ceph/src/mon/MonCap.cc

   1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
   2 // vim: ts=8 sw=2 smarttab
   3 /*
   4  * Ceph - scalable distributed file system
   5  *
   6  * Copyright (C) 2013 Inktank
   7  *
   8  * This is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public
  10  * License version 2.1, as published by the Free Software
  11  * Foundation.  See file COPYING.
  12  *
  13  */
  14
  15 #include <boost/config/warning_disable.hpp>
  16 #include <boost/spirit/include/qi_uint.hpp>
  17 #include <boost/spirit/include/qi.hpp>
  18 #include <boost/fusion/include/std_pair.hpp>
  19 #include <boost/spirit/include/phoenix.hpp>
  20 #include <boost/fusion/adapted/struct/adapt_struct.hpp>
  21 #include <boost/fusion/include/adapt_struct.hpp>
  22 #include <boost/algorithm/string/predicate.hpp>
  23
  24 #include "MonCap.h"
  25 #include "include/stringify.h"
  26 #include "include/ipaddr.h"
  27 #include "common/debug.h"
  28 #include "common/Formatter.h"
  29
  30 #include <algorithm>
  31 #include <regex>
  32
  33 #include "include/ceph_assert.h"
  34
  35 using std::list;
  36 using std::map;
  37 using std::ostream;
  38 using std::pair;
  39 using std::string;
  40 using std::vector;
  41
  42 using ceph::bufferlist;
  43 using ceph::Formatter;
  44
  45 static inline bool is_not_alnum_space(char c)
  46 {
  47   return !(isalpha(c) || isdigit(c) || (c == '-') || (c == '_'));
  48 }
  49
  50 static std::string maybe_quote_string(const std::string& str)
  51 {
  52   if (find_if(str.begin(), str.end(), is_not_alnum_space) == str.end())
  53     return str;
  54   return string("\"") + str + string("\"");
  55 }
  56
  57 #define dout_subsys ceph_subsys_mon
  58
  59 ostream& operator<<(ostream& out, const mon_rwxa_t& p)
  60 {
  61   if (p == MON_CAP_ANY)
  62     return out << "*";
  63
  64   if (p & MON_CAP_R)
  65     out << "r";
  66   if (p & MON_CAP_W)
  67     out << "w";
  68   if (p & MON_CAP_X)
  69     out << "x";
  70   return out;
  71 }
  72
  73 ostream& operator<<(ostream& out, const StringConstraint& c)
  74 {
  75   switch (c.match_type) {
  76   case StringConstraint::MATCH_TYPE_EQUAL:
  77     return out << "value " << c.value;
  78   case StringConstraint::MATCH_TYPE_PREFIX:
  79     return out << "prefix " << c.value;
  80   case StringConstraint::MATCH_TYPE_REGEX:
  81     return out << "regex " << c.value;
  82   default:
  83     break;
  84   }
  85   return out;
  86 }
  87
  88 ostream& operator<<(ostream& out, const MonCapGrant& m)
  89 {
  90   out << "allow";
  91   if (m.service.length()) {
  92     out << " service " << maybe_quote_string(m.service);
  93   }
  94   if (m.command.length()) {
  95     out << " command " << maybe_quote_string(m.command);
  96     if (!m.command_args.empty()) {
  97       out << " with";
  98       for (auto p = m.command_args.begin();
  99            p != m.command_args.end();
 100            ++p) {
 101         switch (p->second.match_type) {
 102         case StringConstraint::MATCH_TYPE_EQUAL:
 103           out << " " << maybe_quote_string(p->first) << "="
 104               << maybe_quote_string(p->second.value);
 105           break;
 106         case StringConstraint::MATCH_TYPE_PREFIX:
 107           out << " " << maybe_quote_string(p->first) << " prefix "
 108               << maybe_quote_string(p->second.value);
 109           break;
 110         case StringConstraint::MATCH_TYPE_REGEX:
 111           out << " " << maybe_quote_string(p->first) << " regex "
 112               << maybe_quote_string(p->second.value);
 113           break;
 114         default:
 115           break;
 116         }
 117       }
 118     }
 119   }
 120   if (m.profile.length()) {
 121     out << " profile " << maybe_quote_string(m.profile);
 122   }
 123   if (m.allow != 0)
 124     out << " " << m.allow;
 125   if (m.network.size())
 126     out << " network " << m.network;
 127   return out;
 128 }
 129
 130
 131 // <magic>
 132 //  fusion lets us easily populate structs via the qi parser.
