proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-07-25 14:51:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

produce shorter spiceproxy tickets

Browse Source 
By using a simple Digest with private secret /etc/pve/pve-www.key. This is
less secure than pub key auth, but good enough for the proxy.
This commit is contained in:
Dietmar Maurer 2013-07-19 12:35:23 +02:00
parent 4cdd950757
commit 3f62bdbea6
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
PVE/AccessControl.pm
View File

@ -234,8 +234,15 @@ sub assemble_spice_ticket {
# private.
# The proxy need to be able to extract/verify the ticket
# Note: data needs to be lower case only, because virt-viewer needs that
# Note: RSA signature are too long (>=256 charaters) and makes problems with remote-viewer
my $secret = &$get_csrfr_secret();
my $plain = "pvespiceproxy:$timestamp:$vmid:$node";
my $sig = unpack("H*", $rsa_priv->sign($plain));
# produces 40 characters
my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
#my $sig = unpack("H*", $rsa_priv->sign($plain)); # this produce too long strings (512)
my $proxyticket = $plain . "::" . $sig;
@ -250,7 +257,7 @@ sub verify_spice_connect_url {
return undef if !$connect_str;
if ($connect_str =~m/^pvespiceproxy:([a-z0-9]{8}):(\d+):(\S+)::([a-z0-9]{512}):(\d+)$/) {
if ($connect_str =~m/^pvespiceproxy:([a-z0-9]{8}):(\d+):(\S+)::([a-z0-9]{40}):(\d+)$/) {
my ($timestamp, $vmid, $node, $hexsig, $port) = ($1, $2, $3, $4, $5, $6);
my $ttime = hex($timestamp);
my $age = time() - $ttime;
@ -258,13 +265,10 @@ sub verify_spice_connect_url {
# use very limited lifetime - is this enough?
return undef if !(($age > -20) && ($age < 40));
my $sig = pack("H*", $hexsig);
my $rsa_pub = get_pubkey();
my $plain = "pvespiceproxy:$timestamp:$vmid:$node";
my $sig = unpack("H*", Digest::SHA::sha1($plain, &$get_csrfr_secret()));
if ($rsa_pub->verify($plain, $sig)) {
if ($sig eq $hexsig) {
return ($vmid, $node, $port);
}
}