authorizer.hpp

Go to the documentation of this file.

// Licensed to the Apache Software Foundation (ASF) under one
// or more contributor license agreements.  See the NOTICE file
// distributed with this work for additional information
// regarding copyright ownership.  The ASF licenses this file
// to you under the Apache License, Version 2.0 (the
// "License"); you may not use this file except in compliance
// with the License.  You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#ifndef __MESOS_AUTHORIZER_AUTHORIZER_HPP__
#define __MESOS_AUTHORIZER_AUTHORIZER_HPP__

#include <mesos/mesos.hpp>

// ONLY USEFUL AFTER RUNNING PROTOC.
#include <mesos/authorizer/authorizer.pb.h>

#include <process/future.hpp>

#include <stout/nothing.hpp>
#include <stout/option.hpp>
#include <stout/try.hpp>

namespace mesos {

class ACLs;

class ObjectApprover
{
public:
  // This object has a 1:1 relationship with `authorization::Object`.
  // We need to ensure that the fields in this object are in sync
  // with the fields in `authorization::Object`.
  struct Object
  {
    Object()
      : value(nullptr),
        framework_info(nullptr),
        task(nullptr),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(const std::string& _value)
      : value(&_value),
        framework_info(nullptr),
        task(nullptr),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(const ContainerID& _container_id)
      : value(nullptr),
        framework_info(nullptr),
        task(nullptr),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(&_container_id),
        machine_id(nullptr) {}

    Object(const MachineID& _machine_id)
      : value(nullptr),
        framework_info(nullptr),
        task(nullptr),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(&_machine_id) {}

    Object(const FrameworkInfo& _framework_info)
      : value(nullptr),
        framework_info(&_framework_info),
        task(nullptr),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(const ExecutorInfo& _executor_info,
        const FrameworkInfo& _framework_info)
      : value(nullptr),
        framework_info(&_framework_info),
        task(nullptr),
        task_info(nullptr),
        executor_info(&_executor_info),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(const TaskInfo& _task_info, const FrameworkInfo& _framework_info)
      : value(nullptr),
        framework_info(&_framework_info),
        task(nullptr),
        task_info(&_task_info),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(const Task& _task, const FrameworkInfo& _framework_info)
      : value(nullptr),
        framework_info(&_framework_info),
        task(&_task),
        task_info(nullptr),
        executor_info(nullptr),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(nullptr),
        machine_id(nullptr) {}

    Object(
        const ExecutorInfo& _executor_info,
        const FrameworkInfo& _framework_info,
        const CommandInfo& _command_info,
        const ContainerID& _container_id)
      : value(nullptr),
        framework_info(&_framework_info),
        task(nullptr),
        task_info(nullptr),
        executor_info(&_executor_info),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(&_command_info),
        container_id(&_container_id),
        machine_id(nullptr) {}

    Object(
        const ExecutorInfo& _executor_info,
        const FrameworkInfo& _framework_info,
        const ContainerID& _container_id)
      : value(nullptr),
        framework_info(&_framework_info),
        task(nullptr),
        task_info(nullptr),
        executor_info(&_executor_info),
        quota_info(nullptr),
        weight_info(nullptr),
        resource(nullptr),
        command_info(nullptr),
        container_id(&_container_id),
        machine_id(nullptr) {}

    Object(const authorization::Object& object)
      : value(object.has_value() ? &object.value() : nullptr),
        framework_info(
            object.has_framework_info() ? &object.framework_info() : nullptr),
        task(object.has_task() ? &object.task() : nullptr),
        task_info(object.has_task_info() ? &object.task_info() : nullptr),
        executor_info(
            object.has_executor_info() ? &object.executor_info() : nullptr),
        quota_info(object.has_quota_info() ? &object.quota_info() : nullptr),
        weight_info(object.has_weight_info() ? &object.weight_info() : nullptr),
        resource(object.has_resource() ? &object.resource() : nullptr),
        command_info(
            object.has_command_info() ? &object.command_info() : nullptr),
        container_id(
            object.has_container_id() ? &object.container_id() : nullptr),
        machine_id(object.has_machine_id() ? &object.machine_id() : nullptr) {}

    const std::string* value;
    const FrameworkInfo* framework_info;
    const Task* task;
    const TaskInfo* task_info;
    const ExecutorInfo* executor_info;
    const quota::QuotaInfo* quota_info;
    const WeightInfo* weight_info;
    const Resource* resource;
    const CommandInfo* command_info;
    const ContainerID* container_id;
    const MachineID* machine_id;
  };

  virtual Try<bool> approved(const Option<Object>& object) const noexcept = 0;

  virtual ~ObjectApprover() = default;
};


class Authorizer
{
public:
  static Try<Authorizer*> create(const std::string &name);

  static Try<Authorizer*> create(const ACLs& acls);

  virtual ~Authorizer() {}

  virtual process::Future<bool> authorized(
      const authorization::Request& request) = 0;

  virtual process::Future<std::shared_ptr<const ObjectApprover>>
  getApprover(
      const Option<authorization::Subject>& subject,
      const authorization::Action& action) = 0;

protected:
  Authorizer() {}
};

} // namespace mesos {

#endif // __MESOS_AUTHORIZER_AUTHORIZER_HPP__