#include "authority.h"
#include "server.h"
#include "connection.h"
#include "session.h"
#include "process.h"
#include "AuthorizationWalkers.h"
using Authorization::AuthItemSet;
using Authorization::AuthItemRef;
using Authorization::AuthValue;
using Authorization::AuthValueOverlay;
AuthorizationToken::AuthMap AuthorizationToken::authMap; Mutex AuthorizationToken::authMapLock;
Authority::Authority(const char *configFile)
: Authorization::Engine(configFile)
{
}
Authority::~Authority()
{
}
AuthorizationToken::AuthorizationToken(Session &ssn, const CredentialSet &base, const security_token_t &securityToken)
: session(ssn), mBaseCreds(base), mTransferCount(INT_MAX),
mCreatorUid(securityToken.val[0]),
mCreatorCode(Server::connection().process.clientCode()),
mCreatorPid(Server::connection().process.pid())
{
Server::active().random(mHandle);
StLock<Mutex> _(authMapLock);
authMap[mHandle] = this;
session.addAuthorization(this);
secdebug("SSauth", "Authorization %p created using %d credentials; owner=%s",
this, int(mBaseCreds.size()),
mCreatorCode ? mCreatorCode->encode().c_str() : "unknown");
}
AuthorizationToken::~AuthorizationToken()
{
assert(mUsingProcesses.empty());
if (session.removeAuthorization(this))
delete &session;
secdebug("SSauth", "Authorization %p destroyed", this);
}
AuthorizationToken &AuthorizationToken::find(const AuthorizationBlob &blob)
{
StLock<Mutex> _(authMapLock);
AuthMap::iterator it = authMap.find(blob);
if (it == authMap.end())
Authorization::Error::throwMe(errAuthorizationInvalidRef);
return *it->second;
}
AuthorizationToken::Deleter::Deleter(const AuthorizationBlob &blob)
: lock(authMapLock)
{
AuthMap::iterator it = authMap.find(blob);
if (it == authMap.end())
Authorization::Error::throwMe(errAuthorizationInvalidRef);
mAuth = it->second;
}
void AuthorizationToken::Deleter::remove()
{
if (mAuth) {
authMap.erase(mAuth->handle());
delete mAuth;
mAuth = NULL;
}
}
CredentialSet AuthorizationToken::effectiveCreds() const
{
secdebug("SSauth", "Authorization %p grabbing session %p creds %p",
this, &session, &session.authCredentials());
CredentialSet result = session.authCredentials();
for (CredentialSet::const_iterator it = mBaseCreds.begin(); it != mBaseCreds.end(); it++)
if (!(*it)->isShared())
result.insert(*it);
return result;
}
void AuthorizationToken::mergeCredentials(const CredentialSet &add)
{
secdebug("SSauth", "Authorization %p merge creds %p", this, &add);
for (CredentialSet::const_iterator it = add.begin(); it != add.end(); it++) {
mBaseCreds.erase(*it);
mBaseCreds.insert(*it);
}
secdebug("SSauth", "Authorization %p merged %d new credentials for %d total",
this, int(add.size()), int(mBaseCreds.size()));
}
void AuthorizationToken::addProcess(Process &proc)
{
StLock<Mutex> _(mLock);
mUsingProcesses.insert(&proc);
secdebug("SSauth", "Authorization %p added process %p(%d)", this, &proc, proc.pid());
}
bool AuthorizationToken::endProcess(Process &proc)
{
StLock<Mutex> _(mLock);
assert(mUsingProcesses.find(&proc) != mUsingProcesses.end());
mUsingProcesses.erase(&proc);
secdebug("SSauth", "Authorization %p removed process %p(%d)%s",
this, &proc, proc.pid(), mUsingProcesses.empty() ? " FINAL" : "");
return mUsingProcesses.empty();
}
bool AuthorizationToken::mayExternalize(Process &) const
{
return mTransferCount > 0;
}
bool AuthorizationToken::mayInternalize(Process &, bool countIt)
{
StLock<Mutex> _(mLock);
if (mTransferCount > 0) {
if (countIt) {
mTransferCount--;
secdebug("SSauth", "Authorization %p decrement intcount to %d", this, mTransferCount);
}
return true;
}
return false;
}
AuthItemSet
AuthorizationToken::infoSet(AuthorizationString tag)
{
StLock<Mutex> _(mLock);
AuthItemSet tempSet;
if (tag)
{
AuthItemSet::iterator found = find_if(mInfoSet.begin(), mInfoSet.end(),
Authorization::FindAuthItemByRightName(tag));
if (found != mInfoSet.end())
tempSet.insert(AuthItemRef(*found));
}
else
tempSet = mInfoSet;
secdebug("SSauth", "Authorization %p returning copy of context %s%s.", this, tag ? "for tag " : "", tag ? "" : tag);
return tempSet;
}
void
AuthorizationToken::setInfoSet(AuthItemSet &newInfoSet)
{
StLock<Mutex> _(mLock); secdebug("SSauth", "Authorization %p setting new context", this);
mInfoSet = newInfoSet;
}
void
AuthorizationToken::setCredentialInfo(const Credential &inCred)
{
AuthItemSet dstInfoSet;
char uid_string[16];
if (snprintf(uid_string, sizeof(uid_string), "%u", inCred->uid()) >=
int(sizeof(uid_string)))
uid_string[0] = '\0';
AuthItemRef uidHint("uid", AuthValueOverlay(uid_string ? strlen(uid_string) + 1 : 0, uid_string), 0);
dstInfoSet.insert(uidHint);
AuthItemRef userHint("username", AuthValueOverlay(inCred->username()), 0);
dstInfoSet.insert(userHint);
setInfoSet(dstInfoSet);
}