Check if the command is ready to be executed in the client 'c', already * referenced by c->cmd, and can be executed by this client according to the * ACLs associated to the client user c->user. * * If the user can execute the command ACL_OK is returned, otherwise * ACL_DENIED_CMD or ACL_DENIED_KEY is returned: the first in case the * command cannot be executed because the user is not allowed
| 1177 | * command, the second if the command is denied because the user is trying |
| 1178 | * to access keys that are not among the specified patterns. */ |
| 1179 | int ACLCheckCommandPerm(client *c, int *keyidxptr) { |
| 1180 | user *u = c->user; |
| 1181 | uint64_t id = c->cmd->id; |
| 1182 | |
| 1183 | /* If there is no associated user, the connection can run anything. */ |
| 1184 | if (u == NULL) return ACL_OK; |
| 1185 | |
| 1186 | /* Check if the user can execute this command or if the command |
| 1187 | * doesn't need to be authenticated (hello, auth). */ |
| 1188 | if (!(u->flags & USER_FLAG_ALLCOMMANDS) && !(c->cmd->flags & CMD_NO_AUTH)) |
| 1189 | { |
| 1190 | /* If the bit is not set we have to check further, in case the |
| 1191 | * command is allowed just with that specific subcommand. */ |
| 1192 | if (ACLGetUserCommandBit(u,id) == 0) { |
| 1193 | /* Check if the subcommand matches. */ |
| 1194 | if (c->argc < 2 || |
| 1195 | u->allowed_subcommands == NULL || |
| 1196 | u->allowed_subcommands[id] == NULL) |
| 1197 | { |
| 1198 | return ACL_DENIED_CMD; |
| 1199 | } |
| 1200 | |
| 1201 | long subid = 0; |
| 1202 | while (1) { |
| 1203 | if (u->allowed_subcommands[id][subid] == NULL) |
| 1204 | return ACL_DENIED_CMD; |
| 1205 | if (!strcasecmp(c->argv[1]->ptr, |
| 1206 | u->allowed_subcommands[id][subid])) |
| 1207 | break; /* Subcommand match found. Stop here. */ |
| 1208 | subid++; |
| 1209 | } |
| 1210 | } |
| 1211 | } |
| 1212 | |
| 1213 | /* Check if the user can execute commands explicitly touching the keys |
| 1214 | * mentioned in the command arguments. */ |
| 1215 | if (!(c->user->flags & USER_FLAG_ALLKEYS) && |
| 1216 | (c->cmd->getkeys_proc || c->cmd->firstkey)) |
| 1217 | { |
| 1218 | getKeysResult result = GETKEYS_RESULT_INIT; |
| 1219 | int numkeys = getKeysFromCommand(c->cmd,c->argv,c->argc,&result); |
| 1220 | int *keyidx = result.keys; |
| 1221 | for (int j = 0; j < numkeys; j++) { |
| 1222 | listIter li; |
| 1223 | listNode *ln; |
| 1224 | listRewind(u->patterns,&li); |
| 1225 | |
| 1226 | /* Test this key against every pattern. */ |
| 1227 | int match = 0; |
| 1228 | while((ln = listNext(&li))) { |
| 1229 | sds pattern = listNodeValue(ln); |
| 1230 | size_t plen = sdslen(pattern); |
| 1231 | int idx = keyidx[j]; |
| 1232 | if (stringmatchlen(pattern,plen,c->argv[idx]->ptr, |
| 1233 | sdslen(c->argv[idx]->ptr),0)) |
| 1234 | { |
| 1235 | match = 1; |
| 1236 | break; |
no test coverage detected