 133
 134 typedef map<string,StringConstraint> kvmap;
 135
 136 BOOST_FUSION_ADAPT_STRUCT(MonCapGrant,
 137                           (std::string, service)
 138                           (std::string, profile)
 139                           (std::string, command)
 140                           (kvmap, command_args)
 141                           (mon_rwxa_t, allow)
 142                           (std::string, network)
 143                           (std::string, fs_name))
 144
 145 BOOST_FUSION_ADAPT_STRUCT(StringConstraint,
 146                           (StringConstraint::MatchType, match_type)
 147                           (std::string, value))
 148
 149 // </magic>
 150
 151 void MonCapGrant::parse_network()
 152 {
 153   network_valid = ::parse_network(network.c_str(), &network_parsed,
 154                                   &network_prefix);
 155 }
 156
 157 void MonCapGrant::expand_profile(const EntityName& name) const
 158 {
 159   // only generate this list once
 160   if (!profile_grants.empty())
 161     return;
 162
 163   if (profile == "read-only") {
 164     // grants READ-ONLY caps monitor-wide
 165     // 'auth' requires MON_CAP_X even for RO, which we do not grant here.
 166     profile_grants.push_back(mon_rwxa_t(MON_CAP_R));
 167     return;
 168   }
 169
 170   if (profile == "read-write") {
 171     // grants READ-WRITE caps monitor-wide
 172     // 'auth' requires MON_CAP_X for all operations, which we do not grant.
 173     profile_grants.push_back(mon_rwxa_t(MON_CAP_R | MON_CAP_W));
 174     return;
 175   }
 176
 177   if (profile == "mon") {
 178     profile_grants.push_back(MonCapGrant("mon", MON_CAP_ALL));
 179     profile_grants.push_back(MonCapGrant("log", MON_CAP_ALL));
 180   }
 181   if (profile == "osd") {
 182     profile_grants.push_back(MonCapGrant("osd", MON_CAP_ALL));
 183     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 184     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R | MON_CAP_W));
 185     profile_grants.push_back(MonCapGrant("log", MON_CAP_W));
 186     StringConstraint constraint(StringConstraint::MATCH_TYPE_REGEX,
 187                                 string("osd_mclock_max_capacity_iops_(hdd|ssd)"));
 188     profile_grants.push_back(MonCapGrant("config set", "name", constraint));
 189   }
 190   if (profile == "mds") {
 191     profile_grants.push_back(MonCapGrant("mds", MON_CAP_ALL));
 192     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 193     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 194     // This command grant is checked explicitly in MRemoveSnaps handling
 195     profile_grants.push_back(MonCapGrant("osd pool rmsnap"));
 196     profile_grants.push_back(MonCapGrant("osd blocklist"));
 197     profile_grants.push_back(MonCapGrant("osd blacklist")); // for compat
 198     profile_grants.push_back(MonCapGrant("log", MON_CAP_W));
 199   }
 200   if (profile == "mgr") {
 201     profile_grants.push_back(MonCapGrant("mgr", MON_CAP_ALL));
 202     profile_grants.push_back(MonCapGrant("log", MON_CAP_R | MON_CAP_W));
 203     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R | MON_CAP_W));
 204     profile_grants.push_back(MonCapGrant("mds", MON_CAP_R | MON_CAP_W));
 205     profile_grants.push_back(MonCapGrant("fs", MON_CAP_R | MON_CAP_W));
 206     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R | MON_CAP_W));
 207     profile_grants.push_back(MonCapGrant("auth", MON_CAP_R | MON_CAP_W | MON_CAP_X));
 208     profile_grants.push_back(MonCapGrant("config-key", MON_CAP_R | MON_CAP_W));
 209     profile_grants.push_back(MonCapGrant("config", MON_CAP_R | MON_CAP_W));
 210     // cephadm orchestrator provisions new daemon keys and updates caps
 211     profile_grants.push_back(MonCapGrant("auth get-or-create"));
 212     profile_grants.push_back(MonCapGrant("auth caps"));
 213     profile_grants.push_back(MonCapGrant("auth rm"));
 214     // tell commands (this is a bit of a kludge)
 215     profile_grants.push_back(MonCapGrant("smart"));
 216   }
