« back to all changes in this revision
Viewing changes to plugin/regex_policy/module.cc
- browse files at revision 2223
- compare with another revision
- compare with revision 1994.4.61
- download diff
- download tarball
- view history from revision 2223
- Committer: Monty Taylor
- Date: 2011-03-07 23:34:58 UTC
- mfrom: (2222.1.2 build)
- Revision ID: mordred@inaugust.com-20110307233458-dq1u12wfycxu5d79
Merged Clint - Regex Policy auth plugin.
Merged Monty - Fix for old broken sphinxes.
Merged Monty - Fix for old broken sphinxes.
- files added:
- plugin/regex_policy
- plugin/regex_policy/tests
- plugin/regex_policy/tests/r
- plugin/regex_policy/tests/t
- files modified:
- docs/pyext/confval.py
added
removed
plugin/regex_policy/module.cc
1
/* -*- mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; -*-
2
* vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
3
*
4
* Copyright (C) 2010 Monty Taylor <mordred@inaugust.com>
5
* Copyright (C) 2011 Canonical, Ltd.
6
* Author: Clint Byrum <clint.byrum@canonical.com>
7
*
8
* Copied from simple_user_policy
9
*
10
* This program is free software; you can redistribute it and/or modify
11
* it under the terms of the GNU General Public License as published by
12
* the Free Software Foundation; version 2 of the License.
13
*
14
* This program is distributed in the hope that it will be useful,
15
* but WITHOUT ANY WARRANTY; without even the implied warranty of
16
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17
* GNU General Public License for more details.
18
*
19
* You should have received a copy of the GNU General Public License
20
* along with this program; if not, write to the Free Software
21
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
*/
23
24
#include <config.h>
25
26
#include <drizzled/plugin/authorization.h>
27
#include <drizzled/module/option_map.h>
28
29
#include "policy.h"
30
31
namespace po= boost::program_options;
32
33
using namespace std;
34
using namespace drizzled;
35
36
namespace regex_policy
37
{
38
39
static int init(module::Context &context)
40
{
41
const module::option_map &vm= context.getOptions();
42
43
Policy *policy= new (nothrow) Policy(fs::path(vm["policy"].as<string>()));
44
if (policy == NULL or not policy->loadFile())
45
{
46
errmsg_printf(error::ERROR, _("Could not load regex policy file: %s\n"),
47
(policy ? policy->getError().str().c_str() : _("Unknown")));
48
if (policy)
49
{
50
delete policy;
51
}
52
return 1;
53
}
54
55
context.add(policy);
56
context.registerVariable(new sys_var_const_string_val("policy", vm["policy"].as<string>()));
57
58
return 0;
59
}
60
61
static void init_options(drizzled::module::option_context &context)
62
{
63
context("policy",
64
po::value<string>()->default_value(DEFAULT_POLICY_FILE.string()),
65
N_("File to load for regex authorization policies"));
66
}
67
68
bool Policy::loadFile()
69
{
70
ifstream file(policy_file.string().c_str());
71
boost::regex comment_re;
72
boost::regex empty_re;
73
boost::regex table_matches_re;
74
boost::regex process_matches_re;
75
boost::regex schema_matches_re;
76
77
try
78
{
79
comment_re= comment_regex;
80
empty_re= empty_regex;
81
table_matches_re= table_match_regex;
82
process_matches_re= process_match_regex;
83
schema_matches_re= schema_match_regex;
84
}
85
catch (const std::exception &e)
86
{
87
error << e.what();
88
return false;
89
}
90
91
if (! file.is_open())
92
{
93
error << "Unable to open regex policy file: " << policy_file.string();
94
return false;
95
}
96
97
int lines= 0;
98
try
99
{
100
while (! file.eof())
101
{
102
++lines;
103
string line;
104
getline(file, line);
105
if (boost::regex_match(line, comment_re))
106
{
107
continue;
108
}
109
if (boost::regex_match(line, empty_re))
110
{
111
continue;
112
}
113
boost::smatch matches;
114
PolicyItemList *policies;
115
if (boost::regex_match(line, matches, table_matches_re, boost::match_extra))
116
{
117
policies= &table_policies;
118
}
119
else if (boost::regex_match(line, matches, process_matches_re, boost::match_extra))
120
{
121
policies= &process_policies;
122
}
123
else if (boost::regex_match(line, matches, schema_matches_re, boost::match_extra))
124
{
125
policies= &schema_policies;
126
}
127
else
128
{
129
throw std::exception();
130
}
131
string user_regex;
132
string object_regex;
133
string action;
134
user_regex= matches[MATCH_REGEX_USER_POS];
135
