dmlite  0.4
security.h
Go to the documentation of this file.
1 /// @file include/dmlite/cpp/utils/security.h
2 /// @brief Security functionality shared between modules.
3 /// @details This is not a plugin!
4 /// @author Alejandro Álvarez Ayllón <aalvarez@cern.ch>
5 #ifndef DMLITE_CPP_UTILS_SECURITY_H_
6 #define DMLITE_CPP_UTILS_SECURITY_H_
7 
8 #include <stdint.h>
9 #include <sys/stat.h>
10 #include <string>
11 #include <vector>
12 #include "../authn.h"
13 #include "../exceptions.h"
14 
15 namespace dmlite {
16 
17  /// Possible outputs for validateToken
18  enum TokenResult {
19  kTokenOK = 0,
25  };
26 
27  /// ACL Entry
28  struct AclEntry {
29  /// ACL Type possible values
30  static const uint8_t kUserObj = 1;
31  static const uint8_t kUser = 2;
32  static const uint8_t kGroupObj = 3;
33  static const uint8_t kGroup = 4;
34  static const uint8_t kMask = 5;
35  static const uint8_t kOther = 6;
36  static const uint8_t kDefault = 0x20;
37 
38  uint8_t type;
39  uint8_t perm;
40  uint32_t id;
41 
42  // Operators
43  bool operator == (const AclEntry&) const;
44  bool operator != (const AclEntry&) const;
45  bool operator < (const AclEntry&) const;
46  bool operator > (const AclEntry&) const;
47  };
48 
49  struct Acl: public std::vector<AclEntry> {
50  public:
51  Acl() throw ();
52 
53  /// Creates an ACL from a string
54  explicit Acl(const std::string&) throw ();
55 
56  /// Creates a new ACL inheriting from parent.
57  /// @param parent The parent's ACL vector.
58  /// @param uid The current user uid.
59  /// @param gid The current user gid.
60  /// @param cmode The creation mode.
61  /// @param fmode The current file mode. It will be modified to fit the inheritance.
62  Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw ();
63 
64  /// Returns the position if there is an ACL entry with the type 'type'
65  /// -1 otherwise.
66  int has(uint8_t type) const throw ();
67 
68  std::string serialize(void) const throw ();
69  void validate (void) const throw (DmException);
70  };
71 
72 
73  /// Check if a specific user has the demanded rights.
74  /// @note This works using uid and gid, so it will only work with plug-ins that
75  /// provide this metadata (as unsigned!!).
76  /// @param context The security context.
77  /// @param acl The Access Control list.
78  /// @param stat A struct stat which mode will be checked.
79  /// @param mode The mode to be checked.
80  /// @return 0 if the mode is allowed, 1 if not.
81  int checkPermissions(const SecurityContext* context,
82  const Acl& acl, const struct stat& stat,
83  mode_t mode);
84 
85  /// Get the VO from a full DN.
86  /// @param mapfile The file that contains the user => group mapping.
87  /// @param dn The DN to parse.
88  /// @return The mapped VO.
89  std::string voFromDn(const std::string& mapfile, const std::string& dn);
90 
91  /// Get the VO from a role.
92  /// @param role The role.
93  /// @return The VO.
94  std::string voFromRole(const std::string& role);
95 
96  /// Get the host DN from the host certificate
97  std::string getHostDN(void);
98 
99  /// Generate a token.
100  /// @param id A unique ID of the user. May be the DN, the IP...
101  /// @param pfn The PFN we want a token for.
102  /// @param passwd The password to be used.
103  /// @param lifetime Token lifetime.
104  /// @param write If true, this will be a token for write access.
105  std::string generateToken(const std::string& id, const std::string& pfn,
106  const std::string& passwd, time_t lifetime,
107  bool write = false);
108 
109  /// Validate a token. It must have been previously generated by generateToken.
110  /// @param token The token to validate.
111  /// @param id The SAME unique ID used to generate the token.
112  /// @param pfn The that is being accessed.
113  /// @param passwd The password that must be used to generate the token.
114  /// @param write If true, write access will be validated.
115  TokenResult validateToken(const std::string& token, const std::string& id,
116  const std::string& pfn, const std::string& passwd,
117  bool write = false);
118 
119 };
120 
121 #endif // DMLITE_CPP_UTILS_SECURITY_H_