--- /dev/null
+module MCollective
+ module Security
+ # This is a base class the other security modules should inherit from
+ # it handles statistics and validation of messages that should in most
+ # cases apply to all security models.
+ #
+ # To create your own security plugin you should provide a plugin that inherits
+ # from this and provides the following methods:
+ #
+ # decodemsg - Decodes a message that was received from the middleware
+ # encodereply - Encodes a reply message to a previous request message
+ # encoderequest - Encodes a new request message
+ # validrequest? - Validates a request received from the middleware
+ #
+ # Optionally if you are identifying users by some other means like certificate name
+ # you can provide your own callerid method that can provide the rest of the system
+ # with an id, and you would see this id being usable in SimpleRPC authorization methods
+ #
+ # The @initiated_by variable will be set to either :client or :node depending on
+ # who is using this plugin. This is to help security providers that operate in an
+ # asymetric mode like public/private key based systems.
+ #
+ # Specifics of each of these are a bit fluid and the interfaces for this is not
+ # set in stone yet, specifically the encode methods will be provided with a helper
+ # that takes care of encoding the core requirements. The best place to see how security
+ # works is by looking at the provided MCollective::Security::PSK plugin.
+ class Base
+ attr_reader :stats
+ attr_accessor :initiated_by
+
+ # Register plugins that inherits base
+ def self.inherited(klass)
+ PluginManager << {:type => "security_plugin", :class => klass.to_s}
+ end
+
+ # Initializes configuration and logging as well as prepare a zero'd hash of stats
+ # various security methods and filter validators should increment stats, see MCollective::Security::Psk for a sample
+ def initialize
+ @config = Config.instance
+ @log = Log
+ @stats = PluginManager["global_stats"]
+ end
+
+ # Takes a Hash with a filter in it and validates it against host information.
+ #
+ # At present this supports filter matches against the following criteria:
+ #
+ # - puppet_class|cf_class - Presence of a configuration management class in
+ # the file configured with classesfile
+ # - agent - Presence of a MCollective agent with a supplied name
+ # - fact - The value of a fact avout this system
+ # - identity - the configured identity of the system
+ #
+ # TODO: Support REGEX and/or multiple filter keys to be AND'd
+ def validate_filter?(filter)
+ failed = 0
+ passed = 0
+
+ passed = 1 if Util.empty_filter?(filter)
+
+ filter.keys.each do |key|
+ case key
+ when /puppet_class|cf_class/
+ filter[key].each do |f|
+ Log.debug("Checking for class #{f}")
+ if Util.has_cf_class?(f) then
+ Log.debug("Passing based on configuration management class #{f}")
+ passed += 1
+ else
+ Log.debug("Failing based on configuration management class #{f}")
+ failed += 1
+ end
+ end
+
+ when "compound"
+ filter[key].each do |compound|
+ result = false
+ truth_values = []
+
+ begin
+ compound.each do |expression|
+ case expression.keys.first
+ when "statement"
+ truth_values << Matcher.eval_compound_statement(expression).to_s
+ when "fstatement"
+ truth_values << Matcher.eval_compound_fstatement(expression.values.first)
+ when "and"
+ truth_values << "&&"
+ when "or"
+ truth_values << "||"
+ when "("
+ truth_values << "("
+ when ")"
+ truth_values << ")"
+ when "not"
+ truth_values << "!"
+ end
+ end
+
+ result = eval(truth_values.join(" "))
+ rescue DDLValidationError
+ result = false
+ end
+
+ if result
+ Log.debug("Passing based on class and fact composition")
+ passed +=1
+ else
+ Log.debug("Failing based on class and fact composition")
+ failed +=1
+ end
+ end
+
+ when "agent"
+ filter[key].each do |f|
+ if Util.has_agent?(f) || f == "mcollective"
+ Log.debug("Passing based on agent #{f}")
+ passed += 1
+ else
+ Log.debug("Failing based on agent #{f}")
+ failed += 1
+ end
+ end
+
+ when "fact"
+ filter[key].each do |f|
+ if Util.has_fact?(f[:fact], f[:value], f[:operator])
+ Log.debug("Passing based on fact #{f[:fact]} #{f[:operator]} #{f[:value]}")
+ passed += 1
+ else
+ Log.debug("Failing based on fact #{f[:fact]} #{f[:operator]} #{f[:value]}")
+ failed += 1
+ end
+ end
+
+ when "identity"
+ unless filter[key].empty?
