dmlite 0.6
security.h
Go to the documentation of this file.
1/// @file include/dmlite/cpp/utils/security.h
2/// @brief Security functionality shared between modules.
3/// @details This is not a plugin!
4/// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch>
5#ifndef DMLITE_CPP_UTILS_SECURITY_H_
6#define DMLITE_CPP_UTILS_SECURITY_H_
7
8#include <stdint.h>
9#include <sys/stat.h>
10#include <string>
11#include <vector>
12#include "../authn.h"
13#include "../exceptions.h"
14
15namespace dmlite {
16 /// Generic username for a name-independent token
17 static const std::string kGenericUser = "nouser";
18
19 /// Possible outputs for validateToken
27 };
28
29 /// ACL Entry
30 class AclEntry {
31 public:
32 /// ACL Type possible values
33 static const uint8_t kUserObj = 1;
34 static const uint8_t kUser = 2;
35 static const uint8_t kGroupObj = 3;
36 static const uint8_t kGroup = 4;
37 static const uint8_t kMask = 5;
38 static const uint8_t kOther = 6;
39 static const uint8_t kDefault = 0x20;
40
41 uint8_t type;
42 uint8_t perm;
43 uint32_t id;
44
45 // Operators
46 bool operator == (const AclEntry&) const;
47 bool operator != (const AclEntry&) const;
48 bool operator < (const AclEntry&) const;
49 bool operator > (const AclEntry&) const;
50 };
51
52 class Acl: public std::vector<AclEntry> {
53 public:
54 Acl() throw ();
55
56 /// Creates an ACL from a string
57 explicit Acl(const std::string&) throw ();
58
59 /// Creates a new ACL inheriting from parent.
60 /// @param parent The parent's ACL vector.
61 /// @param uid The current user uid.
62 /// @param gid The current user gid.
63 /// @param cmode The creation mode.
64 /// @param fmode The current file mode. It will be modified to fit the inheritance.
65 Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw ();
66
67 /// Returns the position if there is an ACL entry with the type 'type'
68 /// -1 otherwise.
69 int has(uint8_t type) const throw ();
70
71 std::string serialize(void) const throw ();
72 void validate (void) const ;
73 };
74
75 /// Check if the group vector contains the given gid.
76 /// @param groups The GroupInfo vector.
77 /// @param gid The gid to look for.
78 /// @return true if the vector contains the given gid. false otherwise.
79 bool hasGroup(const std::vector<GroupInfo>& groups, gid_t gid);
80
81 /// Check if a specific user has the demanded rights.
82 /// @note This works using uid and gid, so it will only work with plug-ins that
83 /// provide this metadata (as unsigned!!).
84 /// @param context The security context.
85 /// @param acl The Access Control list.
86 /// @param stat A struct stat which mode will be checked.
87 /// @param mode The mode to be checked.
88 /// @return 0 if the mode is allowed, 1 if not.
90 const Acl& acl, const struct ::stat& stat,
91 mode_t mode);
92
93 /// Get the VO from a full DN.
94 /// @param mapfile The file that contains the user => group mapping.
95 /// @param dn The DN to parse.
96 /// @return The mapped VO.
97 std::string voFromDn(const std::string& mapfile, const std::string& dn);
98
99 /// Get the VO from a role.
100 /// @param role The role.
101 /// @return The VO.
102 std::string voFromRole(const std::string& role);
103
104 /// Get the subject from the certificate.
105 std::string getCertificateSubject(const std::string& path);
106
107 /// Generate a token.
108 /// @param id A unique ID of the user. May be the DN, the IP...
109 /// @param pfn The PFN we want a token for.
110 /// @param passwd The password to be used.
111 /// @param lifetime Token lifetime.
112 /// @param write If true, this will be a token for write access.
113 std::string generateToken(const std::string& id, const std::string& pfn,
114 const std::string& passwd, time_t lifetime,
115 bool write = false);
116
117 /// Validate a token. It must have been previously generated by generateToken.
118 /// @param token The token to validate.
119 /// @param id The SAME unique ID used to generate the token.
120 /// @param pfn The that is being accessed.
121 /// @param passwd The password that must be used to generate the token.
122 /// @param write If true, write access will be validated.
123 TokenResult validateToken(const std::string& token, const std::string& id,
124 const std::string& pfn, const std::string& passwd,
125 bool write = false);
126
127};
128
129#endif // DMLITE_CPP_UTILS_SECURITY_H_
ACL Entry.
Definition: security.h:30
static const uint8_t kGroup
Definition: security.h:36
bool operator!=(const AclEntry &) const
static const uint8_t kUser
Definition: security.h:34
bool operator==(const AclEntry &) const
static const uint8_t kDefault
Definition: security.h:39
static const uint8_t kOther
Definition: security.h:38
bool operator>(const AclEntry &) const
static const uint8_t kGroupObj
Definition: security.h:35
static const uint8_t kMask
Definition: security.h:37
uint8_t perm
Definition: security.h:42
bool operator<(const AclEntry &) const
static const uint8_t kUserObj
ACL Type possible values.
Definition: security.h:33
uint32_t id
Definition: security.h:43
uint8_t type
Definition: security.h:41
Definition: security.h:52
std::string serialize(void) const
int has(uint8_t type) const
void validate(void) const
Definition: authn.h:61
Security context. To be created by the Authn.
Definition: authn.h:73
Namespace for the dmlite C++ API.
Definition: authn.h:16
TokenResult
Possible outputs for validateToken.
Definition: security.h:20
@ kTokenExpired
Definition: security.h:24
@ kTokenInvalid
Definition: security.h:23
@ kTokenInternalError
Definition: security.h:26
@ kTokenOK
Definition: security.h:21
@ kTokenInvalidMode
Definition: security.h:25
@ kTokenMalformed
Definition: security.h:22
int checkPermissions(const SecurityContext *context, const Acl &acl, const struct ::stat &stat, mode_t mode)
bool hasGroup(const std::vector< GroupInfo > &groups, gid_t gid)
std::string voFromRole(const std::string &role)
std::string voFromDn(const std::string &mapfile, const std::string &dn)
std::string getCertificateSubject(const std::string &path)
Get the subject from the certificate.
TokenResult validateToken(const std::string &token, const std::string &id, const std::string &pfn, const std::string &passwd, bool write=false)
std::string generateToken(const std::string &id, const std::string &pfn, const std::string &passwd, time_t lifetime, bool write=false)