Merge ~epics-core/epics-base/+git/asLib:as-groups into ~epics-core/epics-base/+git/epics-base:7.0

[mdavidsaver]

First attempt to add the notion of groups (in the unix getgrent() sense) to asLib. As I want to preserve acf file compatibility with previous Base releases I'm not changing the parser, instead a "group" appears in a UAG() with a magic prefix "group:".

This branch changes only the core asLib. It won't be possible to use w/ CA. My intended user is PVA, which has the potential to transport a list of group names.

The main API change is the introduction of variants of asAddClient()and asChangeClient() which move most of the argument list to a structure. I also place an arbitrary limit of 16 groups to keep the API simple.

[mdavidsaver (mdavidsaver)]

I'll be pushing changes to github as well, so CI build results are available. Look for "as-groups" at https://travis-ci.org/mdavidsaver/epics-base/branches

[mdavidsaver (mdavidsaver)]

Georg Weiss says:

> ... limit of 16, but this might be a bit too conservative in my opinion ...

https://github.com/epics-base/pvAccessCPP/pull/136#issuecomment-453932984

Which I agree with. So this proposed API will need to change.

I'd still like to get some comment on the idea...

review: Needs Fixing

[mdavidsaver (mdavidsaver)]

Rather then try to use asLib in the PVA gateway, I've written my own parser. This will use 'UAG(BLAH){role:...}'.

Unmerged commits

a6ccaf3... by mdavidsaver on 2018-11-14

asLib test user groups

9e30bc7... by mdavidsaver on 2018-06-16

as: add user groups

Allow clients to provide a user name and list of group names.
user and group names appear in the same namespace, but
group names are required to start with "group:".

A rule matches if a UAG contain the client user name,
or any of the client's group names.

ef45f3f... by mdavidsaver on 2018-11-14

add asAddClient2() pass args in struct

diff --git a/modules/libcom/src/as/asLib.h b/modules/libcom/src/as/asLib.h
index 261e5ed..ba290aa 100644
--- a/modules/libcom/src/as/asLib.h
+++ b/modules/libcom/src/as/asLib.h
@@ -21,6 +21,8 @@
 extern "C" {
 #endif
 
+#define ASMAXGROUPS 16
+
 typedef struct asgMember *ASMEMBERPVT;
 typedef struct asgClient *ASCLIENTPVT;
 typedef int (*ASINPUTFUNCPTR)(char *buf,int max_size);
@@ -29,6 +31,13 @@ typedef enum{
     /*For now this is all*/
 } asClientStatus;
 
+typedef struct asClientInfo {
+    int asl;
+    char *user;
+    char *host;
+    char *groups[ASMAXGROUPS]; /* unused must be NULL */
+} asClientInfo;
+
 typedef void (*ASCLIENTCALLBACK) (ASCLIENTPVT,asClientStatus);
 
 /* The following  routines are macros with the following syntax
@@ -77,13 +86,20 @@ epicsShareFunc long epicsShareAPI asChangeGroup(
 epicsShareFunc void * epicsShareAPI asGetMemberPvt(ASMEMBERPVT asMemberPvt);
 epicsShareFunc void epicsShareAPI asPutMemberPvt(
     ASMEMBERPVT asMemberPvt,void *userPvt);
-/*client must provide permanent storage for user and host*/
+/* user and host must remain valid until asRemoveClient().  host is modified (normalized)*/
 epicsShareFunc long epicsShareAPI asAddClient(
     ASCLIENTPVT *asClientPvt,ASMEMBERPVT asMemberPvt,
     int asl,const char *user,char *host);
-/*client must provide permanent storage for user and host*/
+/* info->user and info->host must remain valid until asRemoveClient().  info->host is modified (normalized)*/
+epicsShareFunc long epicsShareAPI asAddClient2(
+        ASCLIENTPVT *asClientPvt,ASMEMBERPVT asMemberPvt,
+        asClientInfo *info);
+/* user and host must remain valid until asRemoveClient().  host is modified (normalized)*/
 epicsShareFunc long epicsShareAPI asChangeClient(
     ASCLIENTPVT asClientPvt,int asl,const char *user,char *host);
+/* info->user and info->host must remain valid until asRemoveClient().  info->host is modified (normalized)*/
+epicsShareFunc long epicsShareAPI asChangeClient2(
+    ASCLIENTPVT asClientPvt,asClientInfo *info);
 epicsShareFunc long epicsShareAPI asRemoveClient(ASCLIENTPVT *asClientPvt);
 epicsShareFunc void * epicsShareAPI asGetClientPvt(ASCLIENTPVT asClientPvt);
 epicsShareFunc void epicsShareAPI asPutClientPvt(
@@ -226,6 +242,7 @@ typedef struct asgClient {
 	ASGMEMBER	*pasgMember;
 	const char	*user;
 	char	        *host;
+    char        *groups[ASMAXGROUPS];
 	void		*userPvt;
 	ASCLIENTCALLBACK pcallback;
 	int		level;
diff --git a/modules/libcom/src/as/asLibRoutines.c b/modules/libcom/src/as/asLibRoutines.c
index 3f5713e..0ebc14e 100644
--- a/modules/libcom/src/as/asLibRoutines.c
+++ b/modules/libcom/src/as/asLibRoutines.c
@@ -354,9 +354,33 @@ void epicsShareAPI asPutMemberPvt(ASMEMBERPVT asMemberPvt,void *userPvt)
     pasgmember->userPvt = userPvt;
     return;
 }
-

