Borawski.Lukasz | 86e1b66 | 2018-01-19 14:22:14 +0100 | [diff] [blame] | 1 | /* |
| 2 | // Copyright (c) 2018 Intel Corporation |
| 3 | // |
| 4 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | // you may not use this file except in compliance with the License. |
| 6 | // You may obtain a copy of the License at |
| 7 | // |
| 8 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | // |
| 10 | // Unless required by applicable law or agreed to in writing, software |
| 11 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | // See the License for the specific language governing permissions and |
| 14 | // limitations under the License. |
| 15 | */ |
| 16 | #pragma once |
| 17 | |
Tanous | f00032d | 2018-11-05 01:18:10 -0300 | [diff] [blame] | 18 | #include <crow/logging.h> |
| 19 | |
| 20 | #include <array> |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 21 | #include <bitset> |
Tanous | f00032d | 2018-11-05 01:18:10 -0300 | [diff] [blame] | 22 | #include <boost/beast/http/verb.hpp> |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 23 | #include <boost/container/flat_map.hpp> |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 24 | #include <cstdint> |
| 25 | #include <vector> |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 26 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 27 | namespace redfish |
| 28 | { |
| 29 | |
| 30 | enum class PrivilegeType |
| 31 | { |
| 32 | BASE, |
| 33 | OEM |
| 34 | }; |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 35 | |
Ed Tanous | a692779 | 2018-03-06 10:01:57 -0800 | [diff] [blame] | 36 | /** @brief A fixed array of compile time privileges */ |
| 37 | constexpr std::array<const char*, 5> basePrivileges{ |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 38 | "Login", "ConfigureManager", "ConfigureComponents", "ConfigureSelf", |
| 39 | "ConfigureUsers"}; |
Borawski.Lukasz | 43a095a | 2018-02-19 15:39:01 +0100 | [diff] [blame] | 40 | |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 41 | constexpr const int basePrivilegeCount = basePrivileges.size(); |
Ed Tanous | a692779 | 2018-03-06 10:01:57 -0800 | [diff] [blame] | 42 | |
| 43 | /** @brief Max number of privileges per type */ |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 44 | constexpr const int maxPrivilegeCount = 32; |
Ed Tanous | a692779 | 2018-03-06 10:01:57 -0800 | [diff] [blame] | 45 | |
| 46 | /** @brief A vector of all privilege names and their indexes */ |
| 47 | static const std::vector<std::string> privilegeNames{basePrivileges.begin(), |
| 48 | basePrivileges.end()}; |
Borawski.Lukasz | 43a095a | 2018-02-19 15:39:01 +0100 | [diff] [blame] | 49 | |
Borawski.Lukasz | 86e1b66 | 2018-01-19 14:22:14 +0100 | [diff] [blame] | 50 | /** |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 51 | * @brief Redfish privileges |
| 52 | * |
| 53 | * Entity privileges and user privileges are represented by this class. |
| 54 | * |
Ed Tanous | 55c7b7a | 2018-05-22 15:27:24 -0700 | [diff] [blame] | 55 | * Each incoming Connection requires a comparison between privileges held |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 56 | * by the user issuing a request and the target entity's privileges. |
| 57 | * |
| 58 | * To ensure best runtime performance of this comparison, privileges |
| 59 | * are represented as bitsets. Each bit in the bitset corresponds to a |
| 60 | * unique privilege name. |
| 61 | * |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 62 | * A bit is set if the privilege is required (entity domain) or granted |
| 63 | * (user domain) and false otherwise. |
| 64 | * |
Borawski.Lukasz | 86e1b66 | 2018-01-19 14:22:14 +0100 | [diff] [blame] | 65 | */ |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 66 | class Privileges |
| 67 | { |
| 68 | public: |
| 69 | /** |
| 70 | * @brief Constructs object without any privileges active |
| 71 | * |
| 72 | */ |
| 73 | Privileges() = default; |
Borawski.Lukasz | 43a095a | 2018-02-19 15:39:01 +0100 | [diff] [blame] | 74 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 75 | /** |
| 76 | * @brief Constructs object with given privileges active |
| 77 | * |
