ZooKeeper使用ACLs控制訪問

ZooKeeper使用ACL來控制訪問znodes(Zookeeper資料樹上的資料節點). ACL的實現與UNIX的檔案訪問許可權十分相似: 它使用許可權bit來允許/拒絕一個節點和位元許可範圍的各種操作. 不同於傳統的UNITX許可權系統，一個Zookeeper節點沒有三個傳統作用域的限制：user（檔案所屬使用者）、group，和world(其他). ZooKeeper沒有節點所有者的概念. 而是ACL指定集合，與該許可權相關的ID集合.

也要注意ACL僅適用於一個特定的znode. 它不適用於其子節點.例如，如果/appp僅僅被ip為172.16.16.1的讀取，/app/status是有開放全部讀取許可權的，任何人都可以讀取/app/status；ACLs不是遞迴的.

Zookeeer支援可插拔式的外掛認證方案. Ids指定使用這個形式scheme:id，shceme是ID對應的認證方案. 例如， ip:172.16.16.1是一個主機地址為172.16.16.1的ID.

當客戶端連線Zookeeper並進行認證，Zookeeper將與符合這個客戶端的所有ids關聯起來. 當客戶端試圖訪問一個節點時，這些ids會檢查znodes節點的ALC.  ACLs是由成對組成的(scheme:expression，perms). ACLs are made up of pairs of (scheme:expression, perms). 表示式的格式指定了許可權. 例如，這個鍵值對給所有19.22開頭的客戶端體哦概念股了讀取許可權.

ACL許可權

ZooKeeper支援如下許可權:

• CREATE: 你可以建立一個子節點.

• READ: 你可以讀取節點的資料和獲得子節點列表.

• WRITE: 你可以設定節點的資料

• DELETE: 你可以刪除一個子節點

• ADMIN: 你可以設定許可權

CREATE和DELETE許可權從WRITE許可權中分離開來，為了更好的訪問控制. CREATE 和DELETE的情況如下:

你想要A有許可權設定節點資料，而不能CREATE 或 DELETE子節點.

CREATE而無DELETE: 客戶端在父目錄發起建立Zookeeper節點的請求.你想要所有客戶端都能夠新增，但是隻有發起該請求的能夠刪除.(這個情況類似與追加檔案許可權)

而且，ADMIN許可權存在是因為Zookeeper沒有檔案所有者的概念. 某種意義上，ADMIN許可權就相當於檔案所有者. ZooKeeper不支援LOOKUP許可權(目錄上執行許可權位允許你檢視，即使你不能列出目錄). 所有人都隱含LOOKUP許可權. 允許你檢視節點狀態，但是不能進行其他操作.(有些問題，在一個不存在的節點上執行呼叫zoo_exists()，沒有許可權進行安全檢查.)

內建的ACL方案

ZooKeeeper有如下內建構建：

• world 有一個獨立ID, 代表任意一個人.

• auth 不使用任何ID，代表任何許可權使用者.

• digest 使用使用者名稱：密碼字串生成一個MD5，當作時ACL ID. 認證時通過傳送使用者名稱:密碼的明文來進行的. 當使用ACL時，表示式將會使用使用者名稱:base64，base64時SHA1密碼加密.

• ip 使用客戶端IP作為一個ACL ID身份. 這個ACL表示式的格式為addr/bits ，此時addr中的有效位與客戶端addr中的有效位進行比對.

ZooKeeper C client API

The following constants are provided by the ZooKeeper C library:

• const int ZOO_PERM_READ; //can read node’s value and list its children

• const int ZOO_PERM_WRITE;// can set the node’s value

• const int ZOO_PERM_CREATE; //can create children

• const int ZOO_PERM_DELETE;// can delete children

• const int ZOO_PERM_ADMIN; //can execute set_acl()

• const int ZOO_PERM_ALL;// all of the above flags OR’d together

The following are the standard ACL IDs:

• struct Id ZOO_ANYONE_ID_UNSAFE; //(‘world’,’anyone’)

• struct Id ZOO_AUTH_IDS;// (‘auth’,’’)

ZOO_AUTH_IDS empty identity string should be interpreted as “the identity of the creator”.

