Merge lp:~ansharyan015/drizzle/auth_file_dynamic into lp:drizzle

[Daniel Nichter]

[Daniel Nichter (daniel-nichter)]

Overall the changes look godo. There are minor code style changes for later perhaps, like in

bool AuthFile::setUsersFile(std::string& usersFile)

the arg should probably be called "users_file" instead. Similarly, the use of "*_dummy" vars are more clear when named "new_*" (e.g. new_users_file), as was done in regex_policy.

review: Approve (code review)

=== modified file 'plugin/auth_file/auth_file.cc'
--- plugin/auth_file/auth_file.cc	2012-01-15 20:54:59 +0000
+++ plugin/auth_file/auth_file.cc	2012-06-06 03:05:26 +0000
@@ -27,6 +27,7 @@
 #include <boost/program_options.hpp>
 #include <boost/filesystem.hpp>
 
+#include <drizzled/item.h>
 #include <drizzled/configmake.h>
 #include <drizzled/plugin/authentication.h>
 #include <drizzled/identifier.h>
@@ -43,24 +44,22 @@
 namespace auth_file {
 
 static const fs::path DEFAULT_USERS_FILE= SYSCONFDIR "/drizzle.users";
+typedef std::map<string, string> users_t;
+bool updateUsersFile(Session *, set_var *);
+bool parseUsersFile(std::string, users_t&);
 
 class AuthFile : public plugin::Authentication
 {
 public:
-  AuthFile(fs::path users_file_arg);
+  AuthFile(std::string users_file_arg);
 
   /**
    * Retrieve the last error encountered in the class.
    */
   const string& getError() const;
 
-  /**
-   * Load the users file into a map cache.
-   *
-   * @return True on success, false on error. If false is returned an error
-   *  is set and can be retrieved with getError().
-   */
-  bool loadFile();
+  std::string& getUsersFile();
+  bool setUsersFile(std::string& usersFile);
 
 private:
 
@@ -85,18 +84,29 @@
                        const string &scrambled_password);
 
   string error;
-  const fs::path users_file;
+  fs::path users_file;
+  std::string sysvar_users_file;
 
   /**
    * Cache or username:password entries from the file.
    */
-  typedef std::map<string, string> users_t;
   users_t users;
+  /**
+   * This method is called to update the users cache with the new 
+   * username:password pairs given in new users file upon update.
+   */
+  void setUsers(users_t);
+  /**
+   * This method is called to delete all the cached username:password pairs
+   * when users file is updated.
+   */
+  void clearUsers();
 };
+AuthFile *auth_file= NULL;
 
-AuthFile::AuthFile(fs::path users_file_arg) :
+AuthFile::AuthFile(std::string users_file_arg) :
   plugin::Authentication("auth_file"),
-  users_file(users_file_arg)
+  users_file(users_file_arg), sysvar_users_file(users_file_arg)
 {
 }
 
@@ -105,41 +115,29 @@
   return error;
 }
 
-bool AuthFile::loadFile()
-{
-  ifstream file(users_file.string().c_str());
-
-  if (!file.is_open())
-  {
-    error = "Could not open users file: " + users_file.string();
-    return false;
-  }
-
-  string line;
-  while (getline(file, line))
-  {
-    /* Ignore blank lines and lines starting with '#'. */
-    if (line.empty() || line[line.find_first_not_of(" \t")] == '#')
-      continue;
-
-    string username;
-    string password;
-    size_t password_offset = line.find(":");
-    if (password_offset == string::npos)
-      username = line;
-    else
-    {
-      username = string(line, 0, password_offset);
-      password = string(line, password_offset + 1);
-    }
-
-    if (not users.insert(pair<string, string>(username, password)).second)
-    {
-      error = "Duplicate entry found in users file: " + username;
-      return false;
-    }
-  }
-  return true;
+std::string& AuthFile::getUsersFile()
+{
+  return sysvar_users_file;
+}
+
+bool AuthFile::setUsersFile(std::string& usersFile)
+{
+  if (usersFile.empty())
+  {
+    errmsg_printf(error::ERROR, _("users file cannot be an empty string"));
+    return false;  // error
+  }
+  users_t users_dummy;
+  if(parseUsersFile(usersFile, users_dummy))
+  {
+    this->clearUsers();
+    this->setUsers(users_dummy);
+    sysvar_users_file= usersFile;
+    fs::path newUsersFile(getUsersFile());
+    users_file= newUsersFile;
+    return true;  //success
+  }
+  return false;  // error
 }
 
 bool AuthFile::verifyMySQLHash(const string &password,
@@ -195,12 +193,96 @@
     : password == *user;
 }
 
