Skip to content
Snippets Groups Projects
Commit bb86214d authored by Claudio Scafuri's avatar Claudio Scafuri :speech_balloon:
Browse files

cleaner handling of host privileges

parent aa6c424d
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
src/TwinApuId.cpp
+ 45
− 74
View file @ bb86214d
...@@ -690,18 +690,12 @@ void TwinApuId::write_UserPositionLow(Tango::WAttribute &attr) ...@@ -690,18 +690,12 @@ void TwinApuId::write_UserPositionLow(Tango::WAttribute &attr)
/*----- PROTECTED REGION ID(TwinApuId::write_UserPositionLow) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::write_UserPositionLow) ENABLED START -----*/
//check privileges //check privileges
int priv=caller_privileges(); int priv = check_privileges(AUTHORIZED, "UserPositionLow");
if (priv < AUTHORIZED){
INFO_STREAM << "UserPositionLow from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << " UserPositionLow from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::UserPositionLow()");
}
//check enabled for remote useres //check enabled for remote useres
if(priv == AUTHORIZED && *attr_Enabled_read == false){ if(priv == AUTHORIZED && *attr_Enabled_read == false){
INFO_STREAM << "UserPositionLow from "<< clientAddress <<" NOT ENABLED"<<endl; INFO_STREAM << "UserPositionLow from "<< clientAddress <<" NOT ENABLED"<<endl;
TangoSys_OMemStream o; TangoSys_OMemStream o;
o << " UserPositionLow from "<< clientAddress <<" NOT ENBLED"<<ends; o << " UserPositionLow from "<< clientAddress <<" NOT ENABLED"<<ends;
Tango::Except::throw_exception((const char *)"not enabled",o.str(),(const char *)"TwinApuId::UserPositionLow()"); Tango::Except::throw_exception((const char *)"not enabled",o.str(),(const char *)"TwinApuId::UserPositionLow()");
} }
...@@ -771,13 +765,7 @@ void TwinApuId::write_UserPositionHigh(Tango::WAttribute &attr) ...@@ -771,13 +765,7 @@ void TwinApuId::write_UserPositionHigh(Tango::WAttribute &attr)
attr.get_write_value(w_val); attr.get_write_value(w_val);
/*----- PROTECTED REGION ID(TwinApuId::write_UserPositionHigh) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::write_UserPositionHigh) ENABLED START -----*/
//check privileges //check privileges
int priv=caller_privileges(); int priv = check_privileges(AUTHORIZED, "UserPositionHigh");
if (priv < AUTHORIZED){
INFO_STREAM << "UserPositionHigh from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << " UserPositionHig from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::UserPositionHig()");
}
//check enabled for remote useres //check enabled for remote useres
if(priv == AUTHORIZED && *attr_Enabled_read == false){ if(priv == AUTHORIZED && *attr_Enabled_read == false){
INFO_STREAM << "UserPositionHig from "<< clientAddress <<" NOT ENABLED"<<endl; INFO_STREAM << "UserPositionHig from "<< clientAddress <<" NOT ENABLED"<<endl;
...@@ -1041,14 +1029,8 @@ void TwinApuId::high_energy() ...@@ -1041,14 +1029,8 @@ void TwinApuId::high_energy()
{ {
DEBUG_STREAM << "TwinApuId::HighEnergy() - " << device_name << endl; DEBUG_STREAM << "TwinApuId::HighEnergy() - " << device_name << endl;
/*----- PROTECTED REGION ID(TwinApuId::high_energy) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::high_energy) ENABLED START -----*/
int priv=caller_privileges();
if (priv < PRIVILEGED){
INFO_STREAM << "high_energy from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << " high_energy from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::high_energy()");
}
// Add your own code // Add your own code
check_privileges(PRIVILEGED,"high_energy");
if(*attr_HighEnergy_read) return; if(*attr_HighEnergy_read) return;
switchenergy = new switchenergythread(this,true); switchenergy = new switchenergythread(this,true);
switchenergy->start(); switchenergy->start();
...@@ -1065,14 +1047,9 @@ void TwinApuId::low_energy() ...@@ -1065,14 +1047,9 @@ void TwinApuId::low_energy()
{ {
