[pve-devel] r5540 - in pve-access-control/trunk: . PVE test

svn-commits at proxmox.com svn-commits at proxmox.com
Wed Feb 16 07:37:11 CET 2011


Author: dietmar
Date: 2011-02-16 07:37:11 +0100 (Wed, 16 Feb 2011)
New Revision: 5540

Removed:
   pve-access-control/trunk/PVE/ACLCache.pm
Modified:
   pve-access-control/trunk/ChangeLog
   pve-access-control/trunk/PVE/Makefile
   pve-access-control/trunk/PVE/RPCEnvironment.pm
   pve-access-control/trunk/test/perm-test1.pl
Log:
* PVE/ACLCache.pm: deleted - moved code into RPCEnvironment.


Modified: pve-access-control/trunk/ChangeLog
===================================================================
--- pve-access-control/trunk/ChangeLog	2011-02-16 05:37:51 UTC (rev 5539)
+++ pve-access-control/trunk/ChangeLog	2011-02-16 06:37:11 UTC (rev 5540)
@@ -1,3 +1,7 @@
+2011-02-16  Proxmox Support Team  <support at proxmox.com>
+
+	* PVE/ACLCache.pm: deleted - moved code into RPCEnvironment.
+
 2011-02-15  Proxmox Support Team  <support at proxmox.com>
 
 	* PVE/AccessControl.pm (verify_username): restrict user names to

Deleted: pve-access-control/trunk/PVE/ACLCache.pm
===================================================================
--- pve-access-control/trunk/PVE/ACLCache.pm	2011-02-16 05:37:51 UTC (rev 5539)
+++ pve-access-control/trunk/PVE/ACLCache.pm	2011-02-16 06:37:11 UTC (rev 5540)
@@ -1,98 +0,0 @@
-package PVE::ACLCache;
-
-use strict;
-use warnings;
-use PVE::AccessControl;
-
-sub new {
-    my ($class, $user_cfg) = @_;
-
-    my $self = {
-	cfg => $user_cfg,
-	cache => {},
-    };
-
-    bless $self;
-
-    return $self;
-}
-
-my $compile_acl = sub {
-    my ($self, $user) = @_;
-
-    my $res = {};
-    my $cfg = $self->{cfg};
-
-    if ($user eq 'root') { # root can do anything
-	return {'/' => $cfg->{roles}->{'Administrator'}};
-    } 
-
-    foreach my $path (sort keys %{$cfg->{acl}}) {
-	my @ra = PVE::AccessControl::roles($cfg, $user, $path);
-
-	my $privs = {};
-	foreach my $role (@ra) {
-	    if (my $privset = $cfg->{roles}->{$role}) {
-		foreach my $p (keys %$privset) {
-		    $privs->{$p} = 1;
-		}
-	    }
-	}
-
-	$res->{$path} = $privs;
-    }
-
-    return $res;
-};
-
-sub permissions {
-    my ($self, $user, $path) = @_;
-
-    $user = PVE::AccessControl::verify_username($user, 1);
-    return {} if !$user;
-
-    my $cache = $self->{cache};
-
-    my $acl = $cache->{$user};
-
-    if (!$acl) {
-	$acl = $cache->{$user} = &$compile_acl($self, $user);
-    }
-
-    my $perm;
-
-    if (!($perm = $acl->{$path})) {
-	$perm = {};
-	foreach my $p (sort keys %$acl) {
-	    my $final = ($path eq $p);
-	    
-	    next if !(($p eq '/') || $final || ($path =~ m|^$p/|));
-
-	    $perm = $acl->{$p};
-	}
-	$acl->{$path} = $perm;
-    }
-
-    return $perm;
-}
-
-sub check {
-    my ($self, $user, $path, $privs) = @_;
-
-    my $perm = $self->permissions($user, $path);
-
-    foreach my $priv (@$privs) {
-	return undef if !$perm->{$priv};
-    };
-
-    return 1;
-};
-
-sub user_enabled {
-    my ($self, $user) = @_;
-    
-    my $cfg = $self->{cfg};
-    return PVE::AccessControl::user_enabled($cfg, $user);
-}
-
-1;