-long epicsShareAPI asAddClient(ASCLIENTPVT *pasClientPvt,ASMEMBERPVT asMemberPvt,
-	int asl,const char *user,char *host)
+
+static int asCheckGroupNames(const asClientInfo *info)
+{
+    unsigned i;
+    int seennull=0;
+    for(i=0; i<ASMAXGROUPS; i++) {
+        if(!info->groups[i]) {
+            seennull = 1;
+
+        } else {
+            size_t len = strlen(info->groups[i]);
+            if(seennull) {
+                errlogPrintf("as API error: asClientInfo::groups[] must be contigious\n");
+                return 1;
+            } else if(len<=6 || strncmp("group:", info->groups[i], 6)!=0) {
+                errlogPrintf("as API error: group names must begin with \"group:\" and at least one charactor, not '%s'",
+                             info->groups[i]);
+                return 1;
+            }
+        }
+    }
+    return 0;
+}
+
+epicsShareFunc long epicsShareAPI asAddClient2(
+        ASCLIENTPVT *pasClientPvt,ASMEMBERPVT asMemberPvt,
+        asClientInfo *info)
 {
     ASGMEMBER	*pasgmember = asMemberPvt;
     ASGCLIENT	*pasgclient;
@@ -364,18 +388,20 @@ long epicsShareAPI asAddClient(ASCLIENTPVT *pasClientPvt,ASMEMBERPVT asMemberPvt
 
     long	status;
     if(!asActive) return(S_asLib_asNotActive);
-    if(!pasgmember) return(S_asLib_badMember);
+    if(!pasgmember || !info || asCheckGroupNames(info)) return(S_asLib_badMember);
     pasgclient = freeListCalloc(freeListPvt);
     if(!pasgclient) return(S_asLib_noMemory);
-    len = strlen(host);
+    len = strlen(info->host);
     for (i = 0; i < len; i++) {
-        host[i] = (char)tolower((int)host[i]);
+        info->host[i] = (char)tolower((int)info->host[i]);
     }
     *pasClientPvt = pasgclient;
     pasgclient->pasgMember = asMemberPvt;
-    pasgclient->level = asl;
-    pasgclient->user = user;
-    pasgclient->host = host;
+    pasgclient->level = info->asl;
+    pasgclient->user = info->user;
+    pasgclient->host = info->host;
+    STATIC_ASSERT(sizeof(pasgclient->groups)==sizeof(info->groups));
+    memcpy(pasgclient->groups, info->groups, sizeof(info->groups));
     LOCK;
     ellAdd(&pasgmember->clientList,&pasgclient->node);
     status = asComputePvt(pasgclient);
@@ -383,28 +409,43 @@ long epicsShareAPI asAddClient(ASCLIENTPVT *pasClientPvt,ASMEMBERPVT asMemberPvt
     return(status);
 }
 
-long epicsShareAPI asChangeClient(
-    ASCLIENTPVT asClientPvt,int asl,const char *user,char *host)
+long epicsShareAPI asAddClient(ASCLIENTPVT *pasClientPvt,ASMEMBERPVT asMemberPvt,
+    int asl,const char *user,char *host)
+{
+    asClientInfo info = {asl, (char*)user, host};
+    return asAddClient2(pasClientPvt, asMemberPvt, &info);
+}
+
+long epicsShareAPI asChangeClient2(
+    ASCLIENTPVT asClientPvt,asClientInfo *info)
 {
     ASGCLIENT	*pasgclient = asClientPvt;
     long	status;
     int		len, i;
 
     if(!asActive) return(S_asLib_asNotActive);
-    if(!pasgclient) return(S_asLib_badClient);
-    len = strlen(host);
+    if(!pasgclient || asCheckGroupNames(info)) return(S_asLib_badClient);
+    len = strlen(info->host);
     for (i = 0; i < len; i++) {
-        host[i] = (char)tolower((int)host[i]);
+        info->host[i] = (char)tolower((int)info->host[i]);
     }
     LOCK;
-    pasgclient->level = asl;
-    pasgclient->user = user;
-    pasgclient->host = host;
+    pasgclient->level = info->asl;
+    pasgclient->user = info->user;
+    pasgclient->host = info->host;
+    memcpy(pasgclient->groups, info->groups, sizeof(info->groups));
     status = asComputePvt(pasgclient);
     UNLOCK;
     return(status);
 }
 
