dmlite
0.6
Main Page
Related Pages
Namespaces
Classes
Files
File List
File Members
include
dmlite
cpp
utils
security.h
Go to the documentation of this file.
1
/// @file include/dmlite/cpp/utils/security.h
2
/// @brief Security functionality shared between modules.
3
/// @details This is not a plugin!
4
/// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch>
5
#ifndef DMLITE_CPP_UTILS_SECURITY_H_
6
#define DMLITE_CPP_UTILS_SECURITY_H_
7
8
#include <stdint.h>
9
#include <sys/stat.h>
10
#include <string>
11
#include <vector>
12
#include "../authn.h"
13
#include "../exceptions.h"
14
15
namespace
dmlite {
16
/// Generic username for a name-independent token
17
static
const
std::string kGenericUser =
"nouser"
;
18
19
/// Possible outputs for validateToken
20
enum
TokenResult
{
21
kTokenOK
= 0,
22
kTokenMalformed
,
23
kTokenInvalid
,
24
kTokenExpired
,
25
kTokenInvalidMode
,
26
kTokenInternalError
27
};
28
29
/// ACL Entry
30
struct
AclEntry
{
31
/// ACL Type possible values
32
static
const
uint8_t
kUserObj
= 1;
33
static
const
uint8_t
kUser
= 2;
34
static
const
uint8_t
kGroupObj
= 3;
35
static
const
uint8_t
kGroup
= 4;
36
static
const
uint8_t
kMask
= 5;
37
static
const
uint8_t
kOther
= 6;
38
static
const
uint8_t
kDefault
= 0x20;
39
40
uint8_t
type
;
41
uint8_t
perm
;
42
uint32_t
id
;
43
44
// Operators
45
bool
operator ==
(
const
AclEntry
&)
const
;
46
bool
operator !=
(
const
AclEntry
&)
const
;
47
bool
operator <
(
const
AclEntry
&)
const
;
48
bool
operator >
(
const
AclEntry
&)
const
;
49
};
50
51
struct
Acl
:
public
std::vector<AclEntry> {
52
public
:
53
Acl
()
throw
();
54
55
/// Creates an ACL from a string
56
explicit
Acl
(
const
std::string&)
throw
();
57
58
/// Creates a new ACL inheriting from parent.
59
/// @param parent The parent's ACL vector.
60
/// @param uid The current user uid.
61
/// @param gid The current user gid.
62
/// @param cmode The creation mode.
63
/// @param fmode The current file mode. It will be modified to fit the inheritance.
64
Acl
(
const
Acl
& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode)
throw
();
65
66
/// Returns the position if there is an ACL entry with the type 'type'
67
/// -1 otherwise.
68
int
has
(uint8_t type)
const
throw
();
69
70
std::string
serialize
(
void
)
const
throw
();
71
void
validate
(
void
)
const
throw
(
DmException
);
72
};
73
74
/// Check if the group vector contains the given gid.
75
/// @param groups The GroupInfo vector.
76
/// @param gid The gid to look for.
77
/// @return true if the vector contains the given gid. false otherwise.
78
bool
hasGroup
(
const
std::vector<GroupInfo>& groups, gid_t gid);
79
80
/// Check if a specific user has the demanded rights.
81
/// @note This works using uid and gid, so it will only work with plug-ins that
82
/// provide this metadata (as unsigned!!).
83
/// @param context The security context.
84
/// @param acl The Access Control list.
85
/// @param stat A struct stat which mode will be checked.
86
/// @param mode The mode to be checked.
87
/// @return 0 if the mode is allowed, 1 if not.
88
int
checkPermissions
(
const
SecurityContext
* context,
89
const
Acl
& acl,
const
struct ::stat& stat,
90
mode_t mode);
91
92
/// Get the VO from a full DN.
93
/// @param mapfile The file that contains the user => group mapping.
94
/// @param dn The DN to parse.
95
/// @return The mapped VO.
96
std::string
voFromDn
(
const
std::string& mapfile,
const
std::string& dn);
97
98
/// Get the VO from a role.
99
/// @param role The role.
100
/// @return The VO.
101
std::string
voFromRole
(
const
std::string& role);
102
103
/// Get the subject from the certificate.
104
std::string
getCertificateSubject
(
const
std::string& path);
105
106
/// Generate a token.
107
/// @param id A unique ID of the user. May be the DN, the IP...
108
/// @param pfn The PFN we want a token for.
109
/// @param passwd The password to be used.
110
/// @param lifetime Token lifetime.
111
/// @param write If true, this will be a token for write access.
112
std::string
generateToken
(
const
std::string&
id
,
const
std::string& pfn,
113
const
std::string& passwd, time_t lifetime,
114
bool
write =
false
);
115
116
/// Validate a token. It must have been previously generated by generateToken.
117
/// @param token The token to validate.
118
/// @param id The SAME unique ID used to generate the token.
119
/// @param pfn The that is being accessed.
120
/// @param passwd The password that must be used to generate the token.
121
/// @param write If true, write access will be validated.
122
TokenResult
validateToken
(
const
std::string& token,
const
std::string&
id
,
123
const
std::string& pfn,
const
std::string& passwd,
124
bool
write =
false
);
125
126
};
127
128
#endif // DMLITE_CPP_UTILS_SECURITY_H_
Generated on Wed Oct 8 2014 02:52:25 for dmlite by
1.8.3.1