::from_slice(content.as_bytes());
let data = get_or_init_config().parse(user_config(), &content)?; let data = get_or_init_config().parse(user_config(), &content)?;
Ok((data, digest)) Ok((data, digest))