X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=session.c;h=3cac6d95da48802c3cd8243f6c7ef4809bb2056a;hb=296c9d9ceb421bbf2a5c1b7c2e4d8167845fec93;hp=fc5f19b869d93f729282f74a58fbf6c2299deb16;hpb=00a3ec2e523ffbdb4f027642da18cc0bf8ce9285;p=project%2Frpcd.git diff --git a/session.c b/session.c index fc5f19b..3cac6d9 100644 --- a/session.c +++ b/session.c @@ -97,7 +97,6 @@ enum { RPC_DUMP_SID, RPC_DUMP_TIMEOUT, RPC_DUMP_EXPIRES, - RPC_DUMP_ACLS, RPC_DUMP_DATA, __RPC_DUMP_MAX, }; @@ -105,7 +104,6 @@ static const struct blobmsg_policy dump_policy[__RPC_DUMP_MAX] = { [RPC_DUMP_SID] = { .name = "sid", .type = BLOBMSG_TYPE_STRING }, [RPC_DUMP_TIMEOUT] = { .name = "timeout", .type = BLOBMSG_TYPE_INT32 }, [RPC_DUMP_EXPIRES] = { .name = "expires", .type = BLOBMSG_TYPE_INT32 }, - [RPC_DUMP_ACLS] = { .name = "acls", .type = BLOBMSG_TYPE_TABLE }, [RPC_DUMP_DATA] = { .name = "data", .type = BLOBMSG_TYPE_TABLE }, }; @@ -205,7 +203,7 @@ rpc_session_dump_acls(struct rpc_session *ses, struct blob_buf *b) } static void -rpc_session_to_blob(struct rpc_session *ses) +rpc_session_to_blob(struct rpc_session *ses, bool acls) { void *c; @@ -215,9 +213,11 @@ rpc_session_to_blob(struct rpc_session *ses) blobmsg_add_u32(&buf, "timeout", ses->timeout); blobmsg_add_u32(&buf, "expires", uloop_timeout_remaining(&ses->t) / 1000); - c = blobmsg_open_table(&buf, "acls"); - rpc_session_dump_acls(ses, &buf); - blobmsg_close_table(&buf, c); + if (acls) { + c = blobmsg_open_table(&buf, "acls"); + rpc_session_dump_acls(ses, &buf); + blobmsg_close_table(&buf, c); + } c = blobmsg_open_table(&buf, "data"); rpc_session_dump_data(ses, &buf); @@ -228,7 +228,7 @@ static void rpc_session_dump(struct rpc_session *ses, struct ubus_context *ctx, struct ubus_request_data *req) { - rpc_session_to_blob(ses); + rpc_session_to_blob(ses, true); ubus_send_reply(ctx, req, buf.head); } @@ -386,7 +386,7 @@ uh_id_len(const char *str) } static int -rpc_session_grant(struct rpc_session *ses, struct ubus_context *ctx, +rpc_session_grant(struct rpc_session *ses, const char *scope, const char *object, const char *function) { struct rpc_session_acl *acl; @@ -437,7 +437,7 @@ rpc_session_grant(struct rpc_session *ses, struct ubus_context *ctx, } static int -rpc_session_revoke(struct rpc_session *ses, struct ubus_context *ctx, +rpc_session_revoke(struct rpc_session *ses, const char *scope, const char *object, const char *function) { struct rpc_session_acl *acl, *next; @@ -502,8 +502,8 @@ rpc_handle_acl(struct ubus_context *ctx, struct ubus_object *obj, const char *scope = "ubus"; int rem1, rem2; - int (*cb)(struct rpc_session *ses, struct ubus_context *ctx, - const char *scope, const char *object, const char *function); + int (*cb)(struct rpc_session *ses, + const char *scope, const char *object, const char *function); blobmsg_parse(acl_policy, __RPC_SA_MAX, tb, blob_data(msg), blob_len(msg)); @@ -523,7 +523,7 @@ rpc_handle_acl(struct ubus_context *ctx, struct ubus_object *obj, cb = rpc_session_revoke; if (!tb[RPC_SA_OBJECTS]) - return cb(ses, ctx, scope, NULL, NULL); + return cb(ses, scope, NULL, NULL); blobmsg_for_each_attr(attr, tb[RPC_SA_OBJECTS], rem1) { if (blob_id(attr) != BLOBMSG_TYPE_ARRAY) @@ -545,7 +545,7 @@ rpc_handle_acl(struct ubus_context *ctx, struct ubus_object *obj, } if (object && function) - cb(ses, ctx, scope, object, function); + cb(ses, scope, object, function); } return 0; @@ -627,7 +627,7 @@ rpc_handle_set(struct ubus_context *ctx, struct ubus_object *obj, struct blob_attr *msg) { struct rpc_session *ses; - struct blob_attr *tb[__RPC_SA_MAX]; + struct blob_attr *tb[__RPC_SS_MAX]; struct blob_attr *attr; int rem; @@ -657,7 +657,7 @@ rpc_handle_get(struct ubus_context *ctx, struct ubus_object *obj, { struct rpc_session *ses; struct rpc_session_data *data; - struct blob_attr *tb[__RPC_SA_MAX]; + struct blob_attr *tb[__RPC_SG_MAX]; struct blob_attr *attr; void *c; int rem; @@ -837,6 +837,11 @@ rpc_login_test_login(struct uci_context *uci, if (strcmp(ptr.o->v.string, username)) continue; + /* If password is NULL, we're restoring ACLs for an existing session, + * in this case do not check the password again. */ + if (!password) + return ptr.s; + /* test for matching