Permission revocation
[hcoop/domtool2.git] / src / main.sml
... / ...
CommitLineData
1(* HCoop Domtool (http://hcoop.sourceforge.net/)
2 * Copyright (c) 2006, Adam Chlipala
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17 *)
18
19(* Main interface *)
20
21structure Main :> MAIN = struct
22
23open Ast MsgTypes Print
24
25structure SM = StringMap
26
27fun init () = Acl.read Config.aclFile
28
29fun check' G fname =
30 let
31 val prog = Parse.parse fname
32 in
33 if !ErrorMsg.anyErrors then
34 G
35 else
36 Tycheck.checkFile G (Defaults.tInit ()) prog
37 end
38
39fun basis () =
40 let
41 val dir = Posix.FileSys.opendir Config.libRoot
42
43 fun loop files =
44 case Posix.FileSys.readdir dir of
45 NONE => (Posix.FileSys.closedir dir;
46 files)
47 | SOME fname =>
48 if String.isSuffix ".dtl" fname then
49 loop (OS.Path.joinDirFile {dir = Config.libRoot,
50 file = fname}
51 :: files)
52 else
53 loop files
54
55 val files = loop []
56 val (_, files) = Order.order files
57 in
58 if !ErrorMsg.anyErrors then
59 Env.empty
60 else
61 (Tycheck.allowExterns ();
62 foldl (fn (fname, G) => check' G fname) Env.empty files
63 before Tycheck.disallowExterns ())
64 end
65
66fun check fname =
67 let
68 val _ = ErrorMsg.reset ()
69 val _ = Env.preTycheck ()
70
71 val b = basis ()
72 in
73 if !ErrorMsg.anyErrors then
74 raise ErrorMsg.Error
75 else
76 let
77 val _ = Tycheck.disallowExterns ()
78 val _ = ErrorMsg.reset ()
79 val prog = Parse.parse fname
80 in
81 if !ErrorMsg.anyErrors then
82 raise ErrorMsg.Error
83 else
84 let
85 val G' = Tycheck.checkFile b (Defaults.tInit ()) prog
86 in
87 if !ErrorMsg.anyErrors then
88 raise ErrorMsg.Error
89 else
90 (G', #3 prog)
91 end
92 end
93 end
94
95fun reduce fname =
96 let
97 val (G, body) = check fname
98 in
99 if !ErrorMsg.anyErrors then
100 NONE
101 else
102 case body of
103 SOME body =>
104 let
105 val body' = Reduce.reduceExp G body
106 in
107 (*printd (PD.hovBox (PD.PPS.Rel 0,
108 [PD.string "Result:",
109 PD.space 1,
110 p_exp body']))*)
111 SOME body'
112 end
113 | _ => NONE
114 end
115
116fun eval fname =
117 case reduce fname of
118 (SOME body') =>
119 if !ErrorMsg.anyErrors then
120 raise ErrorMsg.Error
121 else
122 Eval.exec (Defaults.eInit ()) body'
123 | NONE => raise ErrorMsg.Error
124
125val dispatcher =
126 Config.dispatcher ^ ":" ^ Int.toString Config.dispatcherPort
127
128fun requestContext f =
129 let
130 val uid = Posix.ProcEnv.getuid ()
131 val user = Posix.SysDB.Passwd.name (Posix.SysDB.getpwuid uid)
132
133 val () = Acl.read Config.aclFile
134 val () = Domain.setUser user
135
136 val () = f ()
137
138 val context = OpenSSL.context (Config.certDir ^ "/" ^ user ^ ".pem",
139 Config.keyDir ^ "/" ^ user ^ "/key.pem",
140 Config.trustStore)
141 in
142 (user, context)
143 end
144
145fun requestBio f =
146 let
147 val (user, context) = requestContext f
148 in
149 (user, OpenSSL.connect (context, dispatcher))
150 end
151
152fun request fname =
153 let
154 val (user, bio) = requestBio (fn () => ignore (check fname))
155
156 val inf = TextIO.openIn fname
157
158 fun loop lines =
159 case TextIO.inputLine inf of
160 NONE => String.concat (List.rev lines)
161 | SOME line => loop (line :: lines)
162
163 val code = loop []
164 in
165 TextIO.closeIn inf;
166 Msg.send (bio, MsgConfig code);