ZooKeeper client comes with three standard ACLs:

• struct ACL_vector ZOO_OPEN_ACL_UNSAFE; //(ZOO_PERM_ALL,ZOO_ANYONE_ID_UNSAFE)

• struct ACL_vector ZOO_READ_ACL_UNSAFE;// (ZOO_PERM_READ, ZOO_ANYONE_ID_UNSAFE)

• struct ACL_vector ZOO_CREATOR_ALL_ACL; //(ZOO_PERM_ALL,ZOO_AUTH_IDS)

The ZOO_OPEN_ACL_UNSAFE is completely open free for all ACL: any application can execute any operation on the node and can create, list and delete its children. The ZOO_READ_ACL_UNSAFE is read-only access for any application. CREATE_ALL_ACL grants all permissions to the creator of the node. The creator must have been authenticated by the server (for example, using “digest” scheme) before it can create nodes with this ACL.

The following ZooKeeper operations deal with ACLs:

• int zoo_add_auth (zhandle_t *zh,const char* scheme,const char* cert, int certLen, void_completion_t completion, const void *data);

The application uses the zoo_add_auth function to authenticate itself to the server. The function can be called multiple times if the application wants to authenticate using different schemes and/or identities.

• int zoo_create (zhandle_t *zh, const char *path, const char *value,int valuelen, const struct ACL_vector *acl, int flags,char *realpath, int max_realpath_len);

zoo_create(...) operation creates a new node. The acl parameter is a list of ACLs associated with the node. The parent node must have the CREATE permission bit set.

• int zoo_get_acl (zhandle_t *zh, const char *path,struct ACL_vector *acl, struct Stat *stat);

This operation returns a node’s ACL info.

• int zoo_set_acl (zhandle_t *zh, const char *path, int version,const struct ACL_vector *acl);

This function replaces node’s ACL list with a new one. The node must have the ADMIN permission set.

Here is a sample code that makes use of the above APIs to authenticate itself using the “foo” scheme and create an ephemeral node “/xyz” with create-only permissions.

This is a very simple example which is intended to show how to interact with ZooKeeper ACLs specifically. See .../trunk/src/c/src/cli.c for an example of a C client implementation

#include <string.h>
#include <errno.h>

#include "zookeeper.h"

static zhandle_t *zh;

/**
 * In this example this method gets the cert for your
 *   environment -- you must provide
 */
char *foo_get_cert_once(char* id) { return 0; }

/** Watcher function -- empty for this example, not something you should
 * do in real code */
void watcher(zhandle_t *zzh, int type, int state, const char *path,
             void *watcherCtx) {}

int main(int argc, char argv) {
  char buffer[512];
  char p[2048];
  char *cert=0;
  char appId[64];

  strcpy(appId, "example.foo_test");
  cert = foo_get_cert_once(appId);
  if(cert!=0) {
    fprintf(stderr,
            "Certificate for appid [%s] is [%s]\n",appId,cert);
    strncpy(p,cert, sizeof(p)-1);
    free(cert);
  } else {
    fprintf(stderr, "Certificate for appid [%s] not found\n",appId);
    strcpy(p, "dummy");
  }

  zoo_set_debug_level(ZOO_LOG_LEVEL_DEBUG);

  zh = zookeeper_init("localhost:3181", watcher, 10000, 0, 0, 0);
  if (!zh) {
    return errno;
  }
  if(zoo_add_auth(zh,"foo",p,strlen(p),0,0)!=ZOK)
    return 2;

  struct ACL CREATE_ONLY_ACL[] = {{ZOO_PERM_CREATE, ZOO_AUTH_IDS}};
  struct ACL_vector CREATE_ONLY = {1, CREATE_ONLY_ACL};
  int rc = zoo_create(zh,"/xyz","value", 5, &CREATE_ONLY, ZOO_EPHEMERAL,
                      buffer, sizeof(buffer)-1);

  /** this operation will fail with a ZNOAUTH error */
  int buflen= sizeof(buffer);
  struct Stat stat;
  rc = zoo_get(zh, "/xyz", 0, buffer, &buflen, &stat);
  if (rc) {
    fprintf(stderr, "Error %d for %s\n", rc, __LINE__);
  }

  zookeeper_close(zh);
  return 0;
}