 217   if (profile == "osd" || profile == "mds" || profile == "mon" ||
 218       profile == "mgr") {
 219     StringConstraint constraint(StringConstraint::MATCH_TYPE_PREFIX,
 220                                 string("daemon-private/") + stringify(name) +
 221                                 string("/"));
 222     std::string prefix = string("daemon-private/") + stringify(name) + string("/");
 223     profile_grants.push_back(MonCapGrant("config-key get", "key", constraint));
 224     profile_grants.push_back(MonCapGrant("config-key put", "key", constraint));
 225     profile_grants.push_back(MonCapGrant("config-key set", "key", constraint));
 226     profile_grants.push_back(MonCapGrant("config-key exists", "key", constraint));
 227     profile_grants.push_back(MonCapGrant("config-key delete", "key", constraint));
 228   }
 229   if (profile == "bootstrap-osd") {
 230     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
 231     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
 232     profile_grants.push_back(MonCapGrant("mon getmap"));
 233     profile_grants.push_back(MonCapGrant("osd new"));
 234     profile_grants.push_back(MonCapGrant("osd purge-new"));
 235   }
 236   if (profile == "bootstrap-mds") {
 237     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
 238     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
 239     profile_grants.push_back(MonCapGrant("mon getmap"));
 240     profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mds keys
 241     profile_grants.back().command_args["entity"] = StringConstraint(
 242       StringConstraint::MATCH_TYPE_PREFIX, "mds.");
 243     profile_grants.back().command_args["caps_mon"] = StringConstraint(
 244       StringConstraint::MATCH_TYPE_EQUAL, "allow profile mds");
 245     profile_grants.back().command_args["caps_osd"] = StringConstraint(
 246       StringConstraint::MATCH_TYPE_EQUAL, "allow rwx");
 247     profile_grants.back().command_args["caps_mds"] = StringConstraint(
 248       StringConstraint::MATCH_TYPE_EQUAL, "allow");
 249   }
 250   if (profile == "bootstrap-mgr") {
 251     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
 252     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
 253     profile_grants.push_back(MonCapGrant("mon getmap"));
 254     profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mgr keys
 255     profile_grants.back().command_args["entity"] = StringConstraint(
 256       StringConstraint::MATCH_TYPE_PREFIX, "mgr.");
 257     profile_grants.back().command_args["caps_mon"] = StringConstraint(
 258       StringConstraint::MATCH_TYPE_EQUAL, "allow profile mgr");
 259   }
 260   if (profile == "bootstrap-rgw") {
 261     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
 262     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));  // read osdmap
 263     profile_grants.push_back(MonCapGrant("mon getmap"));
 264     profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other mds keys
 265     profile_grants.back().command_args["entity"] = StringConstraint(
 266       StringConstraint::MATCH_TYPE_PREFIX, "client.rgw.");
 267     profile_grants.back().command_args["caps_mon"] = StringConstraint(
 268       StringConstraint::MATCH_TYPE_EQUAL, "allow rw");
 269     profile_grants.back().command_args["caps_osd"] = StringConstraint(
 270       StringConstraint::MATCH_TYPE_EQUAL, "allow rwx");
 271   }
 272   if (profile == "bootstrap-rbd" || profile == "bootstrap-rbd-mirror") {
 273     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));  // read monmap
 274     profile_grants.push_back(MonCapGrant("auth get-or-create"));  // FIXME: this can expose other rbd keys
 275     profile_grants.back().command_args["entity"] = StringConstraint(
 276       StringConstraint::MATCH_TYPE_PREFIX, "client.");
 277     profile_grants.back().command_args["caps_mon"] = StringConstraint(
 278       StringConstraint::MATCH_TYPE_EQUAL,
 279       (profile == "bootstrap-rbd-mirror" ? "profile rbd-mirror" :
 280                                            "profile rbd"));
