fix acl permission

Author: lqxhub

conf/pika.conf

@@ -68,12 +68,12 @@ requirepass :
 # [NOTICE] The value of this parameter must match the "requirepass" setting on the master.
 masterauth :
 
-# The [password of user], which is empty by default.
+# The [password of user], which is empty by default.(Deprecated)
 # [NOTICE] If this user password is the same as admin password (including both being empty),
 # the value of this parameter will be ignored and all users are considered as administrators,
 # in this scenario, users are not subject to the restrictions imposed by the userblacklist.
 # PS: "admin password" refers to value of the parameter above: requirepass.
-userpass :
+# userpass :
 
 # The blacklist of commands for users that logged in by userpass,
 # the commands that added to this list will not be available for users except for administrator.
@@ -446,5 +446,5 @@ max-rsync-parallel-num : 4
 # The format of the external ACL user file is exactly the same as the
 # format that is used inside pika.conf to describe users.
 #
-#aclfile : ../conf/users.acl
+# aclfile : ../conf/users.acl
 

include/acl.h

@@ -19,7 +19,7 @@
 #include "pika_command.h"
 #include "pstd_status.h"
 
-#define USER_COMMAND_BITS_COUNT 1024
+static const int USER_COMMAND_BITS_COUNT = 1024;
 
 enum class AclSelectorFlag {
   ROOT = (1 << 0),          // This is the root user permission selector
@@ -119,13 +119,13 @@ class AclSelector {
   void ChangeSelector(const std::shared_ptr<Cmd>& cmd, bool allow);
   pstd::Status ChangeSelector(const std::shared_ptr<Cmd>& cmd, const std::string& subCmd, bool allow);
 
-  void SetSubCommand(const uint32_t cmdId);
-  void SetSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex);
+  void SetSubCommand(uint32_t cmdId);
+  void SetSubCommand(uint32_t cmdId, uint32_t subCmdIndex);
   void ResetSubCommand();
-  void ResetSubCommand(const uint32_t cmdId);
-  void ResetSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex);
+  void ResetSubCommand(uint32_t cmdId);
+  void ResetSubCommand(uint32_t cmdId, uint32_t subCmdIndex);
 
-  bool CheckSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex);
+  bool CheckSubCommand(uint32_t cmdId, uint32_t subCmdIndex);
 
   void DescribeSelectorCommandRules(std::string* str);
 
@@ -172,7 +172,7 @@ class AclSelector {
 class User {
  public:
   User() = delete;
-  explicit User(const std::string& name);
+  explicit User(std::string name);
 
   std::string Name() const;
 
@@ -226,17 +226,17 @@ class User {
  private:
   mutable std::shared_mutex mutex_;
 
-  std::string name_;  // The username
+  std::string name_;                                                            // The username
 
   std::atomic<uint32_t> flags_ = static_cast<uint32_t>(AclUserFlag::DISABLED);  // See USER_FLAG_*
 
-  std::set<std::string> passwords_;  // passwords for this user
+  std::set<std::string> passwords_;                                             // passwords for this user
 
   std::list<std::shared_ptr<AclSelector>> selectors_; /* A set of selectors this user validates commands
                         against. This list will always contain at least
                         one selector for backwards compatibility. */
 
-  std::string aclString_; /* cached string represent of ACLs */
+  std::string aclString_;                             /* cached string represent of ACLs */
 };
 
 class Acl {
@@ -300,10 +300,10 @@ class Acl {
   void UpdateDefaultUserPassword(const std::string& pass);
 
   // check the user can be exec the command, after exec command
-  bool CheckUserCanExec(const std::shared_ptr<Cmd>& cmd, const PikaCmdArgsType& argv);
+  //  bool CheckUserCanExec(const std::shared_ptr<Cmd>& cmd, const PikaCmdArgsType& argv);
 
   // 根据 cmd 分类名 获取分类的值
-  inline static uint32_t GetCommandCategoryFlagByName(const std::string& name);
+  static uint32_t GetCommandCategoryFlagByName(const std::string& name);
 
   // 根据 category获取对应的name
   static std::string GetCommandCategoryFlagByName(const uint32_t category);

src/acl.cc

@@ -18,7 +18,7 @@ extern std::unique_ptr<PikaCmdTableManager> g_pika_cmd_table_manager;
 
 // class User
 
-User::User(const std::string& name) : name_(name) {
+User::User( std::string name) : name_(std::move(name)) {
   selectors_.emplace_back(std::make_shared<AclSelector>(static_cast<uint32_t>(AclSelectorFlag::ROOT)));
 }
 
@@ -157,6 +157,7 @@ pstd::Status User::CreateSelectorFromOpSet(const std::string& opSet) {
     return status;
   }
   AddSelector(selector);
+  return status;
 }
 
 std::shared_ptr<AclSelector> User::GetRootSelector() {
@@ -255,12 +256,8 @@ void User::GetUserDescribe(CmdRes* res) {
 AclDeniedCmd User::CheckUserPermission(std::shared_ptr<Cmd>& cmd, const PikaCmdArgsType& argv) {
   std::shared_lock l(mutex_);
 
-  if (!cmd->CheckArg(argv.size())) {
-    return AclDeniedCmd::NUMBER;
-  }
   std::string subCmd = "";
-  std::vector<std::string> keys;
-
+  auto keys = cmd->current_key();
   AclDeniedCmd res = AclDeniedCmd::OK;
   for (const auto& selector : selectors_) {
     res = selector->CheckCanExecCmd(cmd, subCmd, keys);
@@ -453,7 +450,7 @@ void Acl::UpdateDefaultUserPassword(const std::string& pass) {
   }
 }
 
