miniroon

Simplistic macaroon-based authorization for Unix systems
git clone https://ccx.te2000.cz/git/miniroon
Log | Files | Refs

commit 60464b225c3cf2c92e46bdd1e6ef4c07b0cb7a7c
parent c9239415b7aa969f1ac5bcd8e46636718d997118
Author: Jan Pobrislo <ccx@te2000.cz>
Date:   Fri,  6 Dec 2024 04:57:59 +0000

Automatic dependency generator, split some functions into separate modules

Diffstat:
Acodedeps.awk | 56++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Mgenhash | 5+++--
Msrc/Makefile | 26++++++++++++++++++++------
Msrc/bytebuffer.h | 3+++
Msrc/caveats.h | 3+++
Msrc/caveats_impl.h | 3+++
Msrc/cmd_verify.c | 46++--------------------------------------------
Asrc/common.h | 8++++++++
Msrc/envmap.h | 3+++
Msrc/header.h | 7+++++--
Msrc/hmac_sha2_256.h | 3+++
Msrc/miniroon_caveat_name_perfhash.h | 2++
Asrc/miniroon_data.c | 7+++++++
Asrc/miniroon_data.h | 21+++++++++++++++++++++
Msrc/netstring.h | 3+++
Asrc/secret.c | 37+++++++++++++++++++++++++++++++++++++
Asrc/secret.h | 11+++++++++++
Msrc/verify_common.h | 4++--
18 files changed, 192 insertions(+), 56 deletions(-)

