From cd4377fab21e0f500bef7f06543fa848a039c1e0 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Thu, 20 Jul 2023 06:50:01 +0200 Subject: Merging upstream version 1.41.0. Signed-off-by: Daniel Baumann --- web/api/web_api.c | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) (limited to 'web/api/web_api.c') diff --git a/web/api/web_api.c b/web/api/web_api.c index 7c1d0fa09..4372bb8cb 100644 --- a/web/api/web_api.c +++ b/web/api/web_api.c @@ -2,6 +2,35 @@ #include "web_api.h" +bool netdata_is_protected_by_bearer = false; // this is controlled by cloud, at the point the agent logs in - this should also be saved to /var/lib/netdata +DICTIONARY *netdata_authorized_bearers = NULL; + +static bool web_client_check_acl_and_bearer(struct web_client *w, WEB_CLIENT_ACL endpoint_acl) { + if(endpoint_acl == WEB_CLIENT_ACL_NOCHECK) + // the endpoint is totally public + return true; + + bool acl_allows = w->acl & endpoint_acl; + if(!acl_allows) + // the channel we received the request from (w->acl) is not compatible with the endpoint + return false; + + if(!netdata_is_protected_by_bearer && !(endpoint_acl & WEB_CLIENT_ACL_BEARER_REQUIRED)) + // bearer protection is not enabled and is not required by the endpoint + return true; + + if(!(endpoint_acl & (WEB_CLIENT_ACL_BEARER_REQUIRED|WEB_CLIENT_ACL_BEARER_OPTIONAL))) + // endpoint does not require a bearer + return true; + + if((w->acl & (WEB_CLIENT_ACL_ACLK|WEB_CLIENT_ACL_WEBRTC)) || api_check_bearer_token(w)) + // the request is coming from ACLK or WEBRTC (authorized already), + // or we have a valid bearer on the request + return true; + + return false; +} + int web_client_api_request_vX(RRDHOST *host, struct web_client *w, char *url_path_endpoint, struct web_api_command *api_commands) { if(unlikely(!url_path_endpoint || !*url_path_endpoint)) { buffer_flush(w->response.data); @@ -13,8 +42,8 @@ int web_client_api_request_vX(RRDHOST *host, struct web_client *w, char *url_pat for(int i = 0; api_commands[i].command ; i++) { if(unlikely(hash == api_commands[i].hash && !strcmp(url_path_endpoint, api_commands[i].command))) { - if(unlikely(api_commands[i].acl != WEB_CLIENT_ACL_NOCHECK) && !(w->acl & api_commands[i].acl)) - return web_client_permission_denied(w); + if(unlikely(!web_client_check_acl_and_bearer(w, api_commands[i].acl))) + return web_client_bearer_required(w); char *query_string = (char *)buffer_tostring(w->url_query_string_decoded); -- cgit v1.2.3