include/dmlite/cpp/utils/security.h

Go to the documentation of this file.
00001 /// @file    include/dmlite/cpp/utils/security.h
00002 /// @brief   Security functionality shared between modules.
00003 /// @details This is not a plugin!
00004 /// @author  Alejandro Álvarez Ayllón <aalvarez@cern.ch>
00005 #ifndef DMLITE_CPP_UTILS_SECURITY_H_
00006 #define DMLITE_CPP_UTILS_SECURITY_H_
00007 
00008 #include <stdint.h>
00009 #include <sys/stat.h>
00010 #include <string>
00011 #include <vector>
00012 #include "../authn.h"
00013 #include "../exceptions.h"
00014 
00015 namespace dmlite {
00016   /// Generic username for a name-independent token
00017   static const std::string kGenericUser = "nouser";
00018   
00019   /// Possible outputs for validateToken
00020   enum TokenResult {
00021     kTokenOK = 0,
00022     kTokenMalformed,
00023     kTokenInvalid,
00024     kTokenExpired,
00025     kTokenInvalidMode,
00026     kTokenInternalError
00027   };
00028   
00029   /// ACL Entry
00030   struct AclEntry {
00031     /// ACL Type possible values
00032     static const uint8_t kUserObj  = 1;
00033     static const uint8_t kUser     = 2;
00034     static const uint8_t kGroupObj = 3;
00035     static const uint8_t kGroup    = 4;
00036     static const uint8_t kMask     = 5;
00037     static const uint8_t kOther    = 6;
00038     static const uint8_t kDefault  = 0x20;
00039                  
00040     uint8_t  type;
00041     uint8_t  perm;
00042     uint32_t id;
00043     
00044     // Operators
00045     bool operator == (const AclEntry&) const;
00046     bool operator != (const AclEntry&) const;
00047     bool operator <  (const AclEntry&) const;
00048     bool operator >  (const AclEntry&) const;
00049   };
00050   
00051   struct Acl: public std::vector<AclEntry> {
00052    public:
00053      Acl() throw ();
00054      
00055      /// Creates an ACL from a string
00056      explicit Acl(const std::string&) throw ();
00057      
00058      /// Creates a new ACL inheriting from parent.
00059      /// @param parent The parent's ACL vector.
00060      /// @param uid    The current user uid.
00061      /// @param gid    The current user gid.
00062      /// @param cmode  The creation mode.
00063      /// @param fmode  The current file mode. It will be modified to fit the inheritance.
00064      Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw ();
00065      
00066      /// Returns the position if there is an ACL entry with the type 'type'
00067      /// -1 otherwise.
00068      int has(uint8_t type) const throw ();
00069      
00070      std::string serialize(void) const throw ();
00071      void        validate (void) const throw (DmException);
00072   };
00073   
00074   /// Check if the group vector contains the given gid.
00075   /// @param groups The GroupInfo vector.
00076   /// @param gid    The gid to look for.
00077   /// @return       true if the vector contains the given gid. false otherwise.
00078   bool hasGroup(const std::vector<GroupInfo>& groups, gid_t gid);
00079 
00080   /// Check if a specific user has the demanded rights.
00081   /// @note This works using uid and gid, so it will only work with plug-ins that
00082   ///       provide this metadata (as unsigned!!).
00083   /// @param context The security context.
00084   /// @param acl     The Access Control list.
00085   /// @param stat    A struct stat which mode will be checked.
00086   /// @param mode    The mode to be checked.
00087   /// @return        0 if the mode is allowed, 1 if not.
00088   int checkPermissions(const SecurityContext* context,
00089                        const Acl& acl, const struct ::stat& stat,
00090                        mode_t mode);
00091 
00092   /// Get the VO from a full DN.
00093   /// @param mapfile The file that contains the user => group mapping.
00094   /// @param dn      The DN to parse.
00095   /// @return        The mapped VO.
00096   std::string voFromDn(const std::string& mapfile, const std::string& dn);
00097 
00098   /// Get the VO from a role.
00099   /// @param role The role.
00100   /// @return     The VO.
00101   std::string voFromRole(const std::string& role);
00102 
00103   /// Get the subject from the certificate.
00104   std::string getCertificateSubject(const std::string& path);
00105 
00106   /// Generate a token.
00107   /// @param id       A unique ID of the user. May be the DN, the IP...
00108   /// @param pfn      The PFN we want a token for.
00109   /// @param passwd   The password to be used.
00110   /// @param lifetime Token lifetime.
00111   /// @param write    If true, this will be a token for write access.
00112   std::string generateToken(const std::string& id, const std::string& pfn,
00113                             const std::string& passwd, time_t lifetime,
00114                             bool write = false);
00115 
00116   /// Validate a token. It must have been previously generated by generateToken.
00117   /// @param token  The token to validate.
00118   /// @param id     The SAME unique ID used to generate the token.
00119   /// @param pfn    The that is being accessed.
00120   /// @param passwd The password that must be used to generate the token.
00121   /// @param write  If true, write access will be validated.
00122   TokenResult validateToken(const std::string& token, const std::string& id,
00123                             const std::string& pfn, const std::string& passwd,
00124                             bool write = false);
00125 
00126 };
00127 
00128 #endif // DMLITE_CPP_UTILS_SECURITY_H_

Generated on 28 Apr 2014 for dmlite by  doxygen 1.4.7