167 case Msg.recv bio of
168 NONE => print "Server closed connection unexpectedly.\n"
169 | SOME m =>
170 case m of
171 MsgOk => print "Configuration succeeded.\n"
172 | MsgError s => print ("Configuration failed: " ^ s ^ "\n")
173 | _ => print "Unexpected server reply.\n";
174 OpenSSL.close bio
175 end
176 handle ErrorMsg.Error => ()
177
178fun requestGrant acl =
179 let
180 val (user, bio) = requestBio (fn () => ())
181 in
182 Msg.send (bio, MsgGrant acl);
183 case Msg.recv bio of
184 NONE => print "Server closed connection unexpectedly.\n"
185 | SOME m =>
186 case m of
187 MsgOk => print "Grant succeeded.\n"
188 | MsgError s => print ("Grant failed: " ^ s ^ "\n")
189 | _ => print "Unexpected server reply.\n";
190 OpenSSL.close bio
191 end
192
193fun requestRevoke acl =
194 let
195 val (user, bio) = requestBio (fn () => ())
196 in
197 Msg.send (bio, MsgRevoke acl);
198 case Msg.recv bio of
199 NONE => print "Server closed connection unexpectedly.\n"
200 | SOME m =>
201 case m of
202 MsgOk => print "Revoke succeeded.\n"
203 | MsgError s => print ("Revoke failed: " ^ s ^ "\n")
204 | _ => print "Unexpected server reply.\n";
205 OpenSSL.close bio
206 end
207
208fun service () =
209 let
210 val () = Acl.read Config.aclFile
211
212 val context = OpenSSL.context (Config.serverCert,
213 Config.serverKey,
214 Config.trustStore)
215 val _ = Domain.set_context context
216
217 val sock = OpenSSL.listen (context, Config.dispatcherPort)
218
219 fun loop () =
220 case OpenSSL.accept sock of
221 NONE => ()
222 | SOME bio =>
223 let
224 val user = OpenSSL.peerCN bio
225 val () = print ("\nConnection from " ^ user ^ "\n")
226 val () = Domain.setUser user
227
228 fun cmdLoop () =
229 case Msg.recv bio of
230 NONE => (OpenSSL.close bio
231 handle OpenSSL.OpenSSL _ => ();
232 loop ())
233 | SOME m =>
234 case m of
235 MsgConfig code =>
236 let
237 val _ = print "Configuration:\n"
238 val _ = print code
239 val _ = print "\n"
240
241 val outname = OS.FileSys.tmpName ()
242 val outf = TextIO.openOut outname
243 in
244 TextIO.output (outf, code);
245 TextIO.closeOut outf;
246 (eval outname;
247 Msg.send (bio, MsgOk))
248 handle ErrorMsg.Error =>
249 (print "Compilation error\n";
250 Msg.send (bio,
251 MsgError "Error during configuration evaluation"))
252 | OpenSSL.OpenSSL s =>
253 (print "OpenSSL error\n";
254 Msg.send (bio,
255 MsgError
256 ("Error during configuration evaluation: "
257 ^ s)));
258 OS.FileSys.remove outname;
259 (ignore (OpenSSL.readChar bio);
260 OpenSSL.close bio)
261 handle OpenSSL.OpenSSL _ => ();
262 loop ()
263 end
264
265 | MsgGrant acl =>
266 if Acl.query {user = user, class = "group", value = "root"} then
267 ((Acl.grant acl;
268 Acl.write Config.aclFile;
269 Msg.send (bio, MsgOk);
270 print ("Granted permission " ^ #value acl ^ " to " ^ #user acl ^ " in " ^ #class acl ^ ".\n"))
271 handle OpenSSL.OpenSSL s =>
272 (print "OpenSSL error\n";
273 Msg.send (bio,
274 MsgError
275 ("Error during granting: "
276 ^ s)));
277 (ignore (OpenSSL.readChar bio);
278 OpenSSL.close bio)
279 handle OpenSSL.OpenSSL _ => ();
280 loop ())
281 else
282 ((Msg.send (bio, MsgError "Not authorized to grant privileges");
283 print "Unauthorized user asked to grant a permission!\n";
284 ignore (OpenSSL.readChar bio);
285 OpenSSL.close bio)