+void AuthFile::setUsers(users_t users_dummy)
+{
+  users.insert(users_dummy.begin(), users_dummy.end());
+}
+
+void AuthFile::clearUsers()
+{
+  users.clear();
+}
+
+/**
+ * This function is called when the value of users file is changed in the system.
+ *
+ * @return False on success, True on error.
+ */
+bool updateUsersFile(Session *, set_var* var)
+{
+  if (not var->value->str_value.empty())
+  {
+    std::string newUsersFile(var->value->str_value.data());
+    if (auth_file->setUsersFile(newUsersFile))
+      return false; //success
+    else
+      return true; // error
+  }
+  errmsg_printf(error::ERROR, _("auth_file file cannot be NULL"));
+  return true; // error
+}
+
+/**
+ * Parse the users file into a map cache.
+ *
+ * @return True on success, false on error. If an error is encountered, false is
+ * returned with error message printed.
+ */
+bool parseUsersFile(std::string new_users_file, users_t& users_dummy)
+{
+  ifstream file(new_users_file.c_str());
+
+  if (!file.is_open())
+  {
+    string error_msg= "Could not open users file: " + new_users_file;
+    errmsg_printf(error::ERROR, _(error_msg.c_str()));
+    return false;
+  }
+
+  string line;
+  try
+  {
+    while (getline(file, line))
+    {
+      /* Ignore blank lines and lines starting with '#'. */
+      if (line.empty() || line[line.find_first_not_of(" \t")] == '#')
+        continue;
+
+      string username;
+      string password;
+      size_t password_offset = line.find(":");
+      if (password_offset == string::npos)
+        username = line;
+      else
+      {
+        username = string(line, 0, password_offset);
+        password = string(line, password_offset + 1);
+      }
+  
+      if (not users_dummy.insert(pair<string, string>(username, password)).second)
+      {
+        string error_msg= "Duplicate entry found in users file: " + username;
+        errmsg_printf(error::ERROR, _(error_msg.c_str()));
+        return false;
+      }
+    }
+    return true;
+  }
+  catch (const std::exception &e)
+  {
+    /* On any non-EOF break, unparseable line */
+    string error_msg= "Unable to parse users file " + new_users_file + ":" + e.what();
+    errmsg_printf(error::ERROR, _(error_msg.c_str()));
+    return false;
+  }
+}
+
 static int init(module::Context &context)
 {
   const module::option_map &vm= context.getOptions();
 
-  AuthFile *auth_file = new AuthFile(fs::path(vm["users"].as<string>()));
-  if (not auth_file->loadFile())
+  auth_file= new AuthFile(vm["users"].as<string>());
+  if (!auth_file->setUsersFile(auth_file->getUsersFile()))
   {
     errmsg_printf(error::ERROR, _("Could not load auth file: %s\n"), auth_file->getError().c_str());
     delete auth_file;
@@ -208,7 +290,7 @@
   }
 
   context.add(auth_file);
-  context.registerVariable(new sys_var_const_string_val("users", vm["users"].as<string>()));
+  context.registerVariable(new sys_var_std_string("users", auth_file->getUsersFile(), NULL, &updateUsersFile));
 
   return 0;
 }
 
=== modified file 'plugin/auth_file/docs/index.rst'
--- plugin/auth_file/docs/index.rst	2011-11-06 00:00:03 +0000
+++ plugin/auth_file/docs/index.rst	2012-06-06 03:05:26 +0000
@@ -7,8 +7,8 @@
 
    :program:`auth_file` is a security risk!  Do not use this plugin with production servers!
 
-:program:`auth_file` is an authentication plugin that authenticates connections
-using a list of ``username:password`` entries in a plain text file.
+:program:`auth_file` is an :doc:`/administration/authorization` plugin that authenticates connections
+using a list of ``username:password`` entries in a plain text file. When :program:`drizzled` is started with  ``--plugin-add=auth_file``, the file based authorization plugin is enabled with the default users file. Users file can be specified by either specifying ``--auth-file.users=<users file>`` at the time of server startup or by changing the ``auth_file_users`` with ``SET GLOBAL``.
 
 .. note::
 
@@ -61,7 +61,7 @@
 * ``auth_file_users``
 
    :Scope: Global
-   :Dynamic: No
+   :Dynamic: Yes
    :Option: :option:`--auth-file.users`
 
    File to load for usernames and passwords.
@@ -94,6 +94,17 @@
    Welcome to the Drizzle client..  Commands end with ; or \g.
    ...
 
