proxmox-mirrors/pve-access-control
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-access-control synced 2025-07-15 03:28:06 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

partially fix #2825: authkey: rotate if it was generated in the future

Browse Source 
Can happen if the RTC is in the future during installation and first
boot, when during key generation the clock is in the future and then,
after the key was already generated, jumps back in time.

Allow a fuzz of $auth_graceperiod, which is currently 5 minutes, as
that fuzz allows some minor, not really problematic, time sync
disparity in clusters.

If an old authkey exists, meaning we rotated at least once, check it's
time too. Only rotate if it'd not be valid for any tickets in the
cluster anymore, i.e., if it difference between the current key is >
$ticket_lifetime (2 hours)..

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht 2020-07-03 11:06:55 +02:00
parent 8304b226d6
commit 9de25de807
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
PVE/AccessControl.pm
View File

@ -149,9 +149,22 @@ sub check_authkey {
warn "auth key pair missing, generating new one..\n" if !$quiet; warn "auth key pair missing, generating new one..\n" if !$quiet;
return 0; return 0;
} else { } else {
if (time() - $mtime >= $authkey_lifetime) { my $now = time();
if ($now - $mtime >= $authkey_lifetime) {
warn "auth key pair too old, rotating..\n" if !$quiet;; warn "auth key pair too old, rotating..\n" if !$quiet;;
return 0; return 0;
} elsif ($mtime > $now + $auth_graceperiod) {
# a nodes RTC had a time set in the future during key generation -> ticket
# validity is clamped to 0+5 min grace period until now >= mtime again
my (undef, $old_mtime) = get_pubkey(1);
if ($old_mtime && $mtime >= $old_mtime && $mtime - $old_mtime < $ticket_lifetime) {
warn "auth key pair generated in the future (key $mtime > host $now),"
." but old key still exists and in valid grace period so avoid automatic"
." fixup. Cluster time not in sync?\n" if !$quiet;
return 1;
}
warn "auth key pair generated in the future (key $mtime > host $now), rotating..\n" if !$quiet;
return 0;
} else { } else {
warn "auth key new enough, skipping rotation\n" if !$quiet;; warn "auth key new enough, skipping rotation\n" if !$quiet;;
return 1; return 1;