26 const std::string &GetSecName()
const {
return m_sec_name;}
27 const std::string &GetErrorMessage()
const {
return m_emsg;}
29 static int verify_before_s(
void *authz_ptr,
30 const unsigned char *pred,
33 static int verify_activity_s(
void *authz_ptr,
34 const unsigned char *pred,
37 static int verify_path_s(
void *authz_ptr,
38 const unsigned char *pred,
41 static int verify_name_s(
void *authz_ptr,
42 const unsigned char *pred,
46 int verify_before(
const unsigned char *pred,
size_t pred_sz);
47 int verify_activity(
const unsigned char *pred,
size_t pred_sz);
48 int verify_path(
const unsigned char *pred,
size_t pred_sz);
49 int verify_name(
const unsigned char *pred,
size_t pred_sz);
51 ssize_t m_max_duration;
54 const std::string m_path;
55 std::string m_desired_activity;
56 std::string m_sec_name;
64 int new_privs = privs;
112 int validate_verify_empty(
void *emsg_ptr,
113 const unsigned char *pred,
116 if ((pred_sz >= 5) && (!memcmp(
reinterpret_cast<const char *
>(pred),
"path:", 5) ||
117 !memcmp(
reinterpret_cast<const char *
>(pred),
"name:", 5)))
121 if ((pred_sz >= 9) && (!memcmp(
reinterpret_cast<const char *
>(pred),
"activity:", 9)))
132 : m_max_duration(86400),
134 m_log(log,
"macarons_"),
135 m_authz_behavior(static_cast<int>(
Handler::AuthzBehavior::PASSTHROUGH))
139 if (!
Handler::Config(config, &env, &m_log, m_location, m_secret, m_max_duration, behavior))
141 throw std::runtime_error(
"Macaroon authorization config failed.");
143 m_authz_behavior =
static_cast<int>(behavior);
148 Authz::OnMissing(
const XrdSecEntity *Entity,
const char *path,
151 switch (m_authz_behavior) {
152 case Handler::AuthzBehavior::PASSTHROUGH:
154 case Handler::AuthzBehavior::ALLOW:
156 case Handler::AuthzBehavior::DENY:
174 const char *authz = env ? env->
Get(
"authz") :
nullptr;
175 if (authz && !strncmp(authz,
"Bearer%20", 9))
181 if (!authz && Entity && !strcmp(
"ztn", Entity->
prot) && Entity->
creds &&
184 authz = Entity->
creds;
188 return OnMissing(Entity, path, oper, env);
191 macaroon_returncode mac_err = MACAROON_SUCCESS;
192 struct macaroon* macaroon = macaroon_deserialize(
199 return OnMissing(Entity, path, oper, env);
202 struct macaroon_verifier *verifier = macaroon_verifier_create();
205 m_log.
Emsg(
"Access",
"Failed to create a new macaroon verifier");
210 m_log.
Emsg(
"Access",
"Request with no provided path.");
211 macaroon_verifier_destroy(verifier);
215 AuthzCheck check_helper(path, oper, m_max_duration, m_log);
217 if (macaroon_verifier_satisfy_general(verifier, AuthzCheck::verify_before_s, &check_helper, &mac_err) ||
218 macaroon_verifier_satisfy_general(verifier, AuthzCheck::verify_activity_s, &check_helper, &mac_err) ||
219 macaroon_verifier_satisfy_general(verifier, AuthzCheck::verify_name_s, &check_helper, &mac_err) ||
220 macaroon_verifier_satisfy_general(verifier, AuthzCheck::verify_path_s, &check_helper, &mac_err))
222 m_log.
Emsg(
"Access",
"Failed to configure caveat verifier:");
223 macaroon_verifier_destroy(verifier);
227 const unsigned char *macaroon_loc;
229 macaroon_location(macaroon, &macaroon_loc, &location_sz);
230 if (strncmp(
reinterpret_cast<const char *
>(macaroon_loc), m_location.c_str(), location_sz))
232 std::string location_str(
reinterpret_cast<const char *
>(macaroon_loc), location_sz);
233 m_log.
Emsg(
"Access",
"Macaroon is for incorrect location", location_str.c_str());
234 macaroon_verifier_destroy(verifier);
235 macaroon_destroy(macaroon);
239 if (macaroon_verify(verifier, macaroon,
240 reinterpret_cast<const unsigned char *
>(m_secret.c_str()),
246 macaroon_verifier_destroy(verifier);
247 macaroon_destroy(macaroon);
250 macaroon_verifier_destroy(verifier);
252 const unsigned char *macaroon_id;
254 macaroon_identifier(macaroon, &macaroon_id, &id_sz);
256 std::string macaroon_id_str(
reinterpret_cast<const char *
>(macaroon_id), id_sz);
257 m_log.