+Changing users file at runtime
+-------------------------------
+
+Users file can be reloaded by::
+
+   SET GLOBAL auth_file_users=@@auth_file_users
+
+Moreover, the users file can be changed by::
+
+   SET GLOBAL auth_file_users=/path/to/new/users/file
+
 .. _auth_file_authors:
 
 Authors
 
=== added file 'plugin/auth_file/tests/r/dynamic_plugin.result'
--- plugin/auth_file/tests/r/dynamic_plugin.result	1970-01-01 00:00:00 +0000
+++ plugin/auth_file/tests/r/dynamic_plugin.result	2012-06-06 03:05:26 +0000
@@ -0,0 +1,10 @@
+SET GLOBAL auth_file_users="";
+ERROR HY000: Incorrect arguments to SET
+SET GLOBAL auth_file_users="TOP_SRCDIR/plugin/auth_file/tests/t/dynamic.users3";
+ERROR HY000: Incorrect arguments to SET
+SET GLOBAL auth_file_users="TOP_SRCDIR/plugin/auth_file/tests/t/dynamic.users2";
+connect(localhost,auth_file_password,test_password1,test,MASTER_PORT,);
+ERROR 28000: Access denied for user 'auth_file_password' (using password: YES)
+SELECT 1;
+1
+1
 
=== added file 'plugin/auth_file/tests/t/dynamic.users1'
--- plugin/auth_file/tests/t/dynamic.users1	1970-01-01 00:00:00 +0000
+++ plugin/auth_file/tests/t/dynamic.users1	2012-06-06 03:05:26 +0000
@@ -0,0 +1,3 @@
+# Always allow root user with no password for drizzletest program
+root
+auth_file_password:test_password1
 
=== added file 'plugin/auth_file/tests/t/dynamic.users2'
--- plugin/auth_file/tests/t/dynamic.users2	1970-01-01 00:00:00 +0000
+++ plugin/auth_file/tests/t/dynamic.users2	2012-06-06 03:05:26 +0000
@@ -0,0 +1,3 @@
+# Always allow root user with no password for drizzletest program
+root
+auth_file_password:test_password2
 
=== added file 'plugin/auth_file/tests/t/dynamic_plugin-master.opt'
--- plugin/auth_file/tests/t/dynamic_plugin-master.opt	1970-01-01 00:00:00 +0000
+++ plugin/auth_file/tests/t/dynamic_plugin-master.opt	2012-06-06 03:05:26 +0000
@@ -0,0 +1,1 @@
+--plugin-remove=auth_all --plugin-add=auth_file --auth-file.users=$TOP_SRCDIR/plugin/auth_file/tests/t/dynamic.users1
 
=== added file 'plugin/auth_file/tests/t/dynamic_plugin.test'
--- plugin/auth_file/tests/t/dynamic_plugin.test	1970-01-01 00:00:00 +0000
+++ plugin/auth_file/tests/t/dynamic_plugin.test	2012-06-06 03:05:26 +0000
@@ -0,0 +1,31 @@
+# Making connection using the username:password pair provided in dynamic.users1 file.
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+connect (connection1,localhost,auth_file_password,test_password1,,);
+connection connection1;
+
+#Test that the auth_file_users can't be replaced with an empty value
+--error ER_WRONG_ARGUMENTS
+SET GLOBAL auth_file_users="";
+
+#Test that the auth_file_users can't be replaced with a non existent file
+--replace_result $TOP_SRCDIR TOP_SRCDIR
+--error ER_WRONG_ARGUMENTS
+eval SET GLOBAL auth_file_users="$TOP_SRCDIR/plugin/auth_file/tests/t/dynamic.users3";
+
+#Test that the auth_file_users can be replaced with a different file
+--replace_result $TOP_SRCDIR TOP_SRCDIR
+eval SET GLOBAL auth_file_users="$TOP_SRCDIR/plugin/auth_file/tests/t/dynamic.users2";
+
+disconnect connection1;
+# Test that the connection to database can't be now made using the old username:password pair given in dynamic.users1 file.
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+--replace_regex /@'.*?'/@'LOCALHOST'/
+--error ER_ACCESS_DENIED_ERROR
+connect (connection2,localhost,auth_file_password,test_password1,,);
+
+# Test that the connection to database can now be made using the username:password pair provided in dynamic.users2 file
+--replace_result $MASTER_MYSOCK MASTER_SOCKET $MASTER_MYPORT MASTER_PORT
+connect (connection3,localhost,auth_file_password,test_password2,,);
+connection connection3;
+SELECT 1;
+disconnect connection3;