experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* Added CLICON_NACM_MODE "internal-rpc" which is for RPC functionality only

Browse source
This commit is contained in:
Olof Hagsand 2019-03-22 17:09:05 +01:00
parent 0898870e68
commit 69dcc721a9
5 changed files with 36 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
lib/clixon/clixon_nacm.h
View file

@ -60,6 +60,17 @@ enum nacm_access{
NACM_DELETE,
NACM_EXEC
};
/*! In RFC8341, NACM defines three access points: rpc
* 3.4.4 Incoming RPC Message Validation
* 3.4.5 Data Node Access Validation
* 3.4.6 Outgoing <notification> Authorization
*/
enum nacm_point {
NACM_RPC,
NACM_DATA,
NACM_NOTIFICATION,
};
/*
* Prototypes
*/
@ -67,7 +78,7 @@ int nacm_rpc(char *rpc, char *module, char *username, cxobj *xnacm, cbuf *cbret)
int nacm_datanode_read(cxobj *xt, cxobj **xvec, size_t xlen, char *username, cxobj *nacm_xtree);
int nacm_datanode_write(cxobj *xt, cxobj *xr, enum nacm_access access,
char *username, cxobj *xnacm, cbuf *cbret);
int nacm_access_pre(clicon_handle h, char *username, cxobj **xnacmp);
int nacm_access_pre(clicon_handle h, char *username, enum nacm_point point, cxobj **xnacmp);
int nacm_access(char *mode, cxobj *xnacmin, char *username);
#endif /* _CLIXON_NACM_H */

13
lib/src/clixon_nacm.c
View file

@ -808,7 +808,7 @@ nacm_access(char *mode,
goto permit;
/* 0. If nacm-mode is external, get NACM defintion from separet tree,
otherwise get it from internal configuration */
if (strcmp(mode, "external") && strcmp(mode, "internal")){
if (strcmp(mode, "external") && strcmp(mode, "internal") && strcmp(mode, "internal-rpc")){
clicon_err(OE_XML, 0, "Invalid NACM mode: %s", mode);
goto done;
}
@ -846,6 +846,7 @@ nacm_access(char *mode,
* etc. If retval = 1 access is OK and skip next NACM step.
* @param[in] h Clicon handle
* @param[in] username User name of requestor
* @param[in] point NACM access control point
* @param[out] xncam NACM XML tree, set if retval=0. Free after use
* @retval -1 Error
* @retval 0 OK but not validated. Need to do NACM step using xnacm
@ -864,6 +865,7 @@ nacm_access(char *mode,
int
nacm_access_pre(clicon_handle h,
char *username,
enum nacm_point point,
cxobj **xnacmp)
{
int retval = -1;
@ -882,6 +884,15 @@ nacm_access_pre(clicon_handle h,
if (xmldb_get(h, "running", "nacm", 0, &xnacm0, NULL) < 0)
goto done;
}
else if (strcmp(mode, "internal-rpc")==0){
/* Special mode only implemet exec rpc access point */
if (point == NACM_RPC){
if (xmldb_get(h, "running", "nacm", 0, &xnacm0, NULL) < 0)
goto done;
}
else
goto permit;
}
}
/* If config does not exist then the operation is permitted(?) */
if (xnacm0 == NULL)