From 3a7253435053ac840461627232da62e9648e006b Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ale=C5=A1=20K=C5=99enek?= Date: Thu, 9 Jun 2005 11:40:56 +0000 Subject: [PATCH] basic authorisation --- org.glite.jp.primary/Makefile | 2 +- org.glite.jp.primary/examples/jpps-test.c | 21 +++++---- org.glite.jp.primary/src/authz.c | 76 ++++++++++++++++++++++++++++++ org.glite.jp.primary/src/authz.h | 18 +++++++ org.glite.jp.primary/src/bones_server.c | 8 +++- org.glite.jp.primary/src/new_ftp_backend.c | 22 ++++++--- org.glite.jp.primary/src/soap_ops.c | 14 ++++-- 7 files changed, 140 insertions(+), 21 deletions(-) create mode 100644 org.glite.jp.primary/src/authz.c create mode 100644 org.glite.jp.primary/src/authz.h diff --git a/org.glite.jp.primary/Makefile b/org.glite.jp.primary/Makefile index 73c3691..0736328 100644 --- a/org.glite.jp.primary/Makefile +++ b/org.glite.jp.primary/Makefile @@ -54,7 +54,7 @@ HDRS_S=builtin_plugins.h backend.h SRCS:= bones_server.c soap_ops.c \ new_ftp_backend.c mysql.c file_plugin.c \ - feed.c tags.c\ + feed.c tags.c authz.c\ is_client.c \ ${ps_prefix}ServerLib.c \ ${is_prefix}ClientLib.c jpps_C.c diff --git a/org.glite.jp.primary/examples/jpps-test.c b/org.glite.jp.primary/examples/jpps-test.c index f273fe0..6a7618e 100644 --- a/org.glite.jp.primary/examples/jpps-test.c +++ b/org.glite.jp.primary/examples/jpps-test.c @@ -207,28 +207,31 @@ int main(int argc,char *argv[]) argv[2], &r))) { printf("FeedId: %s\nExpires: %s\n",r.feedId,ctime(&r.expires)); } - } else if (!strcasecmp(argv[1],"GetJob")) { - struct jpsrv__GetJobResponse r; + } +#endif + else if (!strcasecmp(argv[1],"GetJob")) { + struct _jpelem__GetJob in; + struct _jpelem__GetJobResponse out; if (argc != 3) usage(argv[0]); + in.jobid = argv[2]; - if (!check_fault(soap,soap_call_jpsrv__GetJob(soap,server,"", - argv[2],&r))) + if (!check_fault(soap,soap_call___jpsrv__GetJob(soap,server,"", + &in,&out))) { int i; printf("JobLog:\n"); - for (i=0; i__sizefile;i++) { + for (i=0; ifile[i]->class_, - r.files->file[i]->name, - r.files->file[i]->url); + out.files[i]->class_, + out.files[i]->name, + out.files[i]->url); } } } -#endif else usage(argv[0]); return 0; diff --git a/org.glite.jp.primary/src/authz.c b/org.glite.jp.primary/src/authz.c new file mode 100644 index 0000000..3e6d6e4 --- /dev/null +++ b/org.glite.jp.primary/src/authz.c @@ -0,0 +1,76 @@ +#include +#include +#include +#include + +#include "glite/jp/types.h" +#include "glite/jp/context.h" + +#include "jpps_H.h" + +int glite_jpps_authz(glite_jp_context_t ctx,int op,const char *job,const char *owner) +{ + glite_jp_error_t err; + char buf[200]; + int i; + + memset(&err,0,sizeof err); + glite_jp_clear_error(ctx); + err.source = __FUNCTION__; + err.code = EPERM; + + switch (op) { + case SOAP_TYPE___jpsrv__RegisterJob: + case SOAP_TYPE___jpsrv__StartUpload: + case SOAP_TYPE___jpsrv__CommitUpload: + for (i=0; ctx->trusted_peers && ctx->trusted_peers[i]; i++) + if (!strcmp(ctx->trusted_peers[i],ctx->peer)) return 0; + err.desc = "you are not a trusted peer"; + return glite_jp_stack_error(ctx,&err); + + case