diff --git a/codedeps.awk b/codedeps.awk @@ -0,0 +1,56 @@ +BEGIN { + if(length(target) == 0 || length(srcname) == 0) { + exit 2 + } +} + +/^#/ && $3 !~ /^"[<\/]/ { + inc[$3]=1 +} + +/^\/\/ \{IMP\} /{ + imp[substr($0,10)] +} + +function depname(s) { + sub(/"$/, "", s) + sub(/^"/, "", s) + return s +} + +function deparray(fname) { + gsub(/[^a-zA-Z0-9_]/, "__", fname) + return "LINKDEP_" fname +} + +function objfile(fname) { + sub(/\.c$/, ".o", fname) + return "build/" fname +} + +END { + da = deparray(srcname) + printf "ifndef %s\n\n", da + printf "%s:", target + for(f in inc) { + printf " %s", depname(f) + } + printf "\n\n" + printf "%s:=%s\n", deparray(srcname), objfile(srcname) + append = 0 + for(f in imp){ + if(f == srcname) { + continue + } + printf "include build/%s.deps.mk\n", f + append = 1 + } + if(append) { + printf "%s+= $(sort ", da + for(f in imp){ + printf " $(%s)", deparray(f) + } + printf ")\n" + } + printf "\nendif\n" +} diff --git a/genhash b/genhash @@ -1,7 +1,8 @@ #!/bin/sh -xe base=$1 shift -exec triehash --multi-byte=0 --code="${base}.c" --header="${base}.h" \ +triehash --multi-byte=0 --code="${base}.c" --header="${base}.h" \ --enum-name="${base}_key" \ --function-name="${base}_hash" \ - "$@" + "$@" && +printf '\n// {IMP} %s\n' "$base.c" >>"$base.h" diff --git a/src/Makefile b/src/Makefile @@ -7,11 +7,18 @@ build/miniroon-$(1): $$(patsubst %,build/%,$$(obj_$(1))) ../link ../link -o '$$@' $$(patsubst %,build/%,$$(obj_$(1))) endef -obj_read:=cmd_read.o bytebuffer.o netstring.o header.o -$(eval $(call miniroon_link,read)) +define miniroon_autolink = +miniroon_tool_names+=$(1) +include build/cmd_$(1).c.deps.mk +build/miniroon-$(1): $$(LINKDEP_cmd_$(1)__c) ../link build/cmd_$(1).c.deps.mk + ../link -o '$$@' $$(LINKDEP_cmd_$(1)__c) +endef + +#obj_read:=cmd_read.o bytebuffer.o netstring.o header.o +$(eval $(call miniroon_autolink,read)) -obj_verify:=cmd_verify.o bytebuffer.o netstring.o hmac_sha2_256.o header.o envmap.o caveats.o miniroon_caveat_name_perfhash.o caveat_env_is.o caveat_env_absent.o caveat_env_fnmatch.o -$(eval $(call miniroon_link,verify)) +#obj_verify:=cmd_verify.o bytebuffer.o netstring.o hmac_sha2_256.o header.o envmap.o caveats.o miniroon_caveat_name_perfhash.o caveat_env_is.o caveat_env_absent.o caveat_env_fnmatch.o +$(eval $(call miniroon_autolink,verify)) tools:=$(patsubst %,build/miniroon-%,$(miniroon_tool_names)) tools: $(tools) @@ -24,8 +31,15 @@ clean: rm -r $(tools) build .PHONY: clean -build/%.o: %.c ../cc build/.exists - ../cc -c -o '$@' '$*.c' +build/%.c.i: %.c ../cc build/.exists + ../cc -E -C -o '$@' '$*.c' + +build/%.o: build/%.c.i ../cc + ../cc -fpreprocessed -c -o '$@' 'build/$*.c.i' + +build/%.c.deps.mk: build/%.c.i ../codedeps.awk + awk -v srcname='$*.c' -v target='build/$*.c.i' -f ../codedeps.awk 'build/$*.c.i' >'$@.new' + mv '$@.new' '$@' %/.exists: mkdir -p '$*' diff --git a/src/bytebuffer.h b/src/bytebuffer.h @@ -1,6 +1,9 @@ #ifndef MINIROON_BYTEBUFFER_H #define MINIROON_BYTEBUFFER_H +// implementation: +// {IMP} bytebuffer.c + #include <stddef.h> typedef struct bytebuffer_s { diff --git a/src/caveats.h b/src/caveats.h @@ -1,6 +1,9 @@ #ifndef MINIROON_CAVEATS_H #define MINIROON_CAVEATS_H +// implementation: +// {IMP} caveats.c + #include "envmap.h" typedef struct miniroon_caveats_state_s { diff --git a/src/caveats_impl.h b/src/caveats_impl.h @@ -4,12 +4,15 @@ #include "caveats.h" #include "netstring.h" +// {IMP} caveat_env_is.c void miniroon_caveat_prepare_env_is(netstring_chunk *c, miniroon_caveats_state *state); void miniroon_caveat_validate_env_is(netstring_chunk *c, miniroon_caveats_state *state); +// {IMP} caveat_env_absent.c void miniroon_caveat_prepare_env_absent(netstring_chunk *c, miniroon_caveats_state *state); void miniroon_caveat_validate_env_absent(netstring_chunk *c, miniroon_caveats_state *state); +// {IMP} caveat_env_fnmatch.c void miniroon_caveat_prepare_env_fnmatch(netstring_chunk *c, miniroon_caveats_state *state); void miniroon_caveat_validate_env_fnmatch(netstring_chunk *c, miniroon_caveats_state *state); diff --git a/src/cmd_verify.c b/src/cmd_verify.c @@ -22,58 +22,16 @@ #include "hmac_sha2_256.h" #include "header.h" #include "caveats.h" - -typedef struct miniroon_data_s { - miniroon_header hdr; - bytebuffer caveats[MAX_CAVEATS]; - size_t caveat_count; -} miniroon_data; +#include "miniroon_data.h" +#include "secret.h" /* declarations */ -void miniroon_data_init(miniroon_data *data); void process_payload(const bytebuffer payload); void validate_and_exec(miniroon_data *data); -void read_secret(const bytebuffer secret); - -#define MINIROON_HMAC_SIZE 32 -//#define MINIROON_HMAC_FUNC(key, msg, out) hmac_b2s_256(key, msg, out) -#define