 281     profile_grants.back().command_args["caps_osd"] = StringConstraint(
 282       StringConstraint::MATCH_TYPE_REGEX,
 283       "^([ ,]*profile(=|[ ]+)['\"]?rbd[^ ,'\"]*['\"]?([ ]+pool(=|[ ]+)['\"]?[^,'\"]+['\"]?)?)+$");
 284   }
 285   if (profile == "fs-client") {
 286     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 287     profile_grants.push_back(MonCapGrant("mds", MON_CAP_R));
 288     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 289     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
 290   }
 291   if (profile == "simple-rados-client") {
 292     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 293     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 294     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
 295   }
 296   if (profile == "simple-rados-client-with-blocklist") {
 297     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 298     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 299     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
 300     profile_grants.push_back(MonCapGrant("osd blocklist"));
 301     profile_grants.back().command_args["blocklistop"] = StringConstraint(
 302       StringConstraint::MATCH_TYPE_EQUAL, "add");
 303     profile_grants.back().command_args["addr"] = StringConstraint(
 304       StringConstraint::MATCH_TYPE_REGEX, "^[^/]+/[0-9]+$");
 305
 306   }
 307   if (boost::starts_with(profile, "rbd")) {
 308     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 309     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 310     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
 311
 312     // exclusive lock dead-client blocklisting (IP+nonce required)
 313     profile_grants.push_back(MonCapGrant("osd blocklist"));
 314     profile_grants.back().command_args["blocklistop"] = StringConstraint(
 315       StringConstraint::MATCH_TYPE_EQUAL, "add");
 316     profile_grants.back().command_args["addr"] = StringConstraint(
 317       StringConstraint::MATCH_TYPE_REGEX, "^[^/]+/[0-9]+$");
 318
 319     // for compat,
 320     profile_grants.push_back(MonCapGrant("osd blacklist"));
 321     profile_grants.back().command_args["blacklistop"] = StringConstraint(
 322       StringConstraint::MATCH_TYPE_EQUAL, "add");
 323     profile_grants.back().command_args["addr"] = StringConstraint(
 324       StringConstraint::MATCH_TYPE_REGEX, "^[^/]+/[0-9]+$");
 325
 326   }
 327   if (profile == "rbd-mirror") {
 328     StringConstraint constraint(StringConstraint::MATCH_TYPE_PREFIX,
 329                                 "rbd/mirror/");
 330     profile_grants.push_back(MonCapGrant("config-key get", "key", constraint));
 331   } else if (profile == "rbd-mirror-peer") {
 332     StringConstraint constraint(StringConstraint::MATCH_TYPE_REGEX,
 333                                 "rbd/mirror/[^/]+");
 334     profile_grants.push_back(MonCapGrant("config-key get", "key", constraint));
 335
 336     constraint = StringConstraint(StringConstraint::MATCH_TYPE_PREFIX,
 337                                   "rbd/mirror/peer/");
 338     profile_grants.push_back(MonCapGrant("config-key set", "key", constraint));
 339   }
 340   else if (profile == "crash") {
 341     // TODO: we could limit this to getting the monmap and mgrmap...
 342     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 343   }
 344   if (profile == "cephfs-mirror") {
 345     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 346     profile_grants.push_back(MonCapGrant("mds", MON_CAP_R));
 347     profile_grants.push_back(MonCapGrant("osd", MON_CAP_R));
 348     profile_grants.push_back(MonCapGrant("pg", MON_CAP_R));
 349     StringConstraint constraint(StringConstraint::MATCH_TYPE_PREFIX,
 350                                 "cephfs/mirror/peer/");
 351     profile_grants.push_back(MonCapGrant("config-key get", "key", constraint));
 352
 353   }
 354   if (profile == "role-definer") {
 355     // grants ALL caps to the auth subsystem, read-only on the
 356     // monitor subsystem and nothing else.