Modified: pve-access-control/trunk/PVE/Makefile
===================================================================
--- pve-access-control/trunk/PVE/Makefile	2011-02-16 05:37:51 UTC (rev 5539)
+++ pve-access-control/trunk/PVE/Makefile	2011-02-16 06:37:11 UTC (rev 5540)
@@ -3,6 +3,5 @@
 .PHONY: install
 install:
 	install -D -m 0644 AccessControl.pm ${DESTDIR}${PERLDIR}/PVE/AccessControl.pm
-	install -D -m 0644 ACLCache.pm ${DESTDIR}${PERLDIR}/PVE/ACLCache.pm
 	install -D -m 0644 RPCEnvironment.pm ${DESTDIR}${PERLDIR}/PVE/RPCEnvironment.pm
 	make -C API2 install
\ No newline at end of file

Modified: pve-access-control/trunk/PVE/RPCEnvironment.pm
===================================================================
--- pve-access-control/trunk/PVE/RPCEnvironment.pm	2011-02-16 05:37:51 UTC (rev 5539)
+++ pve-access-control/trunk/PVE/RPCEnvironment.pm	2011-02-16 06:37:11 UTC (rev 5540)
@@ -7,9 +7,11 @@
 use Fcntl qw(:flock);
 use PVE::SafeSyslog;
 use PVE::INotify;
+use PVE::Cluster;
 use PVE::ProcFSTools;
+use PVE::AccessControl;
 
-# we use this singleton class to pass RPC related environment value
+# we use this singleton class to pass RPC related environment values
 
 my $pve_env;
 
@@ -48,13 +50,92 @@
     $WORKER_PIDS->{$pid} = 1;
 };
 
-sub get {
+# ACL cache
 
-    die "not initialized" if !$pve_env;
+my $compile_acl = sub {
+    my ($self, $user) = @_;
 
-    return $pve_env;
+    my $res = {};
+    my $cfg = $self->{user_cfg};
+
+    return undef if !$cfg->{roles};
+
+    if ($user eq 'root') { # root can do anything
+	return {'/' => $cfg->{roles}->{'Administrator'}};
+    } 
+
+    foreach my $path (sort keys %{$cfg->{acl}}) {
+	my @ra = PVE::AccessControl::roles($cfg, $user, $path);
+
+	my $privs = {};
+	foreach my $role (@ra) {
+	    if (my $privset = $cfg->{roles}->{$role}) {
+		foreach my $p (keys %$privset) {
+		    $privs->{$p} = 1;
+		}
+	    }
+	}
+
+	$res->{$path} = $privs;
+    }
+
+    return $res;
+};
+
+sub permissions {
+    my ($self, $user, $path) = @_;
+
+    $user = PVE::AccessControl::verify_username($user, 1);
+    return {} if !$user;
+
+    my $cache = $self->{aclcache};
+
+    my $acl = $cache->{$user};
+
+    if (!$acl) {
+	if (!($acl = &$compile_acl($self, $user))) {
+	    return {};
+	}
+	$cache->{$user} = $acl;
+    }
+
+    my $perm;
+
+    if (!($perm = $acl->{$path})) {
+	$perm = {};
+	foreach my $p (sort keys %$acl) {
+	    my $final = ($path eq $p);
+	    
+	    next if !(($p eq '/') || $final || ($path =~ m|^$p/|));
+
+	    $perm = $acl->{$p};
+	}
+	$acl->{$path} = $perm;
+    }
+
+    return $perm;
 }
 
+sub check {
+    my ($self, $user, $path, $privs) = @_;
+
+    my $perm = $self->permissions($user, $path);
+
+    foreach my $priv (@$privs) {
+	return undef if !$perm->{$priv};
+    };
+
+    return 1;
+};
+
+sub user_enabled {
+    my ($self, $user) = @_;
+    
+    my $cfg = $self->{user_cfg};
+    return PVE::AccessControl::user_enabled($cfg, $user);
+}
+
+# initialize environment - must be called once at program startup
 sub init {
     my ($class, $type, %params) = @_;
 