286 handle OpenSSL.OpenSSL _ => ();
287 loop ())
288
289 | MsgRevoke acl =>
290 if Acl.query {user = user, class = "group", value = "root"} then
291 ((Acl.revoke acl;
292 Acl.write Config.aclFile;
293 Msg.send (bio, MsgOk);
294 print ("Revoked permission " ^ #value acl ^ " from " ^ #user acl ^ " in " ^ #class acl ^ ".\n"))
295 handle OpenSSL.OpenSSL s =>
296 (print "OpenSSL error\n";
297 Msg.send (bio,
298 MsgError
299 ("Error during revocation: "
300 ^ s)));
301 (ignore (OpenSSL.readChar bio);
302 OpenSSL.close bio)
303 handle OpenSSL.OpenSSL _ => ();
304 loop ())
305 else
306 ((Msg.send (bio, MsgError "Not authorized to revoke privileges");
307 print "Unauthorized user asked to revoke a permission!\n";
308 ignore (OpenSSL.readChar bio);
309 OpenSSL.close bio)
310 handle OpenSSL.OpenSSL _ => ();
311 loop ())
312
313 | _ =>
314 (Msg.send (bio, MsgError "Unexpected command")
315 handle OpenSSL.OpenSSL _ => ();
316 OpenSSL.close bio
317 handle OpenSSL.OpenSSL _ => ();
318 loop ())
319 in
320 cmdLoop ()
321 end
322 handle OpenSSL.OpenSSL s =>
323 (print ("OpenSSL error: " ^ s ^ "\n");
324 OpenSSL.close bio
325 handle OpenSSL.OpenSSL _ => ();
326 loop ())
327 | OS.SysErr (s, _) =>
328 (print ("System error: " ^ s ^ "\n");
329 OpenSSL.close bio
330 handle OpenSSL.OpenSSL _ => ();
331 loop ())
332 in
333 print "Listening for connections....\n";
334 loop ();
335 OpenSSL.shutdown sock
336 end
337
338fun slave () =
339 let
340 val host = Slave.hostname ()
341
342 val context = OpenSSL.context (Config.certDir ^ "/" ^ host ^ ".pem",
343 Config.keyDir ^ "/" ^ host ^ "/key.pem",
344 Config.trustStore)
345
346 val sock = OpenSSL.listen (context, Config.slavePort)
347
348 fun loop () =
349 case OpenSSL.accept sock of
350 NONE => ()
351 | SOME bio =>
352 let
353 val peer = OpenSSL.peerCN bio
354 val () = print ("\nConnection from " ^ peer ^ "\n")
355 in
356 if peer <> Config.dispatcherName then
357 (print "Not authorized!\n";
358 OpenSSL.close bio;
359 loop ())
360 else let
361 fun loop' files =
362 case Msg.recv bio of
363 NONE => print "Dispatcher closed connection unexpectedly\n"
364 | SOME m =>
365 case m of
366 MsgFile file => loop' (file :: files)
367 | MsgDoFiles => (Slave.handleChanges files;
368 Msg.send (bio, MsgOk))
369 | _ => (print "Dispatcher sent unexpected command\n";
370 Msg.send (bio, MsgError "Unexpected command"))
371 in
372 loop' [];
373 ignore (OpenSSL.readChar bio);
374 OpenSSL.close bio;
375 loop ()
376 end
377 end handle OpenSSL.OpenSSL s =>
378 (print ("OpenSSL error: "^ s ^ "\n");
379 OpenSSL.close bio
380 handle OpenSSL.OpenSSL _ => ();
381 loop ())
382 | OS.SysErr (s, _) =>
383 (print ("System error: "^ s ^ "\n");
384 OpenSSL.close bio
385 handle OpenSSL.OpenSSL _ => ();
386 loop ())
387 in
388 loop ();
389 OpenSSL.shutdown sock
390 end
391
392fun autodocBasis outdir =
393 let
394 val dir = Posix.FileSys.opendir Config.libRoot
395
396 fun loop files =
397 case Posix.FileSys.readdir dir of
398 NONE => (Posix.FileSys.closedir dir;
399 files)
400 | SOME fname =>
401 if String.isSuffix ".dtl" fname then
402 loop (OS.Path.joinDirFile {dir = Config.libRoot,
403 file = fname}
404 :: files)
405 else
406 loop files
407
408 val files = loop []
409 in
410 Autodoc.autodoc {outdir = outdir, infiles = files}
411 end
412
413end