+long epicsShareAPI asChangeClient(
+    ASCLIENTPVT asClientPvt,int asl,const char *user,char *host)
+{
+    asClientInfo info = {asl, (char*)user, host};
+    return asChangeClient2(asClientPvt, &info);
+}
+
 long epicsShareAPI asRemoveClient(ASCLIENTPVT *asClientPvt)
 {
     ASGCLIENT	*pasgclient = *asClientPvt;
@@ -999,11 +1040,15 @@ static long asComputePvt(ASCLIENTPVT asClientPvt)
 
 	    pasguag = (ASGUAG *)ellFirst(&pasgrule->uagList);
 	    while(pasguag) {
-		if((puag = pasguag->puag)) {
-		    pgphentry = gphFind(pasbase->phash,pasgclient->user,puag);
-		    if(pgphentry) goto check_hag;
-		}
-		pasguag = (ASGUAG *)ellNext(&pasguag->node);
+            if((puag = pasguag->puag)) {
+                unsigned i;
+                int match = gphFind(pasbase->phash,pasgclient->user,puag)!=NULL;
+                for(i=0; !match && i<ASMAXGROUPS && pasgclient->groups[i]; i++) {
+                    match = gphFind(pasbase->phash,pasgclient->groups[i],puag)!=NULL;
+                }
+                if(match) goto check_hag;
+            }
+            pasguag = (ASGUAG *)ellNext(&pasguag->node);
 	    }
 	    goto next_rule;
 	}
diff --git a/modules/libcom/test/aslibtest.c b/modules/libcom/test/aslibtest.c
index 875aa56..34bd4d1 100644
--- a/modules/libcom/test/aslibtest.c
+++ b/modules/libcom/test/aslibtest.c
@@ -18,7 +18,8 @@
 #include <asLib.h>
 
 static char *asUser,
-            *asHost;
+            *asHost,
+            *asGroup;
 static int asAsl;
 
 static void setUser(const char *name)
@@ -33,18 +34,31 @@ static void setHost(const char *name)
     asHost = epicsStrDup(name);
 }
 
+static void setGroup(const char *name)
+{
+    free(asGroup);
+    asGroup = name ? epicsStrDup(name) : NULL;
+}
+
 static void testAccess(const char *asg, unsigned mask)
 {
     ASMEMBERPVT asp = 0; /* aka dbCommon::asp */
     ASCLIENTPVT client = 0;
+    asClientInfo info;
     long ret;
 
+    memset(&info, 0, sizeof(info));
+    info.asl = asAsl;
+    info.user = asUser;
+    info.host = asHost;
+    info.groups[0] = asGroup;
+
     ret = asAddMember(&asp, asg);
     if(ret) {
         testFail("testAccess(ASG:%s, USER:%s, HOST:%s, ASL:%d) -> asAddMember error: %s",
                  asg, asUser, asHost, asAsl, errSymMsg(ret));
     } else {
-        ret = asAddClient(&client, asp, asAsl, asUser, asHost);
+        ret = asAddClient2(&client, asp, &info);
     }
     if(ret) {
         testFail("testAccess(ASG:%s, USER:%s, HOST:%s, ASL:%d) -> asAddClient error: %s",
@@ -109,11 +123,47 @@ static void testHostNames(void)
     testAccess("ro", 0);
     testAccess("rw", 0);
 }
+static void testGroup(void)
+{
+    static const char config[] = ""
+         "UAG(foo) {theuser}"
+         "UAG(bar) {group:thegroup}"
+         "ASG(DEFAULT) {RULE(0, NONE)}"
+         "ASG(ro) {RULE(0, NONE)RULE(1, READ) {UAG(foo)}}"
+         "ASG(rw) {RULE(1, WRITE) {UAG(bar)}}"
+            ;
+    testDiag("testGroup()");
+
+    testOk1(asInitMem(config, NULL)==0);
+
+    setHost("localhost");
+    asAsl = 0;
+
+    setUser("theuser");
+    setGroup(NULL);
+
+    testAccess("ro", 1);
+    testAccess("rw", 0);
+
+    setUser("random");
+    setGroup("group:thegroup");
+
+    testAccess("ro", 0);
+    testAccess("rw", 3);
+
+    setUser("theuser");
+    setGroup("group:thegroup");
+
+    testAccess("ro", 1);
+    testAccess("rw", 3);
+}
+
 MAIN(aslibtest)
 {
-    testPlan(14);
+    testPlan(21);
     testSyntaxErrors();
     testHostNames();
+    testGroup();
     errlogFlush();
     return testDone();
 }