ACL-Regex

 view release on metacpan or  search on metacpan

MANIFEST  view on Meta::CPAN

lib/ACL/Regex.pm
Makefile.PL
MANIFEST
MANIFEST.SKIP
README
t/001.t
t/acl.permit.txt
t/acl.reject.txt
t/action.txt
t/actions.txt
t/required.txt
t/test_acl.pl
META.yml                                 Module meta-data (added by MakeMaker)

examples/postifx-policy-server.pl  view on Meta::CPAN

		push( @a, $str );
	}

	return( join( " ", @a ) );
}

sub process_client($){
	my ($socket) = @_;

	# Create some stuff
	my $accept_acl = ACL->new->generate_required( 'required.txt' )->parse_acl_from_file( { Filename => "acl.permit.txt" } );
	my $reject_acl = ACL->new->generate_required( 'required.txt' )->parse_acl_from_file( { Filename => "acl.reject.txt" } );

	ACCEPT: while( my $client = $socket->accept() ){
		my $hash_ref = {};
		parse_postfix_input( $client, $hash_ref );

		my $action = convert_hashref_to_acl( $hash_ref );

		print "Action: " . Dumper($action) . "\n";

		my ($rc,$regex,$comment) = $reject_acl->match( $action );

lib/ACL/Regex.pm  view on Meta::CPAN

require Exporter;

@EXPORT = qw( new parse_acl_from_file match );
$VERSION = '0.0002';

sub new {
my $type = shift;
	bless {}, $type;
}

# This variable stores all of the required fields
# for the ACL.  If a required field is not in a
# given ACL or action, then it is autogenerated
# with the defaults (enabled).
my @required = qw(
	account
	action
	ip
	group
	dow
	time
);

sub generate_required( $$ ){

	my ( $acl, $required_file ) = @_;

	open FD, "<$required_file" or die("Cannot open $required_file: $!\n" );
	while( <FD> ){
		next if /^#/;
		if( /(\S+?)=(\S+)/ ){
			my @a = split( /,/, $2 );	
			$acl->{req}->{$1} = \@a;
		}
	}
	return ($acl);
}

sub sanitize_acl ($$) {
	my ( $self, $acl ) = @_;

	# Split up the ACL
	my %hash = $acl =~ /(\S+?)=\[([^\[^\]].+?)\]/g;

	my @acl_array;
	my @local_required = sort( keys %hash );

	my $action = $hash{action};

	return -1,'ERR','Action not defined' 
		unless defined $hash{action};

	#return 0,'WARN','Action not defined in required fields'
	#	unless defined $self->{req}->{$action};
	if( defined $self->{req}->{$action} ){
		#print "Using pre-defined requirements for $action from file\n";
		@local_required = @{$self->{req}->{$action}};
	}

	# Regenerate the hash
	for my $key ( sort ( @local_required ) ) {
        	unless ( defined $hash{$key} ) {
			# Uh-oh, it wasn't specified
			my $acl_element = "$key=\\\[(.*?)\\\]";
			push ( @acl_array, $acl_element );
		} else {
			my $acl_element = "$key=\\\[$hash{$key}\\\]";
			push ( @acl_array, $acl_element );
		}
	} ## end for my $key ( sort ( @required...
	return 0,'OK',join ( " ", @acl_array );
} ## end sub sanitize_acl ($)

sub sanitize_action ($$) {
	my ( $self, $acl ) = @_;

	# Split up the ACL
	my %hash = $acl =~ /(\S+?)=\[([^\[^\]].+?)\]/g;

	my @acl_array;
	my @local_required = sort( keys %hash );
	
	my $action = $hash{action};
	return -1,'ERR',"Action [$action] not defined"
		unless defined $hash{action};

	#return 0,'WARN','Action not defined in required fields'
	#	unless defined $self->{req}->{$action};
	if( defined $self->{req}->{$action} ){
			@local_required = @{$self->{req}->{$action}};
	}

	my $action = $hash{action};

