Re: [Qemu-devel] PATCH: 6/7: Support simple ACL for client authorization

[Anthony Liguori <anthony@codemonkey.ws>]

Daniel P. Berrange wrote:
> This patch introduces a generic internal API for access control lists
> to be used by network servers in QEMU. It adds support for checking
> these ACL in the VNC server, in two places. The first ACL is for the
> SASL authentication mechanism, checking the SASL username. This ACL
> is called 'vnc.username'. The second is for the TLS authentication
> mechanism, when x509 client certificates are turned on, checking against
> the Distinguished Name of the client. This ACL is called 'vnc.x509dname'
>
> The internal API provides for an ACL with the following characteristics
>
>  - A unique name, eg  vnc.username, and vnc.x509dname.
>  - A default policy, allow or deny
>  - An ordered series of match rules, with allow or deny policy
>
> If none of the match rules apply, then the default policy is
> used.
>
> There is a monitor API to manipulate the ACLs, which I'll describe via
> examples
>
>   (qemu) acl show vnc.username
>   policy: allow
>   (qemu) acl policy vnc.username denya
>   acl: policy set to 'deny'
>   (qemu) acl allow vnc.username fred
>   acl: added rule at position 1
>   (qemu) acl allow vnc.username bob
>   acl: added rule at position 2
>   (qemu) acl allow vnc.username joe 1
>   acl: added rule at position 1
>   (qemu) acl show vnc.username
>   policy: deny
>   0: allow fred
>   1: allow joe
>   2: allow bob
>   


>   (qemu) acl show vnc.x509dname
>   policy: allow
>   (qemu) acl policy vnc.x509dname deny
>   acl: policy set to 'deny'
>   (qemu) acl allow vnc.x509dname C=GB,O=ACME,L=London,CN=*
>   acl: added rule at position 1
>   (qemu) acl allow vnc.x509dname C=GB,O=ACME,L=Boston,CN=bob
>   acl: added rule at position 2
>   (qemu) acl show vnc.x509dname
>   policy: deny
>   0: allow C=GB,O=ACME,L=London,CN=*
>   1: allow C=GB,O=ACME,L=Boston,CN=bob
>
> At startup the ACLs currently default to an allow policy. The
> next patch will provide a way to load a pre-defined ACL when
> starting up
>
>
>    Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
>
>
>  Makefile        |    6 +-
>  b/acl.c         |  158 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  b/acl.h         |   68 ++++++++++++++++++++++++
>  monitor.c       |   80 ++++++++++++++++++++++++++++
>  vnc-auth-sasl.c |   19 +++++-
>  vnc-auth-sasl.h |    4 +
>  vnc-tls.c       |   19 ++++++
>  vnc-tls.h       |    3 +
>  vnc.c           |   14 ++++
>  9 files changed, 363 insertions(+), 8 deletions(-)
>
> Daniel
>
>
> diff -r efb50f6c8c69 Makefile
> --- a/Makefile	Thu Feb 12 12:33:38 2009 +0000
> +++ b/Makefile	Thu Feb 12 12:48:43 2009 +0000
> @@ -144,7 +144,7 @@ endif
>  ifdef CONFIG_CURSES
>  OBJS+=curses.o
>  endif
> -OBJS+=vnc.o d3des.o
> +OBJS+=vnc.o acl.o d3des.o
>  ifdef CONFIG_VNC_TLS
>  OBJS+=vnc-tls.o vnc-auth-vencrypt.o
>  endif
> @@ -174,9 +174,11 @@ sdl.o: sdl.c keymaps.h sdl_keysym.h
>  
>  sdl.o audio/sdlaudio.o: CFLAGS += $(SDL_CFLAGS)
>  
> +acl.o: acl.h acl.c
> +
>  vnc.h: vnc-tls.h vnc-auth-vencrypt.h vnc-auth-sasl.h keymaps.h
>  
> -vnc.o: vnc.c vnc.h vnc_keysym.h vnchextile.h d3des.c d3des.h
> +vnc.o: vnc.c vnc.h vnc_keysym.h vnchextile.h d3des.c d3des.h acl.h
>  
>  vnc.o: CFLAGS += $(CONFIG_VNC_TLS_CFLAGS)
>  
> diff -r efb50f6c8c69 acl.c
> --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
> +++ b/acl.c	Thu Feb 12 12:48:43 2009 +0000
> @@ -0,0 +1,158 @@
> +/*
> + * QEMU access control list management
> + *
> + * Copyright (C) 2009 Red Hat, Inc
> + *
> + * Permission is hereby granted, free of charge, to any person obtaining a copy
> + * of this software and associated documentation files (the "Software"), to deal
> + * in the Software without restriction, including without limitation the rights
> + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
> + * copies of the Software, and to permit persons to whom the Software is
> + * furnished to do so, subject to the following conditions:
> + *
> + * The above copyright notice and this permission notice shall be included in
> + * all copies or substantial portions of the Software.
> + *
> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
> + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
> + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
> + * THE SOFTWARE.
> + */
> +
> +
> +#include "qemu-common.h"
> +#include "sysemu.h"
> +#include "acl.h"
> +#include <fnmatch.h>
> +
> +
> +static unsigned int nacls = 0;
> +static ACL **acls = NULL;
>   

I'd prefer you make this a list (using sys-queue.h).  An advantage would 
be that you could support removing rules in the monitor as that seems 
like an obvious feature.

BTW, there is a qemu_strdup and you don't have to check it's results.

Regards,

Anthony Liguori