SOAP_TYPE___jpsrv__GetJob: + assert(owner); + return strcmp(owner,ctx->peer) ? glite_jp_stack_error(ctx,&err) : 0; + break; + + default: + snprintf(buf,sizeof buf,"%d: unknown operation",op); + err.desc = buf; + err.code = EINVAL; + return glite_jp_stack_error(ctx,&err); + } +} + +int glite_jpps_readauth(glite_jp_context_t ctx,const char *file) +{ + FILE *f = fopen(file,"r"); + glite_jp_error_t err; + int cnt = 0; + + glite_jp_clear_error(ctx); + memset(&err,0,sizeof err); + err.source = __FUNCTION__; + if (!f) { + err.code = errno; + err.desc = file; + return glite_jp_stack_error(ctx,&err); + } + + ctx->trusted_peers = NULL; + while (!feof(f)) { + char buf[BUFSIZ]; + + if (fscanf(f,"%[^\n]\n",buf) != 1) { + err.code = EINVAL; + err.desc = file; + fclose(f); + return glite_jp_stack_error(ctx,&err); + } + + ctx->trusted_peers = realloc(ctx->trusted_peers, (cnt+1) * sizeof *ctx->trusted_peers); + ctx->trusted_peers[cnt++] = strdup(buf); + ctx->trusted_peers[cnt] = NULL; + } + fclose(f); + return 0; +} diff --git a/org.glite.jp.primary/src/authz.h b/org.glite.jp.primary/src/authz.h new file mode 100644 index 0000000..9451aef --- /dev/null +++ b/org.glite.jp.primary/src/authz.h @@ -0,0 +1,18 @@ +/** + * Check authorisation of JPPS operation on job. + * + * \param[in] ctx JP context including peer name & other credentials (VOMS etc.) + * \param[in] op operation, one of SOAP_TYPE___jpsrv__* + * \param[in] job jobid of the job to decide upon + * \param[in] owner current known owner of the job (may be NULL), shortcut to avoid + * unnecessary database query. + * + * \retval 0 OK, operation permitted + * \retval EPERM denied + * \retval other error + */ + +int glite_jpps_authz(glite_jp_context_t ctx,int op,const char *job,const char *owner); + +int glite_jpps_readauth(glite_jp_context_t ctx,const char *file); + diff --git a/org.glite.jp.primary/src/bones_server.c b/org.glite.jp.primary/src/bones_server.c index 0479f78..8a47169 100644 --- a/org.glite.jp.primary/src/bones_server.c +++ b/org.glite.jp.primary/src/bones_server.c @@ -58,7 +58,7 @@ int main(int argc, char *argv[]) b_argc = p_argc = 1; - while ((opt = getopt(argc,argv,"B:P:")) != EOF) switch (opt) { + while ((opt = getopt(argc,argv,"B:P:a:")) != EOF) switch (opt) { case 'B': assert(b_argc < 20); if (com = strchr(optarg,',')) *com = 0; @@ -73,6 +73,12 @@ int main(int argc, char *argv[]) p_argv[p_argc++] = optarg; break; + case 'a': + if (glite_jpps_readauth(ctx,optarg)) { + fprintf(stderr,"%s: %s\n",argv[0],glite_jp_error_chain(ctx)); + exit (1); + } + break; case '?': fprintf(stderr,"usage: %s: -Bb,val ... -Pplugin.so ...