Log(
LogMask::Info,
"Access",
"Macaroon verification successful; ID", macaroon_id_str.c_str());
258 macaroon_destroy(macaroon);
261 if (Entity && check_helper.GetSecName().size()) {
262 const std::string &username = check_helper.GetSecName();
263 m_log.
Log(
LogMask::Debug,
"Access",
"Setting the request name to", username.c_str());
264 Entity->
eaAPI->
Add(
"request.name", username,
true);
276 macaroon_returncode mac_err = MACAROON_SUCCESS;
277 std::unique_ptr<
struct macaroon, decltype(&macaroon_destroy)> macaroon(
278 macaroon_deserialize(token, &mac_err),
283 emsg =
"Failed to deserialize the token as a macaroon";
290 std::unique_ptr<
struct macaroon_verifier, decltype(&macaroon_verifier_destroy)> verifier(
291 macaroon_verifier_create(), &macaroon_verifier_destroy);
294 emsg =
"Internal error: failed to create a verifier.";
300 AuthzCheck check_helper(
"/",
AOP_Read, m_max_duration, m_log);
302 if (macaroon_verifier_satisfy_general(verifier.get(), AuthzCheck::verify_before_s, &check_helper, &mac_err) ||
303 macaroon_verifier_satisfy_general(verifier.get(), validate_verify_empty,
nullptr, &mac_err))
305 emsg =
"Failed to configure the verifier";
310 const unsigned char *macaroon_loc;
312 macaroon_location(macaroon.get(), &macaroon_loc, &location_sz);
313 if (strncmp(
reinterpret_cast<const char *
>(macaroon_loc), m_location.c_str(), location_sz))
315 emsg =
"Macaroon contains incorrect location: " +
316 std::string(
reinterpret_cast<const char *
>(macaroon_loc), location_sz);
321 if (macaroon_verify(verifier.get(), macaroon.get(),
322 reinterpret_cast<const unsigned char *
>(m_secret.c_str()),
327 emsg =
"Macaroon verification error" + (check_helper.GetErrorMessage().size() ?
328 (
", " + check_helper.GetErrorMessage()) :
"");
333 const unsigned char *macaroon_id;
335 macaroon_identifier(macaroon.get(), &macaroon_id, &id_sz);
336 m_log.
Log(
LogMask::Info,
"Validate", (
"Macaroon verification successful; ID " +
337 std::string(
reinterpret_cast<const char *
>(macaroon_id), id_sz)).c_str());
344 : m_max_duration(max_duration),
356 m_desired_activity =
"UPDATE_METADATA";
363 m_desired_activity =
"MANAGE";
368 m_desired_activity =
"UPLOAD";
371 m_desired_activity =
"DELETE";
374 m_desired_activity =
"DOWNLOAD";
377 m_desired_activity =
"LIST";
380 m_desired_activity =
"READ_METADATA";
386 AuthzCheck::verify_before_s(
void *authz_ptr,
387 const unsigned char *pred,
390 return static_cast<AuthzCheck*
>(authz_ptr)->verify_before(pred, pred_sz);
395 AuthzCheck::verify_activity_s(
void *authz_ptr,
396 const unsigned char *pred,
399 return static_cast<AuthzCheck*
>(authz_ptr)->verify_activity(pred, pred_sz);
404 AuthzCheck::verify_path_s(
void *authz_ptr,
405 const unsigned char *pred,
408 return static_cast<AuthzCheck*
>(authz_ptr)->verify_path(pred, pred_sz);
413 AuthzCheck::verify_name_s(
void *authz_ptr,
414 const unsigned char *pred,
417 return static_cast<AuthzCheck*
>(authz_ptr)->verify_name(pred, pred_sz);
422 AuthzCheck::verify_before(
const unsigned char * pred,
size_t pred_sz)
424 std::string pred_str(
reinterpret_cast<const char *
>(pred), pred_sz);
425 if (strncmp(
"before:", pred_str.c_str(), 7))
429 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"Checking macaroon for expiration; caveat:", pred_str.c_str());
432 if (strptime(&pred_str[7],
"%Y-%m-%dT%H:%M:%SZ", &caveat_tm) ==
nullptr)
434 m_emsg =
"Failed to parse time string: " + pred_str.substr(7);
438 caveat_tm.tm_isdst = -1;
440 time_t caveat_time = timegm(&caveat_tm);
441 if (-1 == caveat_time)
443 m_emsg =
"Failed to generate unix time: " + pred_str.substr(7);
447 if ((m_max_duration > 0) && (caveat_time > m_now + m_max_duration))
449 m_emsg =
"Max token age is greater than configured max duration; rejecting";
454 int result = (m_now >= caveat_time);
457 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"Macaroon has not expired.");
461 m_emsg =