-bool Acl::CheckUserCanExec(const std::shared_ptr<Cmd>& cmd, const PikaCmdArgsType& argv) { cmd->name(); }
+// bool Acl::CheckUserCanExec(const std::shared_ptr<Cmd>& cmd, const PikaCmdArgsType& argv) { cmd->name(); }
 
 std::shared_ptr<User> Acl::CreateDefaultUser() {
   auto defaultUser = std::make_shared<User>(DefaultUser);
@@ -545,7 +542,7 @@ std::shared_ptr<User> Acl::Auth(const std::string& userName, const std::string&
   if (!user) {
     return nullptr;
   }
-  if (user->MatchPassword(password)) {
+  if (user->MatchPassword(pstd::sha256(password))) {
     return user;
   }
   return nullptr;
@@ -858,21 +855,17 @@ pstd::Status AclSelector::ChangeSelector(const std::shared_ptr<Cmd>& cmd, const
   return pstd::Status::OK();
 }
 
-void AclSelector::SetSubCommand(const uint32_t cmdId) { subCommand_[cmdId] = ~0; }
+void AclSelector::SetSubCommand(uint32_t cmdId) { subCommand_[cmdId] = ~0; }
 
-void AclSelector::SetSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex) {
-  subCommand_[cmdId] = (1 << subCmdIndex);
-}
+void AclSelector::SetSubCommand(uint32_t cmdId, uint32_t subCmdIndex) { subCommand_[cmdId] = (1 << subCmdIndex); }
 
 void AclSelector::ResetSubCommand() { subCommand_.clear(); }
 
-void AclSelector::ResetSubCommand(const uint32_t cmdId) { subCommand_[cmdId] = 0; }
+void AclSelector::ResetSubCommand(uint32_t cmdId) { subCommand_[cmdId] = 0; }
 
-void AclSelector::ResetSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex) {
-  subCommand_[cmdId] = ~(1 << subCmdIndex);
-}
+void AclSelector::ResetSubCommand(uint32_t cmdId, uint32_t subCmdIndex) { subCommand_[cmdId] = ~(1 << subCmdIndex); }
 
-bool AclSelector::CheckSubCommand(const uint32_t cmdId, const uint32_t subCmdIndex) {
+bool AclSelector::CheckSubCommand(uint32_t cmdId, uint32_t subCmdIndex) {
   if (subCmdIndex < 0) {
     return false;
   }
@@ -1061,7 +1054,7 @@ void AclSelector::RemoveCommonRule(const std::string& rule) {
 
     if (start > 0) {  // the rule not included '-'/'+', but need delete need
       --start;
-      ++delNum;  // star position moved one forward So delNum takes +1
+      ++delNum;       // star position moved one forward So delNum takes +1
     }
 
     commandRules_.erase(start, delNum);

src/pika_acl.cc

@@ -80,7 +80,7 @@ void PikaAclCmd::Cat() {
     res().AppendStringVector(Acl::GetAllCategoryName());
     return;
   }
-  auto category = g_pika_server->Acl()->GetCommandCategoryFlagByName(argv_[2]);
+  auto category = Acl::GetCommandCategoryFlagByName(argv_[2]);
   if (category == 0) {
     res().SetRes(CmdRes::kErrOther, fmt::format("Unknown category '{}'", argv_[2]));
     return;
@@ -207,9 +207,9 @@ void PikaAclCmd::WhoAmI() {
   auto name = conn->UserName();
 
   if (name.empty()) {
-    res().AppendString(name);
+    res().AppendString(Acl::DefaultUser);
   } else {
-    res().SetRes(CmdRes::kNone);
+    res().AppendString(name);
   }
 }
 

src/pika_admin.cc

@@ -62,7 +62,7 @@ enum AuthResult {
 static AuthResult AuthenticateUser(const std::string& userName, const std::string& pwd,
                                    const std::shared_ptr<net::NetConn>& conn) {
   std::string root_password(g_pika_conf->requirepass());
-  if (root_password.empty()) {
+  if (userName == Acl::DefaultUser && root_password.empty()) {
     return AuthResult::NO_REQUIRE_PASS;
   }
 

src/pika_client_conn.cc

@@ -53,6 +53,17 @@ std::shared_ptr<Cmd> PikaClientConn::DoCmd(const PikaCmdArgsType& argv, const st
     }
   }
 
+  uint64_t start_us = 0;
+  if (g_pika_conf->slowlog_slower_than() >= 0) {
+    start_us = pstd::NowMicros();
+  }
+
+  // Initial
+  c_ptr->Initial(argv, current_db_);
+  if (!c_ptr->res().ok()) {
+    return c_ptr;
+  }
+
   auto checkRes = user_->CheckUserPermission(c_ptr, argv);
   switch (checkRes) {
     case AclDeniedCmd::CMD:
@@ -65,7 +76,7 @@ std::shared_ptr<Cmd> PikaClientConn::DoCmd(const PikaCmdArgsType& argv, const st
       return c_ptr;
     case AclDeniedCmd::CHANNEL:
       c_ptr->res().SetRes(CmdRes::kErrOther,
-                          "-NOPERM this user has no permissions to access one of the keys used as arguments");
+                          "-NOPERM this user has no permissions to access one of the channel used as arguments");
       return c_ptr;
     default:
       break;
@@ -76,12 +87,6 @@ std::shared_ptr<Cmd> PikaClientConn::DoCmd(const PikaCmdArgsType& argv, const st
     ProcessMonitor(argv);
   }
 
-  // Initial
-  c_ptr->Initial(argv, current_db_);
-  if (!c_ptr->res().ok()) {
-    return c_ptr;
-  }
-
   g_pika_server->UpdateQueryNumAndExecCountDB(current_db_, opt, c_ptr->is_write());
 
   // PubSub connection