password */ ptr.option = "password"; ptr.o = NULL; @@ -858,6 +863,7 @@ static bool rpc_login_test_permission(struct uci_section *s, const char *perm, const char *group) { + const char *p; struct uci_option *o; struct uci_element *e, *l; @@ -878,9 +884,30 @@ rpc_login_test_permission(struct uci_section *s, if (strcmp(o->e.name, perm)) continue; - uci_foreach_element(&o->v.list, l) - if (l->name && !fnmatch(l->name, group, 0)) + /* Match negative expressions first. If a negative expression matches + * the current group name then deny access. */ + uci_foreach_element(&o->v.list, l) { + p = l->name; + + if (!p || *p != '!') + continue; + + while (isspace(*++p)); + + if (!*p) + continue; + + if (!fnmatch(p, group, 0)) + return false; + } + + uci_foreach_element(&o->v.list, l) { + if (!l->name || !*l->name || *l->name == '!') + continue; + + if (!fnmatch(l->name, group, 0)) return true; + } } /* make sure that write permission implies read permission */ @@ -918,9 +945,9 @@ rpc_login_setup_acl_scope(struct rpc_session *ses, if (blob_id(acl_func) != BLOBMSG_TYPE_STRING) continue; - rpc_session_grant(ses, NULL, blobmsg_name(acl_scope), - blobmsg_name(acl_obj), - blobmsg_data(acl_func)); + rpc_session_grant(ses, blobmsg_name(acl_scope), + blobmsg_name(acl_obj), + blobmsg_data(acl_func)); } } } @@ -940,9 +967,9 @@ rpc_login_setup_acl_scope(struct rpc_session *ses, if (blob_id(acl_obj) != BLOBMSG_TYPE_STRING) continue; - rpc_session_grant(ses, NULL, blobmsg_name(acl_scope), - blobmsg_data(acl_obj), - blobmsg_name(acl_perm)); + rpc_session_grant(ses, blobmsg_name(acl_scope), + blobmsg_data(acl_obj), + blobmsg_name(acl_perm)); } } } @@ -1007,9 +1034,9 @@ rpc_login_setup_acl_file(struct rpc_session *ses, struct uci_section *login, * access groups without having to test access of each single * // tuple defined in a group. */ - rpc_session_grant(ses, NULL, "access-group", - blobmsg_name(acl_group), - blobmsg_name(acl_perm)); + rpc_session_grant(ses, "access-group", + blobmsg_name(acl_group), + blobmsg_name(acl_perm)); } } } @@ -1174,11 +1201,13 @@ fail: } static bool -rpc_session_from_blob(struct blob_attr *attr) +rpc_session_from_blob(struct uci_context *uci, struct blob_attr *attr) { - int i, rem, rem2, rem3; + int i, rem; + const char *user = NULL; struct rpc_session *ses; - struct blob_attr *tb[__RPC_DUMP_MAX], *scope, *object, *function; + struct uci_section *login; + struct blob_attr *tb[__RPC_DUMP_MAX], *data; blobmsg_parse(dump_policy, __RPC_DUMP_MAX, tb, blob_data(attr), blob_len(attr)); @@ -1196,18 +1225,17 @@ rpc_session_from_blob(struct blob_attr *attr) ses->timeout = blobmsg_get_u32(tb[RPC_DUMP_TIMEOUT]); - blobmsg_for_each_attr(scope, tb[RPC_DUMP_ACLS], rem) { - blobmsg_for_each_attr(object, scope, rem2) { - blobmsg_for_each_attr(function, object, rem3) { - rpc_session_grant(ses, NULL, blobmsg_name(scope), - blobmsg_name(object), - blobmsg_data(function)); - } - } + blobmsg_for_each_attr(data, tb[RPC_DUMP_DATA], rem) { + rpc_session_set(ses, blobmsg_name(data), data); + + if (!strcmp(blobmsg_name(data), "username")) + user = blobmsg_get_string(data); } - blobmsg_for_each_attr(object, tb[RPC_DUMP_DATA], rem) { - rpc_session_set(ses, blobmsg_name(object), object); + if (uci && user) { + login = rpc_login_test_login(uci, user, NULL); + if (login) + rpc_login_setup_acls(ses, login); } avl_insert(&sessions, &ses->avl); @@ -1296,7 +1324,7 @@ void rpc_session_freeze(void) continue; snprintf(path, sizeof(path) - 1, RPC_SESSION_DIRECTORY "/%s", ses->id); - rpc_session_to_blob(ses); + rpc_session_to_blob(ses, false); rpc_blob_to_file(path, buf.head); } } @@ -1307,12 +1335,18 @@ void rpc_session_thaw(void) char path[PATH_MAX]; struct dirent *e; struct blob_attr *attr; + struct uci_context *uci; d = opendir(RPC_SESSION_DIRECTORY); if (!d) return; + uci = uci_alloc_context(); + + if (!uci) + return; + while ((e = readdir(d)) != NULL) { if (!rpc_validate_sid(e->d_name)) continue; @@ -1323,7 +1357,7 @@ void rpc_session_thaw(void) attr = rpc_blob_from_file(path); if (attr) { - rpc_session_from_blob(attr); + rpc_session_from_blob(uci, attr); free(attr); } @@ -1331,4 +1365,6 @@ void rpc_session_thaw(void) } closedir(d); + + uci_free_context(uci); }