MINIROON_HMAC_FUNC(key, msg, out) hmac_sha2_256(key, msg, out) /* definitions */ -void miniroon_data_init(miniroon_data *data) { - memset(data, 0, sizeof(miniroon_data)); - // data->env_modif = STRALLOC_ZERO ; -} - -void read_secret(const bytebuffer secret){ - assert(secret.len == MINIROON_HMAC_SIZE); - size_t bytes_read = 0; - int secret_fd = openc_readb("secret"); - if (secret_fd < 0) { - strerr_dief1sys(111, "open(secret)"); - } - while(bytes_read < secret.len) { - ssize_t r = read(secret_fd, &secret.data[bytes_read], secret.len - bytes_read); - switch(r) { - case 0: - strerr_dief1x(111, "EOF before full secret was read"); - break; - case -1: - if(errno != EINTR) { - strerr_dief1sys(111, "read() length"); - } - break; - } - bytes_read += r; - } - if(close(secret_fd) != 0) { - strerr_dief1sys(111, "close(secret_fd)"); - } -} - - void validate_and_exec(miniroon_data *md) { miniroon_caveats_state state; miniroon_caveats_state_init(&state); diff --git a/src/common.h b/src/common.h @@ -0,0 +1,8 @@ +#ifndef MINIROON_COMMON_H +#define MINIROON_COMMON_H + +#define MINIROON_HMAC_SIZE 32 +//#define MINIROON_HMAC_FUNC(key, msg, out) hmac_b2s_256(key, msg, out) +#define MINIROON_HMAC_FUNC(key, msg, out) hmac_sha2_256(key, msg, out) + +#endif diff --git a/src/envmap.h b/src/envmap.h @@ -1,6 +1,9 @@ #ifndef MINIROON_ENVMAP_H #define MINIROON_ENVMAP_H +// implementation: +// {IMP} envmap.c + #include "bytebuffer.h" #define MAX_ENV_ALLOW 256 diff --git a/src/header.h b/src/header.h @@ -1,5 +1,8 @@ -#ifndef MINIROON_MINIROON_HEADER_H -#define MINIROON_MINIROON_HEADER_H +#ifndef MINIROON_HEADER_H +#define MINIROON_HEADER_H + +// implementation: +// {IMP} header.c #include "bytebuffer.h" diff --git a/src/hmac_sha2_256.h b/src/hmac_sha2_256.h @@ -1,6 +1,9 @@ #ifndef MINIROON_HMAC_SHA2_256_H #define MINIROON_HMAC_SHA2_256_H +// implementation: +// {IMP} hmac_sha2_256.c + #include "bytebuffer.h" void hmac_sha2_256(const bytebuffer key, const bytebuffer msg, const bytebuffer output); diff --git a/src/miniroon_caveat_name_perfhash.h b/src/miniroon_caveat_name_perfhash.h @@ -11,3 +11,5 @@ enum miniroon_caveat_name_perfhash_key { }; enum miniroon_caveat_name_perfhash_key miniroon_caveat_name_perfhash_hash(const char *string, size_t length); #endif /* TRIE_HASH_miniroon_caveat_name_perfhash_hash */ + +// {IMP} miniroon_caveat_name_perfhash.c diff --git a/src/miniroon_data.c b/src/miniroon_data.c @@ -0,0 +1,7 @@ +#include <string.h> + +#include "miniroon_data.h" + +void miniroon_data_init(miniroon_data *data) { + memset(data, 0, sizeof(miniroon_data)); +} diff --git a/src/miniroon_data.h b/src/miniroon_data.h @@ -0,0 +1,21 @@ +#ifndef MINIROON_MINIROON_DATA_H +#define MINIROON_MINIROON_DATA_H + +// implementation: +// {IMP} miniroon_data.c + +#include "bytebuffer.h" +#include "header.h" +#include "caveats.h" + +#define MAX_CAVEATS 256 + +typedef struct miniroon_data_s { + miniroon_header hdr; + bytebuffer caveats[MAX_CAVEATS]; + size_t caveat_count; +} miniroon_data; + +void miniroon_data_init(miniroon_data *data); + +#endif diff --git a/src/netstring.h b/src/netstring.h @@ -1,6 +1,9 @@ #ifndef MINIROON_NETSTRING_H #define MINIROON_NETSTRING_H +// implementation: +// {IMP} netstring.c + #include <stdbool.h> #include "bytebuffer.h" diff --git a/src/secret.c b/src/secret.c @@ -0,0 +1,37 @@ +#include <assert.h> +#include <unistd.h> +#include <errno.h> + +#include <skalibs/djbunix.h> +#include <skalibs/strerr.h> + +#include "secret.h" +#include "common.h" + +void read_secret(const bytebuffer secret){ + assert(secret.len == MINIROON_HMAC_SIZE); + size_t bytes_read = 0; + int secret_fd = openc_readb("secret"); + if (secret_fd < 0) { + strerr_dief1sys(111, "open(secret)"); + } + while(bytes_read < secret.len) { + ssize_t r = read(secret_fd, &secret.data[bytes_read], secret.len - bytes_read); + switch(r) { + case 0: + strerr_dief1x(111, "EOF before full secret was read"); + break; + case -1: + if(errno != EINTR) { + strerr_dief1sys(111, "read() length"); + } + break; + } + bytes_read += r; + } + if(close(secret_fd) != 0) { + strerr_dief1sys(111, "close(secret_fd)"); + } +} + + diff --git a/src/secret.h b/src/secret.h @@ -0,0 +1,11 @@ +#ifndef MINIROON_SECRET_H +#define MINIROON_SECRET_H + +// implementation: +// {IMP} secret.c + +#include "bytebuffer.h" + +void read_secret(const bytebuffer secret); + +#endif diff --git a/src/verify_common.h b/src/verify_common.h @@ -1,6 +1,8 @@ #ifndef MINIROON_VERIFY_COMMON_H #define MINIROON_VERIFY_COMMON_H +#include "common.h" + #ifdef PROG #error PROG already defined #endif /* PROG */ @@ -10,6 +12,4 @@ #define USAGE "miniroon-verify macaroon-fd macaroon-length" #define PROG "miniroon-verify" -#define MAX_CAVEATS 256 - #endif