Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
redis
Commits
577fc438
Commit
577fc438
authored
Jan 27, 2020
by
antirez
Browse files
ACL LOG: data structures and initial functions.
parent
f7a94526
Changes
5
Hide whitespace changes
Inline
Side-by-side
src/acl.c
View file @
577fc438
...
...
@@ -49,6 +49,8 @@ list *UsersToLoad; /* This is a list of users found in the configuration file
array of SDS pointers: the first is the user name,
all the remaining pointers are ACL rules in the same
format as ACLSetUser(). */
list
*
ACLLog
;
/* Our security log, the user is able to inspect that
using the ACL LOG command .*/
struct
ACLCategoryItem
{
const
char
*
name
;
...
...
@@ -920,6 +922,7 @@ void ACLInitDefaultUser(void) {
void
ACLInit
(
void
)
{
Users
=
raxNew
();
UsersToLoad
=
listCreate
();
ACLLog
=
listCreate
();
ACLInitDefaultUser
();
}
...
...
@@ -1034,7 +1037,7 @@ user *ACLGetUserByName(const char *name, size_t namelen) {
* command cannot be executed because the user is not allowed to run such
* command, the second if the command is denied because the user is trying
* to access keys that are not among the specified patterns. */
int
ACLCheckCommandPerm
(
client
*
c
)
{
int
ACLCheckCommandPerm
(
client
*
c
,
int
*
keyidxptr
)
{
user
*
u
=
c
->
user
;
uint64_t
id
=
c
->
cmd
->
id
;
...
...
@@ -1094,6 +1097,7 @@ int ACLCheckCommandPerm(client *c) {
}
}
if
(
!
match
)
{
if
(
keyidxptr
)
*
keyidxptr
=
keyidx
[
j
];
getKeysFreeResult
(
keyidx
);
return
ACL_DENIED_KEY
;
}
...
...
@@ -1454,6 +1458,51 @@ void ACLLoadUsersAtStartup(void) {
}
}
/* =============================================================================
* ACL log
* ==========================================================================*/
#define ACL_LOG_CTX_TOPLEVEL 0
#define ACL_LOG_CTX_LUA 1
#define ACL_LOG_CTX_MULTI 2
/* This structure defines an entry inside the ACL log. */
typedef
struct
aclLogEntry
{
uint64_t
count
;
/* Number of times this happened recently. */
int
reason
;
/* Reason for denying the command. ACL_DENIED_*. */
int
context
;
/* Toplevel, Lua or MULTI/EXEC? ACL_LOG_CTX_*. */
sds
object
;
/* The key name or command name. */
sds
username
;
/* User the client is authenticated with. */
mstime_t
ctime
;
/* Milliseconds time of last update to this entry. */
sds
cinfo
;
/* Client info (last client if updated). */
}
aclLogEntry
;
void
addACLLogEntry
(
client
*
c
,
int
reason
,
int
keypos
)
{
/* Create a new entry. */
struct
aclLogEntry
*
le
=
zmalloc
(
sizeof
(
*
le
));
le
->
count
=
1
;
le
->
object
=
(
reason
==
ACL_DENIED_CMD
)
?
sdsnew
(
c
->
cmd
->
name
)
:
sdsdup
(
c
->
argv
[
keypos
]
->
ptr
);
le
->
username
=
sdsdup
(
c
->
user
->
name
);
le
->
ctime
=
mstime
();
client
*
realclient
=
c
;
if
(
realclient
->
flags
&
CLIENT_LUA
)
realclient
=
server
.
lua_caller
;
le
->
cinfo
=
catClientInfoString
(
sdsempty
(),
realclient
);
if
(
c
->
flags
&
CLIENT_MULTI
)
{
le
->
context
=
ACL_LOG_CTX_MULTI
;
}
else
if
(
c
->
flags
&
CLIENT_LUA
)
{
le
->
context
=
ACL_LOG_CTX_LUA
;
}
else
{
le
->
context
=
ACL_LOG_CTX_TOPLEVEL
;
}
/* Add it to our list of entires. We'll have to trim the list
* to its maximum size. */
listAddNodeHead
(
ACLLog
,
le
);
}
/* =============================================================================
* ACL related commands
* ==========================================================================*/
...
...
src/multi.c
View file @
577fc438
...
...
@@ -177,7 +177,7 @@ void execCommand(client *c) {
must_propagate
=
1
;
}
int
acl_retval
=
ACLCheckCommandPerm
(
c
);
int
acl_retval
=
ACLCheckCommandPerm
(
c
,
NULL
);
if
(
acl_retval
!=
ACL_OK
)
{
addReplyErrorFormat
(
c
,
"-NOPERM ACLs rules changed between the moment the "
...
...
src/scripting.c
View file @
577fc438
...
...
@@ -606,7 +606,7 @@ int luaRedisGenericCommand(lua_State *lua, int raise_error) {
}
/* Check the ACLs. */
int
acl_retval
=
ACLCheckCommandPerm
(
c
);
int
acl_retval
=
ACLCheckCommandPerm
(
c
,
NULL
);
if
(
acl_retval
!=
ACL_OK
)
{
if
(
acl_retval
==
ACL_DENIED_CMD
)
luaPushError
(
lua
,
"The user executing the script can't run this "
...
...
src/server.c
View file @
577fc438
...
...
@@ -3377,7 +3377,7 @@ int processCommand(client *c) {
/* Check if the user can run this command according to the current
* ACLs. */
int
acl_retval
=
ACLCheckCommandPerm
(
c
);
int
acl_retval
=
ACLCheckCommandPerm
(
c
,
NULL
);
if
(
acl_retval
!=
ACL_OK
)
{
flagTransaction
(
c
);
if
(
acl_retval
==
ACL_DENIED_CMD
)
...
...
src/server.h
View file @
577fc438
...
...
@@ -1824,7 +1824,7 @@ int ACLCheckUserCredentials(robj *username, robj *password);
int
ACLAuthenticateUser
(
client
*
c
,
robj
*
username
,
robj
*
password
);
unsigned
long
ACLGetCommandID
(
const
char
*
cmdname
);
user
*
ACLGetUserByName
(
const
char
*
name
,
size_t
namelen
);
int
ACLCheckCommandPerm
(
client
*
c
);
int
ACLCheckCommandPerm
(
client
*
c
,
int
*
keyidxptr
);
int
ACLSetUser
(
user
*
u
,
const
char
*
op
,
ssize_t
oplen
);
sds
ACLDefaultUserFirstPassword
(
void
);
uint64_t
ACLGetCommandCategoryFlagByName
(
const
char
*
name
);
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment