| 459 | } |
| 460 | |
| 461 | bool MonCap::is_capable( |
| 462 | CephContext *cct, |
| 463 | EntityName name, |
| 464 | const string& service, |
| 465 | const string& command, const map<string,string>& command_args, |
| 466 | bool op_may_read, bool op_may_write, bool op_may_exec, |
| 467 | const entity_addr_t& addr) const |
| 468 | { |
| 469 | if (cct) |
| 470 | ldout(cct, 20) << "is_capable service=" << service << " command=" << command |
| 471 | << (op_may_read ? " read":"") |
| 472 | << (op_may_write ? " write":"") |
| 473 | << (op_may_exec ? " exec":"") |
| 474 | << " addr " << addr |
| 475 | << " on cap " << *this |
| 476 | << dendl; |
| 477 | |
| 478 | mon_rwxa_t allow = 0; |
| 479 | for (vector<MonCapGrant>::const_iterator p = grants.begin(); |
| 480 | p != grants.end(); ++p) { |
| 481 | if (cct) |
| 482 | ldout(cct, 20) << " allow so far " << allow << ", doing grant " << *p |
| 483 | << dendl; |
| 484 | |
| 485 | if (p->network.size() && |
| 486 | (!p->network_valid || |
| 487 | !network_contains(p->network_parsed, |
| 488 | p->network_prefix, |
| 489 | addr))) { |
| 490 | continue; |
| 491 | } |
| 492 | |
| 493 | if (p->is_allow_all()) { |
| 494 | if (cct) |
| 495 | ldout(cct, 20) << " allow all" << dendl; |
| 496 | return true; |
| 497 | } |
| 498 | |
| 499 | // check enumerated caps |
| 500 | allow = allow | p->get_allowed(cct, name, service, command, command_args); |
| 501 | if ((!op_may_read || (allow & MON_CAP_R)) && |
| 502 | (!op_may_write || (allow & MON_CAP_W)) && |
| 503 | (!op_may_exec || (allow & MON_CAP_X))) { |
| 504 | if (cct) |
| 505 | ldout(cct, 20) << " match" << dendl; |
| 506 | return true; |
| 507 | } |
| 508 | } |
| 509 | return false; |
| 510 | } |
| 511 | |
| 512 | void MonCap::encode(bufferlist& bl) const |
| 513 | { |
no test coverage detected