@@ -72,6 +153,9 @@
     # priv ... access from private server (pvedaemon)
     
     my $self = {
+	user_cfg => {},
+	aclcache => {},
+	aclversion => undef,
 	type => $type,
     };
 
@@ -96,6 +180,51 @@
     return $self;
 }; 
 
+# get the singleton 
+sub get {
+
+    die "not initialized" if !$pve_env;
+
+    return $pve_env;
+}
+
+# init_request - must be called before each RPC request
+sub init_request {
+    my ($self, %params) = @_;
+
+    PVE::Cluster::cfs_update();
+
+    my $userconfig; # we use this for regression tests
+    foreach my $p (keys %params) {
+	if ($p eq 'userconfig') {
+	    $userconfig = $params{$p};
+	} else {
+	    die "unknown parameter '$p'";
+	}
+    }
+
+    eval {
+	$self->{aclcache} = {};
+	if ($userconfig) {
+	    my $ucdata = PVE::Tools::file_get_contents($userconfig);
+	    my $cfg = PVE::AccessControl::parse_user_config($userconfig, $ucdata);
+	    $self->{user_cfg} = $cfg;
+	} else {
+	    my $ucvers = PVE::Cluster::cfs_file_version('user.cfg'); 
+	    if (!$self->{aclcache} || !defined($self->{aclversion}) || 
+		!defined($ucvers) ||  ($ucvers ne $self->{aclversion})) {
+		$self->{aclversion} = $ucvers;
+		my $cfg = PVE::Cluster::cfs_read_file('user.cfg');
+		$self->{user_cfg} = $cfg;
+	    }
+	}
+    };
+    if (my $err = $@) {
+	$self->{user_cfg} = {};
+	die "Unable to load access control list: $err";
+    }
+}
+
 sub set_language {
     my ($self, $lang) = @_;
 
@@ -104,6 +233,12 @@
     $self->{language} = $lang;
 }
 
+sub get_language {
+    my ($self) = @_;
+
+    return $self->{language};
+}
+
 sub set_user {
     my ($self, $user) = @_;
 

Modified: pve-access-control/trunk/test/perm-test1.pl
===================================================================
--- pve-access-control/trunk/test/perm-test1.pl	2011-02-16 05:37:51 UTC (rev 5539)
+++ pve-access-control/trunk/test/perm-test1.pl	2011-02-16 06:37:11 UTC (rev 5540)
@@ -3,26 +3,26 @@
 use strict;
 use PVE::Tools;
 use PVE::AccessControl;
-use PVE::ACLCache;
+use PVE::RPCEnvironment;
 use Getopt::Long;
 
+my $rpcenv = PVE::RPCEnvironment->init('cli');
+
 my $cfgfn = "user.cfg.ex1";
-my $ucdata = PVE::Tools::file_get_contents($cfgfn);
-my $cfg = PVE::AccessControl::parse_user_config ($cfgfn, $ucdata);
-my $acl = PVE::ACLCache->new($cfg);
+$rpcenv->init_request(userconfig => $cfgfn);
 
 sub check_permission {
     my ($user, $path, $expected_result) = @_;
 
-    my $perm = PVE::AccessControl::permission($cfg, $user, $path);
+    my $perm = PVE::AccessControl::permission($rpcenv->{user_cfg}, $user, $path);
     my $res = join(',', sort keys %$perm);
 
-    die "unexpected result - need '${expected_result}'\n"
+    die "unexpected result\nneed '${expected_result}'\ngot '$res'\n"
 	if $res ne $expected_result;
 
-    $perm = $acl->permissions($user, $path);
+    $perm = $rpcenv->permissions($user, $path);
     $res = join(',', sort keys %$perm);
-    die "unexpected result (compiled) - need '${expected_result}'\n"
+    die "unexpected result (compiled)\nneed '${expected_result}'\ngot '$res'\n"
 	if $res ne $expected_result;
 
     print "$path:$user:$res\n";



More information about the pve-devel mailing list