Changeset: 9b88bfa6c54e for MonetDB
URL: http://dev.monetdb.org/hg/MonetDB?cmd=changeset;node=9b88bfa6c54e
Modified Files:
monetdb5/mal/mal_authorize.c
monetdb5/mal/mal_authorize.h
Branch: headless
Log Message:
Colify the authorization
AUTHgetUsers is reduced to a single scenario check.
diffs (truncated from 808 to 300 lines):
diff --git a/monetdb5/mal/mal_authorize.c b/monetdb5/mal/mal_authorize.c
--- a/monetdb5/mal/mal_authorize.c
+++ b/monetdb5/mal/mal_authorize.c
@@ -25,6 +25,8 @@
*
* The implementation is based on three persistent columns, which keep the
* usernames, passwords and allowed scenarios for users of the server.
+ * Each user name should be unique.
+ * For each user we can have multiple scenarios, call for aligned <scen, name>
columns
*/
#include "monetdb_config.h"
#include "mal_authorize.h"
@@ -41,9 +43,10 @@
static str AUTHhashPassword(str *ret, str *algo, str *passwd, str *challenge);
static str AUTHverifyPassword(int *ret, str *passwd);
-static COL *user = NULL;
-static COL *pass = NULL;
-static COL *scen = NULL;
+static COL *user = NULL; /* a string */
+static COL *pass = NULL; /* a string */
+static COL *scen = NULL; /* oid for user */
+static COL *name = NULL; /* scenario name */
/**
* Requires the current client to be the admin user thread. If not the case,
@@ -102,12 +105,14 @@
blist[0] = 0;
assert(user);
- blist[1] = ABS(user->cacheid);
+ blist[1] = user->cacheid;
assert(pass);
- blist[2] = ABS(pass->cacheid);
- assert(pass);
- blist[3] = ABS(scen->cacheid);
- TMsubcommit_list(blist, 4);
+ blist[2] = pass->cacheid;
+ assert(scen);
+ blist[3] = scen->cacheid;
+ assert(name);
+ blist[4] = name->cacheid;
+ TMsubcommit_list(blist, 5);
}
/*
@@ -120,24 +125,25 @@
*/
str
AUTHinitTables() {
- bat bid;
+ int bid;
COL *b;
int isNew = 1;
str msg = MAL_SUCCEED;
/* skip loading if already loaded */
- if (user != NULL && pass != NULL && scen != NULL)
+ if (user != NULL && pass != NULL && scen != NULL && name != NULL)
return(MAL_SUCCEED);
/* if one is not NULL here, something is seriously screwed up */
assert (user == NULL);
assert (pass == NULL);
assert (scen == NULL);
+ assert (name == NULL);
/* load/create users columns */
bid = CBPindex("M5system_auth_user");
if (!bid) {
- b = COLnew(TYPE_oid, TYPE_str, 256);
+ b = COLnew(TYPE_str, 256);
if (b == NULL)
throw(MAL, "initTables.user", MAL_MALLOC_FAIL " user
table");
@@ -151,71 +157,10 @@
assert(b);
user = b;
- /* load old password BAT, upgrade to hash, <monetdb-5.11 */
- bid = CBPindex("M5system_auth_passwd");
- if (bid) {
- BAT *n;
- bat s[3];
-
- b = COLdescriptor(bid);
- if (b == NULL)
- throw(MAL, "initTables.passwd", INTERNAL_COL_ACCESS);
- fprintf(stderr, "#warning: converting old password store to new
format\n");
- fflush(stderr);
-
- /* create new bat */
- n = BATnew(TYPE_oid, TYPE_str, 256);
- if (n == NULL)
- throw(MAL, "initTables.passwd", MAL_MALLOC_FAIL "
password table");
-
- CBPrename(CBPcacheid(n), "M5system_auth_passwd_v2");
- COLmode(n, PERSISTENT);
-
- /* convert data */
- if (COLcount(b) > 0) {
- COLiter bi = col_iterator(b);
- oid p, q;
- str tmp;
- str pwd;
- str sha1pwd;
- int len;
-
- COLloop(b, p, q) {
- tmp = (str)BUNtail(bi, p);
- rethrow("initTables", tmp,
AUTHdecypherValue(&pwd, &tmp));
- len = (int) strlen(pwd);
- msg= AUTHBackendSum(&sha1pwd, &pwd, &len);
- GDKfree(pwd);
- if (msg)
- return msg;
- pwd = NULL;
- msg = AUTHcypherValue(&pwd, &sha1pwd);
- if (msg){
- if (pwd)
- GDKfree(pwd);
- return msg;
- }
- BUNins(n, BUNhead(bi, p), pwd, FALSE);
- GDKfree(sha1pwd);
- GDKfree(pwd);
- }
- }
-
- /* destroy old bat */
- COLmode(b, TRANSIENT);
- CBPreleaseref(b);
-
- /* commit the new situation */
- s[0] = 0;
- s[1] = ABS(n->cacheid);
- s[2] = ABS(b->cacheid);
- TMsubcommit_list(s, 3);
- }
-
- /* load/create password BAT */
+ /* load/create password Column */
bid = CBPindex("M5system_auth_passwd_v2");
if (!bid) {
- b = BATnew(TYPE_oid, TYPE_str, 256);
+ b = COLnew(TYPE_str, 256);
if (b == NULL)
throw(MAL, "initTables.passwd", MAL_MALLOC_FAIL "
password table");
@@ -228,14 +173,13 @@
assert(b);
pass = b;
- /* load/create scenario BAT */