| 78 | * @param[in] privilegeList List of privileges to be activated |
| 79 | * |
| 80 | */ |
| 81 | Privileges(std::initializer_list<const char*> privilegeList) |
| 82 | { |
| 83 | for (const char* privilege : privilegeList) |
| 84 | { |
| 85 | if (!setSinglePrivilege(privilege)) |
| 86 | { |
| 87 | BMCWEB_LOG_CRITICAL << "Unable to set privilege " << privilege |
| 88 | << "in constructor"; |
| 89 | } |
| 90 | } |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 91 | } |
| 92 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 93 | /** |
| 94 | * @brief Sets given privilege in the bitset |
| 95 | * |
| 96 | * @param[in] privilege Privilege to be set |
| 97 | * |
| 98 | * @return None |
| 99 | * |
| 100 | */ |
| 101 | bool setSinglePrivilege(const char* privilege) |
| 102 | { |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 103 | for (int searchIndex = 0; searchIndex < privilegeNames.size(); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 104 | searchIndex++) |
| 105 | { |
| 106 | if (privilege == privilegeNames[searchIndex]) |
| 107 | { |
| 108 | privilegeBitset.set(searchIndex); |
| 109 | return true; |
| 110 | } |
| 111 | } |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 112 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 113 | return false; |
Ed Tanous | a692779 | 2018-03-06 10:01:57 -0800 | [diff] [blame] | 114 | } |
| 115 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 116 | /** |
| 117 | * @brief Sets given privilege in the bitset |
| 118 | * |
| 119 | * @param[in] privilege Privilege to be set |
| 120 | * |
| 121 | * @return None |
| 122 | * |
| 123 | */ |
| 124 | bool setSinglePrivilege(const std::string& privilege) |
| 125 | { |
| 126 | return setSinglePrivilege(privilege.c_str()); |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 127 | } |
Ed Tanous | a692779 | 2018-03-06 10:01:57 -0800 | [diff] [blame] | 128 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 129 | /** |
| 130 | * @brief Retrieves names of all active privileges for a given type |
| 131 | * |
| 132 | * @param[in] type Base or OEM |
| 133 | * |
| 134 | * @return Vector of active privileges. Pointers are valid until |
| 135 | * the setSinglePrivilege is called, or the Privilege structure is destroyed |
| 136 | * |
| 137 | */ |
| 138 | std::vector<const std::string*> |
| 139 | getActivePrivilegeNames(const PrivilegeType type) const |
| 140 | { |
| 141 | std::vector<const std::string*> activePrivileges; |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 142 | |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 143 | int searchIndex = 0; |
| 144 | int endIndex = basePrivilegeCount; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 145 | if (type == PrivilegeType::OEM) |
| 146 | { |
| 147 | searchIndex = basePrivilegeCount - 1; |
| 148 | endIndex = privilegeNames.size(); |
| 149 | } |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 150 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 151 | for (; searchIndex < endIndex; searchIndex++) |
| 152 | { |
| 153 | if (privilegeBitset.test(searchIndex)) |
| 154 | { |
| 155 | activePrivileges.emplace_back(&privilegeNames[searchIndex]); |
| 156 | } |
| 157 | } |
| 158 | |
| 159 | return activePrivileges; |
| 160 | } |
| 161 | |
| 162 | /** |
| 163 | * @brief Determines if this Privilege set is a superset of the given |
| 164 | * privilege set |
| 165 | * |
| 166 | * @param[in] privilege Privilege to be checked |
| 167 | * |
| 168 | * @return None |
| 169 | * |
| 170 | */ |
| 171 | bool isSupersetOf(const Privileges& p) const |
| 172 | { |
| 173 | return (privilegeBitset & p.privilegeBitset) == p.privilegeBitset; |
| 174 | } |
| 175 | |
| 176 | private: |
| 177 | std::bitset<maxPrivilegeCount> privilegeBitset = 0; |
Borawski.Lukasz | 86e1b66 | 2018-01-19 14:22:14 +0100 | [diff] [blame] | 178 | }; |
| 179 | |
Ratan Gupta | 6f35956 | 2019-04-03 10:39:08 +0530 | [diff] [blame] | 180 | inline const Privileges& getUserPrivileges(const std::string& userRole) |
| 181 | { |
| 182 | // Redfish privilege : Administrator |
| 183 | if (userRole == "priv-admin") |
| 184 | { |
| 185 | static Privileges admin{"Login", "ConfigureManager", "ConfigureSelf", |
