xmpp.chapril.org-ejabberd/src/acl.erl

%%%----------------------------------------------------------------------
%%% File    : acl.erl
%%% Author  : Alexey Shchepin <alexey@process-one.net>
%%% Purpose : ACL support
%%% Created : 18 Jan 2003 by Alexey Shchepin <alexey@process-one.net>
%%%
%%%
%%% ejabberd, Copyright (C) 2002-2010   ProcessOne
%%%
%%% This program is free software; you can redistribute it and/or
%%% modify it under the terms of the GNU General Public License as
%%% published by the Free Software Foundation; either version 2 of the
%%% License, or (at your option) any later version.
%%%
%%% This program is distributed in the hope that it will be useful,
%%% but WITHOUT ANY WARRANTY; without even the implied warranty of
%%% MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
%%% General Public License for more details.
%%%
%%% You should have received a copy of the GNU General Public License
%%% along with this program; if not, write to the Free Software
%%% Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
%%% 02111-1307 USA
%%%
%%%----------------------------------------------------------------------

-module(acl).
-author('alexey@process-one.net').

-export([start/0,
	 to_record/3,
	 add/3,
	 add_list/3,
	 match_rule/3,
	 % for debugging only
	 match_acl/3]).

-include("ejabberd.hrl").

%% @type aclspec() = all | JID_Exact | JID_Regexp | JID_Glob | Shared_Group
%%     JID_Exact = {user, U} | {user, U, S} | {server, S} | {resource, R}
%%         U = string()
%%         S = string()
%%         R = string()
%%     JID_Regexp = {user_regexp, UR} | {user_regexp, UR, S} | {server_regexp, SR} | {resource_regexp, RR} | {node_regexp, UR, SR}
%%         UR = string()
%%         SR = string()
%%         RR = string()
%%     JID_Glob = {user_glob, UG} | {user_glob, UG, S} | {server_glob, SG} | {resource_glob, RG} | {node_glob, UG, SG}
%%         UG = string()
%%         SG = string()
%%         RG = string()
%%     Shared_Group = {shared_group, G} | {shared_group, G, H}
%%         G = string()
%%         H = string().

%% @type acl() = {acl, ACLName, ACLSpec}
%%     ACLName = atom()
%%     ACLSpec = aclspec().
%% Record in its Ejabberd-configuration-file variant.

%% @type storedacl() = {acl, {ACLName, Host}, ACLSpec}
%%     ACLName = atom()
%%     Host = global | string()
%%     ACLSpec = aclspec().
%% Record in its Mnesia-table-record variant.

-record(acl, {aclname, aclspec}).

%% @spec () -> ok

start() ->
    mnesia:create_table(acl,
			[{disc_copies, [node()]},
			 {type, bag},
			 {attributes, record_info(fields, acl)}]),
    mnesia:add_table_copy(acl, node(), ram_copies),
    ok.

%% @spec (Host, ACLName, ACLSpec) -> storedacl()
%%     Host = global | string()
%%     ACLName = atom()
%%     ACLSpec = aclspec()

to_record(Host, ACLName, ACLSpec) ->
    #acl{aclname = {ACLName, Host}, aclspec = normalize_spec(ACLSpec)}.

%% @spec (Host, ACLName, ACLSpec) -> {atomic, ok} | {aborted, Reason}
%%     Host = global | string()
%%     ACLName = atom()
%%     ACLSpec = all | none | aclspec()
%%     Reason = term()

add(Host, ACLName, ACLSpec) ->
    F = fun() ->
		mnesia:write(#acl{aclname = {ACLName, Host},
				  aclspec = normalize_spec(ACLSpec)})
	end,
    mnesia:transaction(F).

%% @spec (Host, ACLs, Clear) -> ok | false
%%     Host = global | string()
%%     ACLs = [acl()]
%%     Clear = bool()

add_list(Host, ACLs, Clear) ->
    F = fun() ->
		if
		    Clear ->
			Ks = mnesia:select(
			       acl, [{{acl, {'$1', Host}, '$2'}, [], ['$1']}]),
			lists:foreach(fun(K) ->
					      mnesia:delete({acl, {K, Host}})
				      end, Ks);
		    true ->
			ok
		end,
		lists:foreach(fun(ACL) ->
				      case ACL of
					  #acl{aclname = ACLName,
					       aclspec = ACLSpec} ->
					      mnesia:write(
						#acl{aclname = {ACLName, Host},
						     aclspec = normalize_spec(ACLSpec)})
				      end
			      end, ACLs)
	end,
    case mnesia:transaction(F) of
	{atomic, _} ->
	    ok;
	_ ->
	    false
    end.

%% @spec (String) -> Prepd_String
%%     String = string()
%%     Prepd_String = string()

normalize(String) ->
    exmpp_stringprep:nodeprep(String).

%% @spec (ACLSpec) -> Normalized_ACLSpec
%%     ACLSpec = all | none | aclspec()
%%     Normalized_ACLSpec = aclspec()

normalize_spec({A, B}) ->
    {A, normalize(B)};
normalize_spec({A, B, C}) ->
    {A, normalize(B), normalize(C)};
normalize_spec(all) ->
    all;
normalize_spec(none) ->
    none.