+ /* load/create scenario uid Column */
bid = CBPindex("M5system_auth_scen");
if (!bid) {
- b = BATnew(TYPE_oid, TYPE_str, 256);
+ b = COLnew( TYPE_oid, 256);
if (b == NULL)
throw(MAL, "initTables.scen", MAL_MALLOC_FAIL "
scenario table");
- COLkey(b, TRUE);
CBPrename(CBPcacheid(b), "M5system_auth_scen");
COLmode(b, PERSISTENT);
} else {
@@ -245,13 +189,29 @@
assert(b);
scen = b;
+ /* load/create scenario Column */
+ bid = CBPindex("M5system_auth_name");
+ if (!bid) {
+ b = COLnew( TYPE_str, 256);
+ if (b == NULL)
+ throw(MAL, "initTables.scen", MAL_MALLOC_FAIL "
scenario name table");
+
+ CBPrename(CBPcacheid(b), "M5system_auth_name");
+ COLmode(b, PERSISTENT);
+ } else {
+ b = COLdescriptor(bid);
+ isNew = 0;
+ }
+ assert(b);
+ name = b;
+
if (isNew == 1) {
/* insert the monetdb/monetdb administrator account on a
* complete fresh and new auth tables system */
str user = "monetdb";
str pw; /* will become the right hash for "monetdb" */
int len = (int) strlen(user);
- bat b = 0;
+ int b = 0;
str tmp;
oid uid;
Client c = &mal_clients[0];
@@ -286,26 +246,24 @@
str tmp, msg= MAL_SUCCEED;
str pwd = NULL;
str hash = NULL;
- BAT *b;
- oid p, q;
- oid *id;
- COLiter useri, passi;
+ COL *b;
+ oid o;
+ oid id;
rethrow("checkCredentials", tmp, AUTHrequireAdminOrUser(c, username));
assert(user);
assert(pass);
assert(scen);
+ assert(name);
if (*username == NULL || strNil(*username))
throw(INVCRED, "checkCredentials", "invalid credentials for
unknown user");
- p = BUNfnd(BATmirror(user), *username);
- if (p == BUN_NONE) {
+ id = BUNfnd(user, *username);
+ if (id == BUN_NONE) {
/* DO NOT reveal that the user doesn't exist here! */
throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER "
'%s'", *username);
}
- useri = col_iterator(user);
- id = (oid*)(BUNhead(useri, p));
/* a NULL password is impossible (since we should be dealing with
* hashes here) so we can bail out immediately
@@ -316,10 +274,7 @@
}
/* find the corresponding password to the user */
- q = BUNfnd(pass, id);
- assert (q != BUN_NONE);
- passi = col_iterator(pass);
- tmp = (str)BUNtail(passi, q);
+ tmp = COLgetString(pass,id);
assert (tmp != NULL);
/* decypher the password (we lose the original tmp here) */
rethrow("checkCredentials", tmp, AUTHdecypherValue(&pwd, &tmp));
@@ -341,59 +296,57 @@
/* now see if the scenario is permitted (if restrictions for that
* apply)
*/
- b = COLselect(scen, id, id);
+ b = COLselect(scen, &id, &id);
if (b && COLcount(b) > 0) {
- COLiter bi = col_iterator(b);
+ oid *lbase= (oid*) COLbase(b);
if (*scenario == NULL || strNil(*scenario)) {
- CBPunfix(b->cacheid);
+ CBPreleaseref(b);
/* of course we DO NOT tell the exact reason here again
*/
throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER
" '%s'",*username);
}
/* ok, there are some tuples that we have to consider */
- COLloop(b, p, q) {
- tmp = (str)BUNtail(bi, p);
- assert (tmp != NULL);
- if (strcmp(*scenario, tmp) == 0) {
+ COLforloop(b, o) {
+ if (strcmp(*scenario, COLgetString(name,lbase[o])) ==
0) {
/* YAY! fun! party! We are granted access! */
- *uid = *id;
- CBPunfix(b->cacheid);
+ *uid = id;
+ CBPreleaseref(b);
return(MAL_SUCCEED);
}
}
- CBPunfix(b->cacheid);
+ CBPreleaseref(b);
/* uh oh... that we made it till here means it's wrong */
throw(INVCRED, "checkCredentials", INVCRED_INVALID_USER "
'%s'", *username);
} else {
/* no scenario restriction applies, so everything is good */
if (b)
- CBPunfix(b->cacheid);
- *uid = *id;
+ CBPreleaseref(b);
+ *uid = id;
return(MAL_SUCCEED);
}
}
/**
* Adds the given user with password to the administration. The scens
- * BAT contains all scenarios allowed for the user. If NULL or empty,
+ * Column contains all scenarios allowed for the user. If NULL or empty,
* no restrictions for a scenario applies. The return value of this
* function is the user id of the added user.
*/
str
AUTHaddUser(oid *uid, Client *c, str *username, str *passwd, bat *scenarios) {
- oid p, q;
_______________________________________________
Checkin-list mailing list
[email protected]
http://mail.monetdb.org/mailman/listinfo/checkin-list
