dmlite  0.6
security.h
Go to the documentation of this file.
1 /// @file include/dmlite/cpp/utils/security.h
2 /// @brief Security functionality shared between modules.
3 /// @details This is not a plugin!
4 /// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch>
5 #ifndef DMLITE_CPP_UTILS_SECURITY_H_
6 #define DMLITE_CPP_UTILS_SECURITY_H_
7 
8 #include <stdint.h>
9 #include <sys/stat.h>
10 #include <string>
11 #include <vector>
12 #include "../authn.h"
13 #include "../exceptions.h"
14 
15 namespace dmlite {
16  /// Generic username for a name-independent token
17  static const std::string kGenericUser = "nouser";
18 
19  /// Possible outputs for validateToken
20  enum TokenResult {
21  kTokenOK = 0,
27  };
28 
29  /// ACL Entry
30  struct AclEntry {
31  /// ACL Type possible values
32  static const uint8_t kUserObj = 1;
33  static const uint8_t kUser = 2;
34  static const uint8_t kGroupObj = 3;
35  static const uint8_t kGroup = 4;
36  static const uint8_t kMask = 5;
37  static const uint8_t kOther = 6;
38  static const uint8_t kDefault = 0x20;
39 
40  uint8_t type;
41  uint8_t perm;
42  uint32_t id;
43 
44  // Operators
45  bool operator == (const AclEntry&) const;
46  bool operator != (const AclEntry&) const;
47  bool operator < (const AclEntry&) const;
48  bool operator > (const AclEntry&) const;
49  };
50 
51  struct Acl: public std::vector<AclEntry> {
52  public:
53  Acl() throw ();
54 
55  /// Creates an ACL from a string
56  explicit Acl(const std::string&) throw ();
57 
58  /// Creates a new ACL inheriting from parent.
59  /// @param parent The parent's ACL vector.
60  /// @param uid The current user uid.
61  /// @param gid The current user gid.
62  /// @param cmode The creation mode.
63  /// @param fmode The current file mode. It will be modified to fit the inheritance.
64  Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw ();
65 
66  /// Returns the position if there is an ACL entry with the type 'type'
67  /// -1 otherwise.
68  int has(uint8_t type) const throw ();
69 
70  std::string serialize(void) const throw ();
71  void validate (void) const throw (DmException);
72  };
73 
74  /// Check if the group vector contains the given gid.
75  /// @param groups The GroupInfo vector.
76  /// @param gid The gid to look for.
77  /// @return true if the vector contains the given gid. false otherwise.
78  bool hasGroup(const std::vector<GroupInfo>& groups, gid_t gid);
79 
80  /// Check if a specific user has the demanded rights.
81  /// @note This works using uid and gid, so it will only work with plug-ins that
82  /// provide this metadata (as unsigned!!).
83  /// @param context The security context.
84  /// @param acl The Access Control list.
85  /// @param stat A struct stat which mode will be checked.
86  /// @param mode The mode to be checked.
87  /// @return 0 if the mode is allowed, 1 if not.
88  int checkPermissions(const SecurityContext* context,
89  const Acl& acl, const struct ::stat& stat,
90  mode_t mode);
91 
92  /// Get the VO from a full DN.
93  /// @param mapfile The file that contains the user => group mapping.
94  /// @param dn The DN to parse.
95  /// @return The mapped VO.
96  std::string voFromDn(const std::string& mapfile, const std::string& dn);
97 
98  /// Get the VO from a role.
99  /// @param role The role.
100  /// @return The VO.
101  std::string voFromRole(const std::string& role);
102 
103  /// Get the subject from the certificate.
104  std::string getCertificateSubject(const std::string& path);
105 
106  /// Generate a token.
107  /// @param id A unique ID of the user. May be the DN, the IP...
108  /// @param pfn The PFN we want a token for.
109  /// @param passwd The password to be used.
110  /// @param lifetime Token lifetime.
111  /// @param write If true, this will be a token for write access.
112  std::string generateToken(const std::string& id, const std::string& pfn,
113  const std::string& passwd, time_t lifetime,
114  bool write = false);
115 
116  /// Validate a token. It must have been previously generated by generateToken.
117  /// @param token The token to validate.
118  /// @param id The SAME unique ID used to generate the token.
119  /// @param pfn The that is being accessed.
120  /// @param passwd The password that must be used to generate the token.
121  /// @param write If true, write access will be validated.
122  TokenResult validateToken(const std::string& token, const std::string& id,
123  const std::string& pfn, const std::string& passwd,
124  bool write = false);
125 
126 };
127 
128 #endif // DMLITE_CPP_UTILS_SECURITY_H_
Definition: security.h:22
uint8_t type
Definition: security.h:40
std::string voFromDn(const std::string &mapfile, const std::string &dn)
bool operator>(const AclEntry &) const
uint32_t id
Definition: security.h:42
Definition: security.h:51
std::string getCertificateSubject(const std::string &path)
Get the subject from the certificate.
TokenResult validateToken(const std::string &token, const std::string &id, const std::string &pfn, const std::string &passwd, bool write=false)
static const uint8_t kUser
Definition: security.h:33
Security context. To be created by the Authn.
Definition: authn.h:64
Base exception class.
Definition: exceptions.h:17
static const uint8_t kGroupObj
Definition: security.h:34
Definition: security.h:24
void validate(void) const
bool operator<(const AclEntry &) const
Definition: security.h:23
static const uint8_t kDefault
Definition: security.h:38
static const uint8_t kOther
Definition: security.h:37
int has(uint8_t type) const
Definition: security.h:21
bool hasGroup(const std::vector< GroupInfo > &groups, gid_t gid)
std::string generateToken(const std::string &id, const std::string &pfn, const std::string &passwd, time_t lifetime, bool write=false)
Definition: security.h:26
TokenResult
Possible outputs for validateToken.
Definition: security.h:20
ACL Entry.
Definition: security.h:30
bool operator!=(const AclEntry &) const
uint8_t perm
Definition: security.h:41
std::string voFromRole(const std::string &role)
static const uint8_t kGroup
Definition: security.h:35
std::string serialize(void) const
static const uint8_t kMask
Definition: security.h:36
static const uint8_t kUserObj
ACL Type possible values.
Definition: security.h:32
int checkPermissions(const SecurityContext *context, const Acl &acl, const struct::stat &stat, mode_t mode)
Definition: security.h:25
bool operator==(const AclEntry &) const