%% @spec (Host, Rule, JID) -> Access
%%     Host = global | string()
%%     Rule = all | none | atom()
%%     JID = exmpp_jid:jid()
%%     Access = allow | deny | atom()

match_rule(global, Rule, JID) ->
    case Rule of
	all -> allow;
	none -> deny;
	_ ->
	    case ejabberd_config:get_global_option({access, Rule, global}) of
		undefined ->
		    deny;
		GACLs ->
		    match_acls(GACLs, JID, global)
	    end
    end;

match_rule(Host, Rule, JID) ->
    case Rule of
	all -> allow;
	none -> deny;
	_ ->
	    case ejabberd_config:get_global_option({access, Rule, global}) of
		undefined ->
		    case ejabberd_config:get_global_option({access, Rule, Host}) of
			undefined ->
			    deny;
			ACLs ->
			    match_acls(ACLs, JID, Host)
		    end;
		GACLs ->
		    case ejabberd_config:get_global_option({access, Rule, Host}) of
			undefined ->
			    match_acls(GACLs, JID, Host);
			ACLs ->
			    case lists:reverse(GACLs) of
				[{allow, all} | Rest] ->
				    match_acls(
				      lists:reverse(Rest) ++ ACLs ++
				      [{allow, all}],
				      JID, Host);
				_ ->
				    match_acls(GACLs ++ ACLs, JID, Host)
			    end
		    end
	    end
    end.

%% @spec (ACLs, JID, Host) -> Access
%%     ACLs = [{Access, ACLName}]
%%         Access = deny | atom()
%%         ACLName = atom()
%%     JID = exmpp_jid:jid()
%%     Host = string()

match_acls([], _, _Host) ->
    deny;
match_acls([{Access, ACLName} | ACLs], JID, Host) ->
    case match_acl(ACLName, JID, Host) of
	true ->
	    Access;
	_ ->
	    match_acls(ACLs, JID, Host)
    end.

%% @spec (ACLName, JID, Host) -> bool()
%%     ACLName = all | none | atom()
%%     JID = exmpp_jid:jid()
%%     Host = string()

match_acl(ACLName, JID, Host) ->
    case ACLName of
	all -> true;
	none -> false;
	_ ->
	    User = exmpp_jid:prep_node_as_list(JID),
	    Server = exmpp_jid:prep_domain_as_list(JID),
	    Resource = exmpp_jid:prep_resource_as_list(JID),
	    lists:any(fun(#acl{aclspec = Spec}) ->
			      case Spec of
				  all ->
				      true;
				  {user, U} ->
				      (U == User)
					  andalso
					    ((Host == Server) orelse
					     ((Host == global) andalso
					      lists:member(Server, ?MYHOSTS)));
				  {user, U, S} ->
				      (U == User) andalso (S == Server);
				  {server, S} ->
				      S == Server;
				  {resource, R} ->
				      R == Resource;
				  {user_regexp, UR} ->
				      ((Host == Server) orelse
				       ((Host == global) andalso
					lists:member(Server, ?MYHOSTS)))
					  andalso is_regexp_match(User, UR);
				  {shared_group, G} ->
				      mod_shared_roster:is_user_in_group({User, Server}, G, Host);
				  {shared_group, G, H} ->
				      mod_shared_roster:is_user_in_group({User, Server}, G, H);
				  {user_regexp, UR, S} ->
				      (S == Server) andalso
					  is_regexp_match(User, UR);
				  {server_regexp, SR} ->
				      is_regexp_match(Server, SR);
				  {resource_regexp, RR} ->
				      is_regexp_match(Resource, RR);
				  {node_regexp, UR, SR} ->
				      is_regexp_match(Server, SR) andalso
					  is_regexp_match(User, UR);
				  {user_glob, UR} ->
				      ((Host == Server) orelse
				       ((Host == global) andalso
					lists:member(Server, ?MYHOSTS)))
					  andalso
					  is_glob_match(User, UR);
				  {user_glob, UR, S} ->
				      (S == Server) andalso
					  is_glob_match(User, UR);
				  {server_glob, SR} ->
				      is_glob_match(Server, SR);
				  {resource_glob, RR} ->
				      is_glob_match(Resource, RR);
				  {node_glob, UR, SR} ->
				      is_glob_match(Server, SR) andalso
					  is_glob_match(User, UR);
				  WrongSpec ->
				      ?ERROR_MSG(
					 "Wrong ACL expression: ~p~n"
					 "Check your config file and reload it with the override_acls option enabled",
					 [WrongSpec]),
				      false
			      end
		      end,
		      ets:lookup(acl, {ACLName, global}) ++
		      ets:lookup(acl, {ACLName, Host}))
    end.

%% @spec (String, RegExp) -> bool()
%%     String = string() | undefined
%%     RegExp = string()

is_regexp_match(undefined, _RegExp) ->
    false;
is_regexp_match(String, RegExp) ->
    try re:run(String, RegExp, [{capture, none}]) of
	nomatch ->
	    false;
	match ->
	    true
    catch
	_:ErrDesc ->
	    ?ERROR_MSG(
	       "Wrong regexp ~p in ACL:~n~p",
	       [RegExp, ErrDesc]),
	    false
    end.

%% @spec (String, Glob) -> bool()
%%     String = string() | undefined
%%     Glob = string()

is_glob_match(String, Glob) ->
    is_regexp_match(String, xmerl_regexp:sh_to_awk(Glob)).