 357     profile_grants.push_back(MonCapGrant("mon", MON_CAP_R));
 358     profile_grants.push_back(MonCapGrant("auth", MON_CAP_ALL));
 359   }
 360 }
 361
 362 mon_rwxa_t MonCapGrant::get_allowed(CephContext *cct,
 363                                     EntityName name,
 364                                     const std::string& s, const std::string& c,
 365                                     const map<string,string>& c_args) const
 366 {
 367   if (profile.length()) {
 368     expand_profile(name);
 369     mon_rwxa_t a;
 370     for (auto p = profile_grants.begin();
 371          p != profile_grants.end(); ++p)
 372       a = a | p->get_allowed(cct, name, s, c, c_args);
 373     return a;
 374   }
 375   if (service.length()) {
 376     if (service != s)
 377       return 0;
 378     return allow;
 379   }
 380   if (command.length()) {
 381     if (command != c)
 382       return 0;
 383     for (map<string,StringConstraint>::const_iterator p = command_args.begin(); p != command_args.end(); ++p) {
 384       map<string,string>::const_iterator q = c_args.find(p->first);
 385       // argument must be present if a constraint exists
 386       if (q == c_args.end())
 387         return 0;
 388       switch (p->second.match_type) {
 389       case StringConstraint::MATCH_TYPE_EQUAL:
 390         if (p->second.value != q->second)
 391           return 0;
 392         break;
 393       case StringConstraint::MATCH_TYPE_PREFIX:
 394         if (q->second.find(p->second.value) != 0)
 395           return 0;
 396         break;
 397       case StringConstraint::MATCH_TYPE_REGEX:
 398         try {
 399           std::regex pattern(
 400             p->second.value, std::regex::extended);
 401           if (!std::regex_match(q->second, pattern))
 402             return 0;
 403         } catch(const std::regex_error&) {
 404           return 0;
 405         }
 406         break;
 407       default:
 408         break;
 409       }
 410     }
 411     return MON_CAP_ALL;
 412   }
 413   // we don't allow config-key service to be accessed with blanket caps other
 414   // than '*' (i.e., 'any'), and that should have been checked by the caller
 415   // via 'is_allow_all()'.
 416   if (s == "config-key") {
 417     return 0;
 418   }
 419   return allow;
 420 }
 421
 422 ostream& operator<<(ostream&out, const MonCap& m)
 423 {
 424   for (vector<MonCapGrant>::const_iterator p = m.grants.begin(); p != m.grants.end(); ++p) {
 425     if (p != m.grants.begin())
 426       out << ", ";
 427     out << *p;
 428   }
 429   return out;
 430 }
 431
 432 bool MonCap::is_allow_all() const
 433 {
 434   for (vector<MonCapGrant>::const_iterator p = grants.begin(); p != grants.end(); ++p)
 435     if (p->is_allow_all())
 436       return true;
 437   return false;
 438 }
 439
 440 void MonCap::set_allow_all()
 441 {
 442   grants.clear();
 443   grants.push_back(MonCapGrant(MON_CAP_ANY));
 444   text = "allow *";
 445 }
 446
 447 bool MonCap::is_capable(
 448   CephContext *cct,
 449   EntityName name,
 450   const string& service,
 451   const string& command, const map<string,string>& command_args,
 452   bool op_may_read, bool op_may_write, bool op_may_exec,
 453   const entity_addr_t& addr) const
 454 {
 455   if (cct)
 456     ldout(cct, 20) << "is_capable service=" << service << " command=" << command
 457                    << (op_may_read ? " read":"")
 458                    << (op_may_write ? " write":"")