	# Regenerate the hash
	for my $key ( sort ( @local_required ) ) {
		unless ( defined $hash{$key} ) {
			# Uh-oh, it wasn't specified
			my $acl_element = "$key=\[]";
			push ( @acl_array, $acl_element );
		} else {
			my $acl_element = "$key=\[$hash{$key}\]";
			push ( @acl_array, $acl_element );
		}
	} ## end for my $key ( sort ( @required...
	return 0,'OK',join ( " ", @acl_array );
} ## end sub sanitize_action ($)

sub parse_acl_from_file( $$ ) {
	my ( $self, $hash ) = @_;

	die ( "Please give a filename as an option!\n" )
		unless defined $hash->{Filename};

	open FD, "<$hash->{Filename}"

lib/ACL/Regex.pm  view on Meta::CPAN

=head1 NAME

ACL::Regex - Process arbitrary events with regular expressions.

=head1 SYNOPSIS

   use ACL::Regex;

   # Instantiate a reject object
   my $reject_acl = ACL::Regex->new->
           generate_required( 'required.txt' )->
           parse_acl_from_file( { Filename => "acl.reject.txt" } );

   while( <> ){
           chomp;
           my ($rc,$regex,$comment) = $reject_acl->match( $_ );
           if( $rc ){
                  print "\t! Rejected against $regex\n";
                  print "\t: Reason: $comment\n";
                  next;
           }

lib/ACL/Regex.pm  view on Meta::CPAN

=head2 OBJECT ORIENTED INTERFACE

The module is written with an object oriented interface.  There is no function
interface to choose from.  To streamline many of the initial operations of the
object, many of the initialization methods return the object reference, allowing
the programmer to chain the commands together.

=over 4

=item B<generate_required>

This method pulls in a I<:file> containing a series of required keys.

=item B<sanitize_acl>

This method re-sorts the keys in alphabetical order.

=item B<sanitize_action>

This method accomplishes the same thing as B<:sanitize_acl>
but for actions.

lib/ACL/Regex.pm  view on Meta::CPAN

  # Don't allow domain admins to delete mailboxes on weekends or mondays
  /action=[mac-delete-mailbox] account=[.*@domain.net.adm] group=[domain-admin] dow=[sat|sun|mon]/        Domain admins can only delete mailboxes during the week
  # Reject mail from brazil
  /account=[.*@example.net] ip=[200..*] group=[user] action=[send-mail]/  No mail to be sent from Brazil!

The two tab deliminated columns separate the regex acl and the comment returned if any
match is found.

=head3 REQUIRED FILE

The required file is supplied to the object during instantiation and will seed
the object with a list of I<required> keys in the hash.  This way, if a key regex
isn't present in the B<ACL REGEX FILE> then the object will fill the hash with
a regex that I<matches all> possibilities.  This is designed to satisfy the regex
string should a key be absent from the action line.

  # This file contains a list of actions, and required attributes
  send-mail=account,ip,group,dow,time
  rwi_login=account,ip,auth_method,dow,time
  create_user=account,ip

=head3 ACTION FILE

A line of B<key>=[B<val>] pairs to be consumed by the ACL object.  These get
massaged so that any action key that doesn't satisfy the B<REQUIRED> fields are
added and the entire string is sorted by key name.

t/required.txt  view on Meta::CPAN

# This file contains a list of actions, and required attributes
send-mail=account,ip,group,dow,time
rwi_login=account,ip,auth_method,dow,time
create_user=account,ip

t/test_acl.pl  view on Meta::CPAN

#!/usr/bin/perl
#use warnings;
use strict;
use lib( "../lib" );
use ACL::Regex;
use Data::Dumper;

my $accept_acl = ACL::Regex->new->
	generate_required( 'required.txt' )->
	parse_acl_from_file( { Filename => "acl.permit.txt" } );

my $reject_acl = ACL::Regex->new->
	generate_required( 'required.txt' )->
	parse_acl_from_file( { Filename => "acl.reject.txt" } );

my @actions;

# Read an action
while( <> ){
	chomp;
	push( @actions, $_ );
}