object_regex= matches[MATCH_REGEX_OBJECT_POS];
136
action= matches[MATCH_REGEX_ACTION_POS];
137
PolicyItem *i;
138
try
139
{
140
i= new PolicyItem(user_regex, object_regex, action);
141
}
142
catch (const std::exception &e)
143
{
144
error << "Bad policy item: user=" << user_regex << " object=" << object_regex << " action=" << action;
145
throw std::exception();
146
}
147
policies->push_back(i);
148
}
149
return true;
150
}
151
catch (const std::exception &e)
152
{
153
/* On any non-EOF break, unparseable line */
154
error << "Unable to parse line " << lines << " of policy file " << policy_file.string() << ":" << e.what();
155
return false;
156
}
157
}
158
159
void clearPolicyItemList(PolicyItemList policies)
160
{
161
for (PolicyItemList::iterator x= policies.begin() ; x != policies.end() ; ++x)
162
{
163
delete *x;
164
*x= NULL;
165
}
166
}
167
168
Policy::~Policy()
169
{
170
clearPolicyItemList(table_policies);
171
clearPolicyItemList(process_policies);
172
clearPolicyItemList(schema_policies);
173
delete table_check_cache;
174
delete process_check_cache;
175
delete schema_check_cache;
176
}
177
178
bool Policy::restrictObject(const drizzled::identifier::User &user_ctx,
179
const string &obj, const PolicyItemList &policies,
180
CheckMap **check_cache)
181
{
182
CheckItem c(user_ctx.username(), obj, check_cache);
183
if (!c.hasCachedResult())
184
{
185
PolicyItemList::const_iterator m= find_if(policies.begin(), policies.end(), c);
186
if (m != policies.end())
187
{
188
c.setCachedResult((*m)->isRestricted());
189
}
190
else
191
{
192
/* TODO: make default action configurable */
193
c.setCachedResult(false);
194
}
195
}
196
return c.getCachedResult();
197
}
198
199
bool Policy::restrictSchema(const drizzled::identifier::User &user_ctx,
200
drizzled::identifier::Schema::const_reference schema)
201
{
202
return restrictObject(user_ctx, schema.getSchemaName(), schema_policies, &schema_check_cache);
203
}
204
205
bool Policy::restrictProcess(const drizzled::identifier::User &user_ctx,
206
const drizzled::identifier::User &session_ctx)
207
{
208
return restrictObject(user_ctx, session_ctx.username(), process_policies, &process_check_cache);
209
}
210
211
bool Policy::restrictTable(drizzled::identifier::User::const_reference user_ctx,
212
drizzled::identifier::Table::const_reference table)
213
{
214
return restrictObject(user_ctx, table.getTableName(), table_policies, &table_check_cache);
215
}
216
217
bool CheckItem::operator()(PolicyItem *p)
218
{
219
if (p->userMatches(user))
220
{
221
errmsg_printf(error::INSPECT, _("User %s matches regex\n"), user.c_str());
222
if (p->objectMatches(object))
223
{
224
errmsg_printf(error::INSPECT, _("Object %s matches regex %s (%s)\n"),
225
object.c_str(),
226
p->getObject().c_str(),
227
p->getAction());
228
return true;
229
}
230
errmsg_printf(error::INSPECT, _("Object %s NOT restricted by regex %s (%s)\n"),
231
object.c_str(),
232
p->getObject().c_str(),
233
p->getAction());
234
}
235
return false;
236
}
237
238
CheckItem::CheckItem(const std::string &user_in, const std::string &obj_in, CheckMap **check_cache_in)
239
: user(user_in), object(obj_in), has_cached_result(false), check_cache(check_cache_in)
240
{
241
CheckMap::iterator check_val;
242
std::stringstream keystream;
243
keystream << user << "_" << object;
244
key= keystream.str();
245
246
/* using RCU to only need to lock when updating the cache */
247
if ((*check_cache) && (check_val= (*check_cache)->find(key)) != (*check_cache)->end())
248
{
249
setCachedResult(check_val->second);
250
}
251
}
252
253
void CheckItem::setCachedResult(bool result)
254
{
255
// TODO: make the mutex per-cache
256
CheckMap *old_cache;
257
CheckMap *new_cache;
258
boost::mutex::scoped_lock lock(check_cache_mutex, boost::defer_lock);
259
lock.lock();
260
261
// Copy the current one
262
if (*check_cache)
263
{
264
new_cache= new CheckMap(**check_cache);
265
}
266
else
267
{
268
new_cache= new CheckMap();
269
}
270
271
// Update it
272
(*new_cache)[key]= result;
273
// Replace old
274
old_cache= *check_cache;
275
*check_cache= new_cache;
276
277
lock.unlock();
278
has_cached_result= true;
279
cached_result= result;
280
281
if (old_cache)
282
{
283
delete old_cache;
284
}
285
}
286
287
} /* namespace regex_policy */
288
289
DRIZZLE_PLUGIN(regex_policy::init, NULL, regex_policy::init_options);
Loggerhead is a web-based interface for Breezy
Version: 2.0.1