\n" "b is backend option\n",argv[0]); exit (1); diff --git a/org.glite.jp.primary/src/new_ftp_backend.c b/org.glite.jp.primary/src/new_ftp_backend.c index 00a2cb1..be620e4 100644 --- a/org.glite.jp.primary/src/new_ftp_backend.c +++ b/org.glite.jp.primary/src/new_ftp_backend.c @@ -21,6 +21,8 @@ #include "backend.h" #include "db.h" +#include "jpps_H.h" /* XXX: SOAP_TYPE___jpsrv__GetJob */ + #define FTPBE_DEFAULT_DB_CS "jpps/@localhost:jpps" struct ftpbe_config { @@ -444,7 +446,7 @@ int glite_jppsbe_start_upload( glite_jp_db_freestmt(&db_res); - /* XXX authorization */ + /* XXX authorization done in soap_ops.c */ /* XXX name length */ if (asprintf(&data_basename, "%s%s%s", class, @@ -712,7 +714,7 @@ int glite_jppsbe_get_job_url( char *stmt = NULL; glite_jp_db_stmt_t db_res; int db_retn; - char *db_row[2] = { NULL, NULL }; + char *db_row[3] = { NULL, NULL, NULL }; long reg_time; glite_jp_error_t err; @@ -728,12 +730,12 @@ int glite_jppsbe_get_job_url( if (jobid_unique_pathname(ctx, job, &ju, &ju_path, 1) != 0) { err.code = ctx->error->code; - err.desc = "Cannot obtain jobid unique path/name"; + err.desc = "Cannot obtain jobid unique path/ : ""name"; return glite_jp_stack_error(ctx,&err); } - trio_asprintf(&stmt, "select owner, reg_time from jobs " - "where jobid='%|Ss'", ju); + trio_asprintf(&stmt, "select j.owner,reg_time,u.cert_subj from jobs j, users u " + "where j.jobid='%|Ss' and j.owner = u.userid", ju); if (!stmt) { err.code = ENOMEM; @@ -752,7 +754,7 @@ int glite_jppsbe_get_job_url( } db_retn = glite_jp_db_fetchrow(db_res, db_row); - if (db_retn != 2) { + if (db_retn != 3) { glite_jp_db_freestmt(&db_res); err.code = EIO; err.desc = "DB access failed"; @@ -760,10 +762,16 @@ int glite_jppsbe_get_job_url( } glite_jp_db_freestmt(&db_res); + + if (glite_jpps_authz(ctx,SOAP_TYPE___jpsrv__GetJob,job,db_row[2])) { + err.code = EPERM; + goto error_out; + } /* XXX name length */ if (asprintf(&data_basename, "%s%s%s", class, - (name != NULL) ? "." : "", name) == -1) { + (name != NULL) ? "." : "", + (name != NULL) ? name : "") == -1) { err.code = ENOMEM; goto error_out; } diff --git a/org.glite.jp.primary/src/soap_ops.c b/org.glite.jp.primary/src/soap_ops.c index 222ac0d..e80825f 100644 --- a/org.glite.jp.primary/src/soap_ops.c +++ b/org.glite.jp.primary/src/soap_ops.c @@ -97,13 +97,14 @@ SOAP_FMAC5 int SOAP_FMAC6 __jpsrv__RegisterJob( struct soap *soap, struct _jpelem__RegisterJob *in, struct _jpelem__RegisterJobResponse *empty) -// struct __jpsrv__RegisterJobResponse *empty) { CONTEXT_FROM_SOAP(soap,ctx); glite_jp_attrval_t owner_val[2]; printf("%s %s %s\n",__FUNCTION__,in->job,in->owner); - if (glite_jppsbe_register_job(ctx,in->job,in->owner)) { + if (glite_jpps_authz(ctx,SOAP_TYPE___jpsrv__RegisterJob,in->job,in->owner) || + glite_jppsbe_register_job(ctx,in->job,in->owner)) + { err2fault(ctx,soap); return SOAP_FAULT; } @@ -134,6 +135,11 @@ SOAP_FMAC5 int SOAP_FMAC6 __jpsrv__StartUpload( glite_jp_clear_error(ctx); memset(&err,0,sizeof err); + if (glite_jpps_authz(ctx,SOAP_TYPE___jpsrv__StartUpload,NULL,NULL)) { + err2fault(ctx,soap); + return SOAP_FAULT; + } + switch (glite_jpps_fplug_lookup(ctx,in->class_,&pd)) { case ENOENT: err.code = ENOENT; @@ -177,7 +183,9 @@ SOAP_FMAC5 int SOAP_FMAC6 __jpsrv__CommitUpload( job = class = name = NULL; - if (glite_jppsbe_commit_upload(ctx,in->destination)) { + if (glite_jpps_authz(ctx,SOAP_TYPE___jpsrv__CommitUpload,NULL,NULL) || + glite_jppsbe_commit_upload(ctx,in->destination)) + { err2fault(ctx,soap); return SOAP_FAULT; } -- 1.8.2.3