dmlite
0.6
|
00001 /// @file include/dmlite/cpp/utils/security.h 00002 /// @brief Security functionality shared between modules. 00003 /// @details This is not a plugin! 00004 /// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch> 00005 #ifndef DMLITE_CPP_UTILS_SECURITY_H_ 00006 #define DMLITE_CPP_UTILS_SECURITY_H_ 00007 00008 #include <stdint.h> 00009 #include <sys/stat.h> 00010 #include <string> 00011 #include <vector> 00012 #include "../authn.h" 00013 #include "../exceptions.h" 00014 00015 namespace dmlite { 00016 00017 /// Possible outputs for validateToken 00018 enum TokenResult { 00019 kTokenOK = 0, 00020 kTokenMalformed, 00021 kTokenInvalid, 00022 kTokenExpired, 00023 kTokenInvalidMode, 00024 kTokenInternalError 00025 }; 00026 00027 /// ACL Entry 00028 struct AclEntry { 00029 /// ACL Type possible values 00030 static const uint8_t kUserObj = 1; 00031 static const uint8_t kUser = 2; 00032 static const uint8_t kGroupObj = 3; 00033 static const uint8_t kGroup = 4; 00034 static const uint8_t kMask = 5; 00035 static const uint8_t kOther = 6; 00036 static const uint8_t kDefault = 0x20; 00037 00038 uint8_t type; 00039 uint8_t perm; 00040 uint32_t id; 00041 00042 // Operators 00043 bool operator == (const AclEntry&) const; 00044 bool operator != (const AclEntry&) const; 00045 bool operator < (const AclEntry&) const; 00046 bool operator > (const AclEntry&) const; 00047 }; 00048 00049 struct Acl: public std::vector<AclEntry> { 00050 public: 00051 Acl() throw (); 00052 00053 /// Creates an ACL from a string 00054 explicit Acl(const std::string&) throw (); 00055 00056 /// Creates a new ACL inheriting from parent. 00057 /// @param parent The parent's ACL vector. 00058 /// @param uid The current user uid. 00059 /// @param gid The current user gid. 00060 /// @param cmode The creation mode. 00061 /// @param fmode The current file mode. It will be modified to fit the inheritance. 00062 Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw (); 00063 00064 /// Returns the position if there is an ACL entry with the type 'type' 00065 /// -1 otherwise. 00066 int has(uint8_t type) const throw (); 00067 00068 std::string serialize(void) const throw (); 00069 void validate (void) const throw (DmException); 00070 }; 00071 00072 /// Check if the group vector contains the given gid. 00073 /// @param groups The GroupInfo vector. 00074 /// @param gid The gid to look for. 00075 /// @return true if the vector contains the given gid. false otherwise. 00076 bool hasGroup(const std::vector<GroupInfo>& groups, gid_t gid); 00077 00078 /// Check if a specific user has the demanded rights. 00079 /// @note This works using uid and gid, so it will only work with plug-ins that 00080 /// provide this metadata (as unsigned!!). 00081 /// @param context The security context. 00082 /// @param acl The Access Control list. 00083 /// @param stat A struct stat which mode will be checked. 00084 /// @param mode The mode to be checked. 00085 /// @return 0 if the mode is allowed, 1 if not. 00086 int checkPermissions(const SecurityContext* context, 00087 const Acl& acl, const struct stat& stat, 00088 mode_t mode); 00089 00090 /// Get the VO from a full DN. 00091 /// @param mapfile The file that contains the user => group mapping. 00092 /// @param dn The DN to parse. 00093 /// @return The mapped VO. 00094 std::string voFromDn(const std::string& mapfile, const std::string& dn); 00095 00096 /// Get the VO from a role. 00097 /// @param role The role. 00098 /// @return The VO. 00099 std::string voFromRole(const std::string& role); 00100 00101 /// Get the subject from the certificate. 00102 std::string getCertificateSubject(const std::string& path); 00103 00104 /// Generate a token. 00105 /// @param id A unique ID of the user. May be the DN, the IP... 00106 /// @param pfn The PFN we want a token for. 00107 /// @param passwd The password to be used. 00108 /// @param lifetime Token lifetime. 00109 /// @param write If true, this will be a token for write access. 00110 std::string generateToken(const std::string& id, const std::string& pfn, 00111 const std::string& passwd, time_t lifetime, 00112 bool write = false); 00113 00114 /// Validate a token. It must have been previously generated by generateToken. 00115 /// @param token The token to validate. 00116 /// @param id The SAME unique ID used to generate the token. 00117 /// @param pfn The that is being accessed. 00118 /// @param passwd The password that must be used to generate the token. 00119 /// @param write If true, write access will be validated. 00120 TokenResult validateToken(const std::string& token, const std::string& id, 00121 const std::string& pfn, const std::string& passwd, 00122 bool write = false); 00123 00124 }; 00125 00126 #endif // DMLITE_CPP_UTILS_SECURITY_H_