security.h

Go to the documentation of this file.
00001 /// @file    include/dmlite/cpp/utils/security.h
00002 /// @brief   Security functionality shared between modules.
00003 /// @details This is not a plugin!
00004 /// @author  Alejandro Álvarez Ayllón <aalvarez@cern.ch>
00005 #ifndef DMLITE_CPP_UTILS_SECURITY_H_
00006 #define DMLITE_CPP_UTILS_SECURITY_H_
00007 
00008 #include <stdint.h>
00009 #include <sys/stat.h>
00010 #include <string>
00011 #include <vector>
00012 #include "../authn.h"
00013 #include "../exceptions.h"
00014 
00015 namespace dmlite {
00016   
00017   /// Possible outputs for validateToken
00018   enum TokenResult {
00019     kTokenOK = 0,
00020     kTokenMalformed,
00021     kTokenInvalid,
00022     kTokenExpired,
00023     kTokenInvalidMode,
00024     kTokenInternalError
00025   };
00026   
00027   /// ACL Entry
00028   struct AclEntry {
00029     /// ACL Type possible values
00030     static const uint8_t kUserObj  = 1;
00031     static const uint8_t kUser     = 2;
00032     static const uint8_t kGroupObj = 3;
00033     static const uint8_t kGroup    = 4;
00034     static const uint8_t kMask     = 5;
00035     static const uint8_t kOther    = 6;
00036     static const uint8_t kDefault  = 0x20;
00037                  
00038     uint8_t  type;
00039     uint8_t  perm;
00040     uint32_t id;
00041     
00042     // Operators
00043     bool operator == (const AclEntry&) const;
00044     bool operator != (const AclEntry&) const;
00045     bool operator <  (const AclEntry&) const;
00046     bool operator >  (const AclEntry&) const;
00047   };
00048   
00049   struct Acl: public std::vector<AclEntry> {
00050    public:
00051      Acl() throw ();
00052      
00053      /// Creates an ACL from a string
00054      explicit Acl(const std::string&) throw ();
00055      
00056      /// Creates a new ACL inheriting from parent.
00057      /// @param parent The parent's ACL vector.
00058      /// @param uid    The current user uid.
00059      /// @param gid    The current user gid.
00060      /// @param cmode  The creation mode.
00061      /// @param fmode  The current file mode. It will be modified to fit the inheritance.
00062      Acl(const Acl& parent, uid_t uid, gid_t gid, mode_t cmode, mode_t* fmode) throw ();
00063      
00064      /// Returns the position if there is an ACL entry with the type 'type'
00065      /// -1 otherwise.
00066      int has(uint8_t type) const throw ();
00067      
00068      std::string serialize(void) const throw ();
00069      void        validate (void) const throw (DmException);
00070   };
00071   
00072 
00073   /// Check if a specific user has the demanded rights.
00074   /// @note This works using uid and gid, so it will only work with plug-ins that
00075   ///       provide this metadata (as unsigned!!).
00076   /// @param context The security context.
00077   /// @param acl     The Access Control list.
00078   /// @param stat    A struct stat which mode will be checked.
00079   /// @param mode    The mode to be checked.
00080   /// @return        0 if the mode is allowed, 1 if not.
00081   int checkPermissions(const SecurityContext* context,
00082                        const Acl& acl, const struct stat& stat,
00083                        mode_t mode);
00084 
00085   /// Get the VO from a full DN.
00086   /// @param mapfile The file that contains the user => group mapping.
00087   /// @param dn      The DN to parse.
00088   /// @return        The mapped VO.
00089   std::string voFromDn(const std::string& mapfile, const std::string& dn);
00090 
00091   /// Get the VO from a role.
00092   /// @param role The role.
00093   /// @return     The VO.
00094   std::string voFromRole(const std::string& role);
00095 
00096   /// Get the host DN from the host certificate
00097   std::string getHostDN(void);
00098 
00099   /// Generate a token.
00100   /// @param id       A unique ID of the user. May be the DN, the IP...
00101   /// @param pfn      The PFN we want a token for.
00102   /// @param passwd   The password to be used.
00103   /// @param lifetime Token lifetime.
00104   /// @param write    If true, this will be a token for write access.
00105   std::string generateToken(const std::string& id, const std::string& pfn,
00106                             const std::string& passwd, time_t lifetime,
00107                             bool write = false);
00108 
00109   /// Validate a token. It must have been previously generated by generateToken.
00110   /// @param token  The token to validate.
00111   /// @param id     The SAME unique ID used to generate the token.
00112   /// @param pfn    The that is being accessed.
00113   /// @param passwd The password that must be used to generate the token.
00114   /// @param write  If true, write access will be validated.
00115   TokenResult validateToken(const std::string& token, const std::string& id,
00116                             const std::string& pfn, const std::string& passwd,
00117                             bool write = false);
00118 
00119 };
00120 
00121 #endif // DMLITE_CPP_UTILS_SECURITY_H_

Generated on 3 Mar 2013 for dmlite by  doxygen 1.4.7