 459                    << (op_may_exec ? " exec":"")
 460                    << " addr " << addr
 461                    << " on cap " << *this
 462                    << dendl;
 463
 464   mon_rwxa_t allow = 0;
 465   for (vector<MonCapGrant>::const_iterator p = grants.begin();
 466        p != grants.end(); ++p) {
 467     if (cct)
 468       ldout(cct, 20) << " allow so far " << allow << ", doing grant " << *p
 469                      << dendl;
 470
 471     if (p->network.size() &&
 472         (!p->network_valid ||
 473          !network_contains(p->network_parsed,
 474                            p->network_prefix,
 475                            addr))) {
 476       continue;
 477     }
 478
 479     if (p->is_allow_all()) {
 480       if (cct)
 481         ldout(cct, 20) << " allow all" << dendl;
 482       return true;
 483     }
 484
 485     // check enumerated caps
 486     allow = allow | p->get_allowed(cct, name, service, command, command_args);
 487     if ((!op_may_read || (allow & MON_CAP_R)) &&
 488         (!op_may_write || (allow & MON_CAP_W)) &&
 489         (!op_may_exec || (allow & MON_CAP_X))) {
 490       if (cct)
 491         ldout(cct, 20) << " match" << dendl;
 492       return true;
 493     }
 494   }
 495   return false;
 496 }
 497
 498 void MonCap::encode(bufferlist& bl) const
 499 {
 500   ENCODE_START(4, 4, bl);   // legacy MonCaps was 3, 3
 501   encode(text, bl);
 502   ENCODE_FINISH(bl);
 503 }
 504
 505 void MonCap::decode(bufferlist::const_iterator& bl)
 506 {
 507   std::string s;
 508   DECODE_START(4, bl);
 509   decode(s, bl);
 510   DECODE_FINISH(bl);
 511   parse(s, NULL);
 512 }
 513
 514 void MonCap::dump(Formatter *f) const
 515 {
 516   f->dump_string("text", text);
 517 }
 518
 519 void MonCap::generate_test_instances(list<MonCap*>& ls)
 520 {
 521   ls.push_back(new MonCap);
 522   ls.push_back(new MonCap);
 523   ls.back()->parse("allow *");
 524   ls.push_back(new MonCap);
 525   ls.back()->parse("allow rwx");
 526   ls.push_back(new MonCap);
 527   ls.back()->parse("allow service foo x");
 528   ls.push_back(new MonCap);
 529   ls.back()->parse("allow command bar x");
 530   ls.push_back(new MonCap);
 531   ls.back()->parse("allow service foo r, allow command bar x");
 532   ls.push_back(new MonCap);
 533   ls.back()->parse("allow command bar with k1=v1 x");
 534   ls.push_back(new MonCap);
 535   ls.back()->parse("allow command bar with k1=v1 k2=v2 x");
 536 }
 537
 538 // grammar
 539 namespace qi = boost::spirit::qi;
 540 namespace ascii = boost::spirit::ascii;
 541 namespace phoenix = boost::phoenix;
 542
 543
 544 template <typename Iterator>
 545 struct MonCapParser : qi::grammar<Iterator, MonCap()>
 546 {
 547   MonCapParser() : MonCapParser::base_type(moncap)
 548   {
 549     using qi::char_;
 550     using qi::int_;
 551     using qi::ulong_long;
 552     using qi::lexeme;
 553     using qi::alnum;
 554     using qi::_val;
 555     using qi::_1;
 556     using qi::_2;
 557     using qi::_3;
 558     using qi::eps;
 559     using qi::lit;
 560
 561     quoted_string %=
 562       lexeme['"' >> +(char_ - '"') >> '"'] |
 563       lexeme['\'' >> +(char_ - '\'') >> '\''];
 564     unquoted_word %= +char_("a-zA-Z0-9_./-");
 565     str %= quoted_string | unquoted_word;
 566     network_str %= +char_("/.:a-fA-F0-9][");
 567     fs_name_str %= +char_("a-zA-Z0-9_.-");
 568
 569     spaces = +(lit(' ') | lit('\n') | lit('\t'));
 570
 571     // command := command[=]cmd [k1=v1 k2=v2 ...]