| 186 | "ConfigureUsers", "ConfigureComponents"}; |
| 187 | return admin; |
| 188 | } |
| 189 | else if (userRole == "priv-operator") |
| 190 | { |
| 191 | // Redfish privilege : Operator |
| 192 | static Privileges op{"Login", "ConfigureSelf", "ConfigureComponents"}; |
| 193 | return op; |
| 194 | } |
anil kumar appana | 8e69d14 | 2019-08-26 12:49:15 +0000 | [diff] [blame^] | 195 | else if (userRole == "priv-user") |
Ratan Gupta | 6f35956 | 2019-04-03 10:39:08 +0530 | [diff] [blame] | 196 | { |
| 197 | // Redfish privilege : Readonly |
| 198 | static Privileges readOnly{"Login", "ConfigureSelf"}; |
| 199 | return readOnly; |
| 200 | } |
anil kumar appana | 8e69d14 | 2019-08-26 12:49:15 +0000 | [diff] [blame^] | 201 | else |
| 202 | { |
| 203 | // Redfish Privilege : No privileges for callback users |
| 204 | static Privileges noPriv{}; |
| 205 | return noPriv; |
| 206 | } |
Ratan Gupta | 6f35956 | 2019-04-03 10:39:08 +0530 | [diff] [blame] | 207 | } |
| 208 | |
Ed Tanous | e0d918b | 2018-03-27 17:41:04 -0700 | [diff] [blame] | 209 | using OperationMap = boost::container::flat_map<boost::beast::http::verb, |
| 210 | std::vector<Privileges>>; |
Borawski.Lukasz | 43a095a | 2018-02-19 15:39:01 +0100 | [diff] [blame] | 211 | |
| 212 | /** |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 213 | * @brief Checks if given privileges allow to call an HTTP method |
| 214 | * |
| 215 | * @param[in] method HTTP method |
| 216 | * @param[in] user Privileges |
| 217 | * |
| 218 | * @return True if method allowed, false otherwise |
Borawski.Lukasz | 43a095a | 2018-02-19 15:39:01 +0100 | [diff] [blame] | 219 | * |
| 220 | */ |
Ed Tanous | e0d918b | 2018-03-27 17:41:04 -0700 | [diff] [blame] | 221 | inline bool isMethodAllowedWithPrivileges(const boost::beast::http::verb method, |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 222 | const OperationMap& operationMap, |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 223 | const Privileges& userPrivileges) |
| 224 | { |
| 225 | const auto& it = operationMap.find(method); |
| 226 | if (it == operationMap.end()) |
| 227 | { |
| 228 | return false; |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 229 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 230 | |
| 231 | // If there are no privileges assigned, assume no privileges required |
| 232 | if (it->second.empty()) |
| 233 | { |
| 234 | return true; |
| 235 | } |
| 236 | |
| 237 | for (auto& requiredPrivileges : it->second) |
| 238 | { |
| 239 | if (userPrivileges.isSupersetOf(requiredPrivileges)) |
| 240 | { |
| 241 | return true; |
| 242 | } |
| 243 | } |
| 244 | return false; |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 245 | } |
Borawski.Lukasz | aecb47a | 2018-01-25 12:14:14 +0100 | [diff] [blame] | 246 | |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 247 | /** |
| 248 | * @brief Checks if a user is allowed to call an HTTP method |
| 249 | * |
| 250 | * @param[in] method HTTP method |
| 251 | * @param[in] user Username |
| 252 | * |
| 253 | * @return True if method allowed, false otherwise |
| 254 | * |
| 255 | */ |
Ed Tanous | e0d918b | 2018-03-27 17:41:04 -0700 | [diff] [blame] | 256 | inline bool isMethodAllowedForUser(const boost::beast::http::verb method, |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 257 | const OperationMap& operationMap, |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 258 | const std::string& user) |
| 259 | { |
| 260 | // TODO: load user privileges from configuration as soon as its available |
| 261 | // now we are granting all privileges to everyone. |
| 262 | Privileges userPrivileges{"Login", "ConfigureManager", "ConfigureSelf", |
| 263 | "ConfigureUsers", "ConfigureComponents"}; |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 264 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 265 | return isMethodAllowedWithPrivileges(method, operationMap, userPrivileges); |
Ed Tanous | 3ebd75f | 2018-03-05 18:20:01 -0800 | [diff] [blame] | 266 | } |
Borawski.Lukasz | 86e1b66 | 2018-01-19 14:22:14 +0100 | [diff] [blame] | 267 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 268 | } // namespace redfish |