DEBUG_STREAM << "TwinApuId::LowEnergy() - " << device_name << endl; DEBUG_STREAM << "TwinApuId::LowEnergy() - " << device_name << endl;
/*----- PROTECTED REGION ID(TwinApuId::low_energy) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::low_energy) ENABLED START -----*/
int priv=caller_privileges();
if (priv < PRIVILEGED){
INFO_STREAM << "low_energy from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << " low_energy from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::low_energy()");
}
// Add your own code // Add your own code
check_privileges(PRIVILEGED,"low_energy");
if(*attr_LowEnergy_read) return; if(*attr_LowEnergy_read) return;
switchenergy = new switchenergythread(this,false); switchenergy = new switchenergythread(this,false);
switchenergy->start(); switchenergy->start();
...@@ -1091,14 +1068,7 @@ void TwinApuId::injection_position() ...@@ -1091,14 +1068,7 @@ void TwinApuId::injection_position()
/*----- PROTECTED REGION ID(TwinApuId::injection_position) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::injection_position) ENABLED START -----*/
// Add your own code // Add your own code
int priv=caller_privileges(); check_privileges(PRIVILEGED, "InjectionPosition");
if (priv < PRIVILEGED){
INFO_STREAM << "InjectionPosition from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << " InjectionPosition from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::InjectionPosition()");
}
try { try {
double inj_pos_high = highEnergyPeriod/2.0; double inj_pos_high = highEnergyPeriod/2.0;
double inj_pos_low = lowEnergyPeriod/2.0; double inj_pos_low = lowEnergyPeriod/2.0;
...@@ -1134,14 +1104,7 @@ void TwinApuId::axis_init_low_energy() ...@@ -1134,14 +1104,7 @@ void TwinApuId::axis_init_low_energy()
/*----- PROTECTED REGION ID(TwinApuId::axis_init_low_energy) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::axis_init_low_energy) ENABLED START -----*/
// Add your own code // Add your own code
int priv=caller_privileges(); check_privileges(PRIVILEGED, "AxisIniLowEnergy");
if (priv < PRIVILEGED){
INFO_STREAM << "AxisInitLowEnergy from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << "AxisInitLowEnergy from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::AxisInit()");
}
// Add your own code
try { try {
low_energy_device->command_inout("AxisInit"); low_energy_device->command_inout("AxisInit");
*attr_Ready_read = false; *attr_Ready_read = false;
...@@ -1170,27 +1133,20 @@ void TwinApuId::axis_init_high_energy() ...@@ -1170,27 +1133,20 @@ void TwinApuId::axis_init_high_energy()
/*----- PROTECTED REGION ID(TwinApuId::axis_init_high_energy) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::axis_init_high_energy) ENABLED START -----*/
// Add your own code // Add your own code
int priv=caller_privileges(); check_privileges(PRIVILEGED, "AxisInitHighEnergy");
if (priv < PRIVILEGED){ try {
INFO_STREAM << "AxisInitHighEnergy from "<< clientAddress <<" REJECTED"<<endl; high_energy_device->command_inout("AxisInit");
TangoSys_OMemStream o; *attr_Ready_read = false;
o << "AxisInitHighEnergy from "<< clientAddress <<" REJECTED"<<ends; id_flags[0]=*attr_Ready_read;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::AxisInit()"); set_status("AxisInit");
} } catch (Tango::DevFailed &e) {
// Add your own code Tango::Except::print_exception(e);
try { Tango::Except::re_throw_exception(e,
high_energy_device->command_inout("AxisInit"); (const char*) "Failed to AxisInitHighEnergy motor device",
*attr_Ready_read = false; (const char*) "DevFailed", (const char*) "TwinApuId::axis_init_high_energy",
id_flags[0]=*attr_Ready_read; Tango::ERR);
set_status("AxisInit"); set_status("AxisInit HighEnergy failed");
} catch (Tango::DevFailed &e) { }
Tango::Except::print_exception(e);
Tango::Except::re_throw_exception(e,
(const char*) "Failed to AxisInitHighEnergy motor device",
(const char*) "DevFailed", (const char*) "TwinApuId::axis_init_high_energy",
Tango::ERR);
set_status("AxisInit HighEnergy failed");
}