+ # Identity filters should not be 'and' but 'or' as each node can only have one identity
+ matched = filter[key].select{|f| Util.has_identity?(f)}.size
+
+ if matched == 1
+ Log.debug("Passing based on identity")
+ passed += 1
+ else
+ Log.debug("Failed based on identity")
+ failed += 1
+ end
+ end
+ end
+ end
+
+ if failed == 0 && passed > 0
+ Log.debug("Message passed the filter checks")
+
+ @stats.passed
+
+ return true
+ else
+ Log.debug("Message failed the filter checks")
+
+ @stats.filtered
+
+ return false
+ end
+ end
+
+ def create_reply(reqid, agent, body)
+ Log.debug("Encoded a message for request #{reqid}")
+
+ {:senderid => @config.identity,
+ :requestid => reqid,
+ :senderagent => agent,
+ :msgtime => Time.now.utc.to_i,
+ :body => body}
+ end
+
+ def create_request(reqid, filter, msg, initiated_by, target_agent, target_collective, ttl=60)
+ Log.debug("Encoding a request for agent '#{target_agent}' in collective #{target_collective} with request id #{reqid}")
+
+ {:body => msg,
+ :senderid => @config.identity,
+ :requestid => reqid,
+ :filter => filter,
+ :collective => target_collective,
+ :agent => target_agent,
+ :callerid => callerid,
+ :ttl => ttl,
+ :msgtime => Time.now.utc.to_i}
+ end
+
+ # Give a MC::Message instance and a message id this will figure out if you the incoming
+ # message id matches the one the Message object is expecting and raise if its not
+ #
+ # Mostly used by security plugins to figure out if they should do the hard work of decrypting
+ # etc messages that would only later on be ignored
+ def should_process_msg?(msg, msgid)
+ if msg.expected_msgid
+ unless msg.expected_msgid == msgid
+ msgtext = "Got a message with id %s but was expecting %s, ignoring message" % [msgid, msg.expected_msgid]
+ Log.debug msgtext
+ raise MsgDoesNotMatchRequestID, msgtext
+ end
+ end
+
+ true
+ end
+
+ # Validates a callerid. We do not want to allow things like \ and / in
+ # callerids since other plugins make assumptions that these are safe strings.
+ #
+ # callerids are generally in the form uid=123 or cert=foo etc so we do that
+ # here but security plugins could override this for some complex uses
+ def valid_callerid?(id)
+ !!id.match(/^[\w]+=[\w\.\-]+$/)
+ end
+
+ # Returns a unique id for the caller, by default we just use the unix
+ # user id, security plugins can provide their own means of doing ids.
+ def callerid
+ "uid=#{Process.uid}"
+ end
+
+ # Security providers should provide this, see MCollective::Security::Psk
+ def validrequest?(req)
+ Log.error("validrequest? is not implemented in #{self.class}")
+ end
+
+ # Security providers should provide this, see MCollective::Security::Psk
+ def encoderequest(sender, msg, filter={})
+ Log.error("encoderequest is not implemented in #{self.class}")
+ end
+
+ # Security providers should provide this, see MCollective::Security::Psk
+ def encodereply(sender, msg, requestcallerid=nil)
+ Log.error("encodereply is not implemented in #{self.class}")
+ end
+
+ # Security providers should provide this, see MCollective::Security::Psk
+ def decodemsg(msg)
+ Log.error("decodemsg is not implemented in #{self.class}")
+ end
+ end
+ end
+end
Code Review / packages / precise / mcollective.git / blobdiff