"Macaroon expired at " + pred_str.substr(7);
469 AuthzCheck::verify_activity(
const unsigned char * pred,
size_t pred_sz)
471 if (!m_desired_activity.size()) {
return 1;}
472 std::string pred_str(
reinterpret_cast<const char *
>(pred), pred_sz);
473 if (strncmp(
"activity:", pred_str.c_str(), 9)) {
return 1;}
474 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"running verify activity", pred_str.c_str());
476 std::stringstream ss(pred_str.substr(9));
477 for (std::string activity;
std::getline(ss, activity,
','); )
480 if (m_desired_activity ==
"READ_METADATA") {
return 0;}
481 if ((activity == m_desired_activity) || ((m_desired_activity ==
"UPLOAD") && (activity ==
"MANAGE")))
483 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"macaroon has desired activity", activity.c_str());
487 m_log.Log(
LogMask::Info,
"AuthzCheck",
"macaroon does NOT have desired activity", m_desired_activity.c_str());
493 AuthzCheck::verify_path(
const unsigned char * pred,
size_t pred_sz)
495 std::string pred_str_raw(
reinterpret_cast<const char *
>(pred), pred_sz);
496 if (strncmp(
"path:", pred_str_raw.c_str(), 5)) {
return 1;}
498 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"running verify path", pred_str.c_str());
500 if ((m_path.find(
"/./") != std::string::npos) ||
501 (m_path.find(
"/../") != std::string::npos))
503 m_log.Log(
LogMask::Info,
"AuthzCheck",
"invalid requested path", m_path.c_str());
507 int result = strncmp(pred_str.c_str(), m_path.c_str(), pred_str.size());
510 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"path request verified for", m_path.c_str());
516 result = strncmp(m_path.c_str(), pred_str.c_str(), m_path.size());
517 if (!result) {m_log.Log(
LogMask::Debug,
"AuthzCheck",
"READ_METADATA path request verified for", m_path.c_str());}
518 else {m_log.Log(
LogMask::Debug,
"AuthzCheck",
"READ_METADATA path request NOT allowed", m_path.c_str());}
522 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"path request NOT allowed", m_path.c_str());
530 AuthzCheck::verify_name(
const unsigned char * pred,
size_t pred_sz)
532 std::string pred_str(
reinterpret_cast<const char *
>(pred), pred_sz);
533 if (strncmp(
"name:", pred_str.c_str(), 5)) {
return 1;}
534 if (pred_str.size() < 6) {
return 1;}
535 m_log.Log(
LogMask::Debug,
"AuthzCheck",
"Verifying macaroon with", pred_str.c_str());
538 m_sec_name = pred_str.substr(5);
Access_Operation
The following are supported operations.
@ AOP_Delete
rm() or rmdir()
@ AOP_Update
open() r/w or append
@ AOP_Create
open() with create
@ AOP_Any
Special for getting privs.
@ AOP_Stat
exists(), stat()
@ AOP_Rename
mv() for source
@ AOP_Read
open() r/o, prepare()
@ AOP_Excl_Create
open() with O_EXCL|O_CREAT
@ AOP_Insert
mv() for target
@ AOP_Excl_Insert
mv() where destination doesn't exist.
void getline(uchar *buff, int blen)
int emsg(int rc, char *msg)
virtual bool Validate(const char *token, std::string &emsg, long long *expT, XrdSecEntity *entP) override
Authz(XrdSysLogger *lp, const char *parms, XrdAccAuthorize *chain)
virtual XrdAccPrivs Access(const XrdSecEntity *Entity, const char *path, const Access_Operation oper, XrdOucEnv *env) override
static bool Config(const char *config, XrdOucEnv *env, XrdSysError *log, std::string &location, std::string &secret, ssize_t &max_duration, AuthzBehavior &behavior)
virtual XrdAccPrivs Access(const XrdSecEntity *Entity, const char *path, const Access_Operation oper, XrdOucEnv *Env=0)=0
char * Get(const char *varname)
bool Add(XrdSecAttr &attr)
int credslen
Length of the 'creds' data.
XrdSecEntityAttr * eaAPI
non-const API to attributes
char prot[XrdSecPROTOIDSIZE]
Auth protocol used (e.g. krb5)
char * creds
Raw entity credentials or cert.
int Emsg(const char *esfx, int ecode, const char *text1, const char *text2=0)
void Log(int mask, const char *esfx, const char *text1, const char *text2=0, const char *text3=0)
std::string NormalizeSlashes(const std::string &)