 572     str_match = '=' >> qi::attr(StringConstraint::MATCH_TYPE_EQUAL) >> str;
 573     str_prefix = spaces >> lit("prefix") >> spaces >>
 574                  qi::attr(StringConstraint::MATCH_TYPE_PREFIX) >> str;
 575     str_regex = spaces >> lit("regex") >> spaces >>
 576                  qi::attr(StringConstraint::MATCH_TYPE_REGEX) >> str;
 577     kv_pair = str >> (str_match | str_prefix | str_regex);
 578     kv_map %= kv_pair >> *(spaces >> kv_pair);
 579     command_match = -spaces >> lit("allow") >> spaces >> lit("command") >> (lit('=') | spaces)
 580                             >> qi::attr(string()) >> qi::attr(string())
 581                             >> str
 582                             >> -(spaces >> lit("with") >> spaces >> kv_map)
 583                             >> qi::attr(0)
 584                             >> -(spaces >> lit("network") >> spaces >> network_str);
 585
 586     // service foo rwxa
 587     service_match %= -spaces >> lit("allow") >> spaces >> lit("service") >> (lit('=') | spaces)
 588                              >> str >> qi::attr(string()) >> qi::attr(string())
 589                              >> qi::attr(map<string,StringConstraint>())
 590                              >> spaces >> rwxa
 591                              >> -(spaces >> lit("network") >> spaces >> network_str);
 592
 593     // profile foo
 594     profile_match %= -spaces >> -(lit("allow") >> spaces)
 595                              >> lit("profile") >> (lit('=') | spaces)
 596                              >> qi::attr(string())
 597                              >> str
 598                              >> qi::attr(string())
 599                              >> qi::attr(map<string,StringConstraint>())
 600                              >> qi::attr(0)
 601                              >> -(spaces >> lit("network") >> spaces >> network_str);
 602
 603     // rwxa
 604     rwxa_match %= -spaces >> lit("allow") >> spaces
 605                           >> qi::attr(string()) >> qi::attr(string()) >> qi::attr(string())
 606                           >> qi::attr(map<string,StringConstraint>())
 607                           >> rwxa
 608                           >> -(spaces >> lit("network") >> spaces >> network_str)
 609                           >> -(spaces >> lit("fsname") >> (lit('=') | spaces) >> fs_name_str);
 610
 611     // rwxa := * | [r][w][x]
 612     rwxa =
 613       (lit("*")[_val = MON_CAP_ANY]) |
 614       (lit("all")[_val = MON_CAP_ANY]) |
 615       ( eps[_val = 0] >>
 616         ( lit('r')[_val |= MON_CAP_R] ||
 617           lit('w')[_val |= MON_CAP_W] ||
 618           lit('x')[_val |= MON_CAP_X]
 619           )
 620         );
 621
 622     // grant := allow ...
 623     grant = -spaces >> (rwxa_match | profile_match | service_match | command_match) >> -spaces;
 624
 625     // moncap := grant [grant ...]
 626     grants %= (grant % (*lit(' ') >> (lit(';') | lit(',')) >> *lit(' ')));
 627     moncap = grants  [_val = phoenix::construct<MonCap>(_1)];
 628
 629   }
 630   qi::rule<Iterator> spaces;
 631   qi::rule<Iterator, unsigned()> rwxa;
 632   qi::rule<Iterator, string()> quoted_string;
 633   qi::rule<Iterator, string()> unquoted_word;
 634   qi::rule<Iterator, string()> str, network_str;
 635   qi::rule<Iterator, string()> fs_name_str;
 636
 637   qi::rule<Iterator, StringConstraint()> str_match, str_prefix, str_regex;
 638   qi::rule<Iterator, pair<string, StringConstraint>()> kv_pair;
 639   qi::rule<Iterator, map<string, StringConstraint>()> kv_map;
 640
 641   qi::rule<Iterator, MonCapGrant()> rwxa_match;
 642   qi::rule<Iterator, MonCapGrant()> command_match;
 643   qi::rule<Iterator, MonCapGrant()> service_match;
 644   qi::rule<Iterator, MonCapGrant()> profile_match;
 645   qi::rule<Iterator, MonCapGrant()> grant;
 646   qi::rule<Iterator, std::vector<MonCapGrant>()> grants;
 647   qi::rule<Iterator, MonCap()> moncap;
 648 };
 649
 650 bool MonCap::parse(const string& str, ostream *err)
 651 {
 652   auto iter = str.begin();
 653   auto end = str.end();
 654
 655   MonCapParser<string::const_iterator> exp;
 656   bool r = qi::parse(iter, end, exp, *this);
 657   if (r && iter == end) {
 658     text = str;
 659     for (auto& g : grants) {
 660       g.parse_network();
 661     }
 662     return true;
 663   }
 664
 665   // Make sure no grants are kept after parsing failed!
 666   grants.clear();
 667
 668   if (err) {
 669     if (iter != end)
 670       *err << "mon capability parse failed, stopped at '"
 671            << std::string(iter, end)
 672            << "' of '" << str << "'";
 673     else
 674       *err << "mon capability parse failed, stopped at end of '" << str << "'";
 675   }
 676
 677   return false;
 678 }
 679