/*----- PROTECTED REGION END -----*/ // TwinApuId::axis_init_high_energy /*----- PROTECTED REGION END -----*/ // TwinApuId::axis_init_high_energy
} }
//-------------------------------------------------------- //--------------------------------------------------------
...@@ -1204,14 +1160,9 @@ void TwinApuId::axis_init_energy_switch() ...@@ -1204,14 +1160,9 @@ void TwinApuId::axis_init_energy_switch()
{ {
DEBUG_STREAM << "TwinApuId::AxisInitEnergySwitch() - " << device_name << endl; DEBUG_STREAM << "TwinApuId::AxisInitEnergySwitch() - " << device_name << endl;
/*----- PROTECTED REGION ID(TwinApuId::axis_init_energy_switch) ENABLED START -----*/ /*----- PROTECTED REGION ID(TwinApuId::axis_init_energy_switch) ENABLED START -----*/
int priv=caller_privileges();
if (priv < PRIVILEGED){
INFO_STREAM << "AxisInitEnergySwitch from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << "AxisInitEnergySwitch from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),(const char *)"TwinApuId::AxisInitEnergySwitch()");
}
// Add your own code // Add your own code
check_privileges(PRIVILEGED, "AxisInitEnergySwitch");
try { try {
energy_switch_device->command_inout("AxisInit"); energy_switch_device->command_inout("AxisInit");
*attr_Ready_read = false; *attr_Ready_read = false;
...@@ -1261,7 +1212,6 @@ int TwinApuId::caller_privileges(void) ...@@ -1261,7 +1212,6 @@ int TwinApuId::caller_privileges(void)
Tango::DevVarStringArray blackbox = black_box(1)[0]; Tango::DevVarStringArray blackbox = black_box(1)[0];
string last_msg(blackbox[0].in()); string last_msg(blackbox[0].in());
string::size_type loc = last_msg.find( " requested from ", 0 ); string::size_type loc = last_msg.find( " requested from ", 0 );
INFO_STREAM << loc <<endl;
if( loc != string::npos ) if( loc != string::npos )
{ {
clientAddress = last_msg.substr(loc + strlen(" requested from ")); clientAddress = last_msg.substr(loc + strlen(" requested from "));
...@@ -1296,6 +1246,27 @@ int TwinApuId::caller_privileges(void) ...@@ -1296,6 +1246,27 @@ int TwinApuId::caller_privileges(void)
} }
return NORMAL; //do not grant special privilege - but we should NOT arrive at this line return NORMAL; //do not grant special privilege - but we should NOT arrive at this line
} }
//--------------------------------------------------------------------
/**
* check privileges level based on host name from which the call is generated
* formats warning/ error messages and throw exception in case of vilotaions
* privilege levels:
* PRIVILEGED : can change the enable bit and set gap/tapering
* AUTHORIZED : can set gap/tapering when enabled
* NORMAL : can only read;
*/
int TwinApuId::check_privileges(int level, string msg)
{
int priv=caller_privileges();
if (priv < level){
INFO_STREAM << msg << " from "<< clientAddress <<" REJECTED"<<endl;
TangoSys_OMemStream o;
o << msg << " from "<< clientAddress <<" REJECTED"<<ends;
Tango::Except::throw_exception((const char *)"Host not allowed",o.str(),msg);
}
return priv;
}
/*----- PROTECTED REGION END -----*/ // TwinApuId::namespace_ending /*----- PROTECTED REGION END -----*/ // TwinApuId::namespace_ending
} // namespace } // namespace
src/TwinApuId.h
+ 3
− 1
View file @ bb86214d
...@@ -81,9 +81,11 @@ public: ...@@ -81,9 +81,11 @@ public:
protected: protected:
int caller_privileges(void); int caller_privileges(void);
bool is_privileged; //true is tha caller has all privileges - must be handled in alawys_executed bool is_privileged; //true is the caller has all privileges - must be handled in alawys_executed
string clientAddress; string clientAddress;
map<string,int> hostMap; map<string,int> hostMap;
int check_privileges(int, string); //check privileges , emits diagnostics and throw exception, returns actual privileges
/*----- PROTECTED REGION END -----*/ // TwinApuId::Data Members /*----- PROTECTED REGION END -----*/ // TwinApuId::Data Members
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment