Enable Node ACL based on ECF_PERMISSIONS ECFLOW-1960

CMakeLists.txt

@@ -79,6 +79,21 @@ option( ENABLE_UDP                 "Enable UDP server"
 option( ENABLE_DOCS                "Enable Documentation"                                OFF )
 option( ENABLE_DEBIAN_PACKAGE      "Enable Debian Package"                               OFF )
 
+#
+# On macOS, Boost.ASIO, by default, uses kqueue -- which is correctly intercepted by proxychains.
+#
+# On Linux, Boost.ASIO, by default, uses the epoll reactor.
+# This means that the TCP/IP client, driven by Boost's async_* calls, uses the epoll_* API.
+# Since proxychains only intercepts the select/connect API, the epoll_* calls are simply ignored.
+#
+# The option below allows to force the use of the Boost.Asio 'select' fallback reactor,
+# and thus allows the use with proxychains.
+#
+# This is useful to enable running ecflow_client/ecFlowUI in a Linux container, while using
+# proxychains to reach a SOCKS proxy and contact a remote host via an 'ssh -N -D' tunnel.
+#
+option( ENABLE_ASIO_SELECT_REACTOR "Use the Boost.Asio 'select' fallback reactor"        OFF )
+
 # =========================================================================================
 # Sanity check options
 # =========================================================================================
@@ -134,6 +149,11 @@ if(ENABLE_UDP AND NOT ENABLE_SERVER)
   set(ENABLE_UDP OFF)
 endif()
 
+# Only in Linux do we support the Boost.Asio 'select' fallback reactor
+if( ENABLE_ASIO_SELECT_REACTOR AND NOT CMAKE_SYSTEM_NAME STREQUAL "Linux" )
+  ecbuild_critical( "ENABLE_ASIO_SELECT_REACTOR is only supported on Linux" )
+endif()
+
 ecbuild_info( "ENABLE_SERVER              : ${ENABLE_SERVER}" )
 ecbuild_info( "ENABLE_PYTHON              : ${ENABLE_PYTHON}" )
 ecbuild_info( "ENABLE_PYTHON_PTR_REGISTER : ${ENABLE_PYTHON_PTR_REGISTER}" )
@@ -145,6 +165,7 @@ ecbuild_info( "ENABLE_SSL                 : ${ENABLE_SSL} *if* openssl libraries
 ecbuild_info( "ENABLE_HTTP                : ${ENABLE_HTTP}" )
 ecbuild_info( "ENABLE_HTTP_COMPRESSION    : ${ENABLE_HTTP_COMPRESSION}" )
 ecbuild_info( "ENABLE_UDP                 : ${ENABLE_UDP}" )
+ecbuild_info( "ENABLE_ASIO_SELECT_REACTOR : ${ENABLE_ASIO_SELECT_REACTOR}" )
 
 
 if (ENABLE_UI)

CMakePresets.json

@@ -36,6 +36,7 @@
         "ENABLE_UI"                    : "ON",
         "ENABLE_STATIC_BOOST_LIBS"     : "OFF",
         "ENABLE_DEBIAN_PACKAGE"        : "ON",
+        "ENABLE_ASIO_SELECT_REACTOR"   : "ON",
         "Boost_INCLUDE_DIR"            : "/usr/include"
       },
       "environment"   : {}
@@ -70,6 +71,7 @@
         "ENABLE_UI"                    : "ON",
         "ENABLE_STATIC_BOOST_LIBS"     : "OFF",
         "ENABLE_DEBIAN_PACKAGE"        : "ON",
+        "ENABLE_ASIO_SELECT_REACTOR"   : "ON",
         "Boost_INCLUDE_DIR"            : "/usr/include"
       },
       "environment"   : {}
@@ -104,6 +106,7 @@
         "ENABLE_UI"                    : "ON",
         "ENABLE_STATIC_BOOST_LIBS"     : "OFF",
         "ENABLE_DEBIAN_PACKAGE"        : "ON",
+        "ENABLE_ASIO_SELECT_REACTOR"   : "ON",
         "Boost_INCLUDE_DIR"            : "/usr/include"
       },
       "environment"   : {}
@@ -138,6 +141,7 @@
         "ENABLE_UI"                    : "ON",
         "ENABLE_STATIC_BOOST_LIBS"     : "OFF",
         "ENABLE_DEBIAN_PACKAGE"        : "ON",
+        "ENABLE_ASIO_SELECT_REACTOR"   : "ON",
         "Boost_INCLUDE_DIR"            : "/usr/include"
       },
       "environment"   : {}

cmake/CompilerOptions.cmake

@@ -121,6 +121,22 @@ if (HAVE_EXPORT_COMPILE_COMMANDS)
   set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 endif ()
 
+# =========================================================================================
+# Support for ASIO select 'fallback' reactor
+# =========================================================================================
+
+if( ENABLE_ASIO_SELECT_REACTOR )
+  #
+  # The three current alternatives, on Linux, for ASIO reactor are:
+  #  - epoll (by default)
+  #  - io_uring (when requested explicitly)
+  #  - select (fallback).
+  #
+  # This macro forces the use of the Boost.Asio 'select' fallback reactor.
+  #
+  add_compile_definitions( BOOST_ASIO_DISABLE_EPOLL )
+endif()
+
 # =========================================================================================
 # Support for std::filesystem
 # =========================================================================================

libs/CMakeLists.txt

@@ -342,6 +342,7 @@ set(srcs
   node/src/ecflow/node/ClientSuiteMgr.hpp
   node/src/ecflow/node/ClientSuites.hpp
   node/src/ecflow/node/CmdContext.hpp
+  node/src/ecflow/node/AuthorisationContext.hpp
   node/src/ecflow/node/Defs.hpp
   node/src/ecflow/node/DefsDelta.hpp
   node/src/ecflow/node/DefsTreeVisitor.hpp
@@ -373,7 +374,6 @@ set(srcs
   node/src/ecflow/node/NodeStats.hpp
   node/src/ecflow/node/NodeTreeVisitor.hpp
   node/src/ecflow/node/Operations.hpp
-  node/src/ecflow/node/Permissions.hpp
   node/src/ecflow/node/ResolveExternsVisitor.hpp
   node/src/ecflow/node/ServerState.hpp
   node/src/ecflow/node/Signal.hpp
@@ -420,6 +420,10 @@ set(srcs
   node/src/ecflow/node/parser/VariableParser.hpp
   node/src/ecflow/node/parser/VerifyParser.hpp
   node/src/ecflow/node/parser/ZombieAttrParser.hpp
+  node/src/ecflow/node/permissions/ActivePermissions.hpp
+  node/src/ecflow/node/permissions/Allowed.hpp
+  node/src/ecflow/node/permissions/Permission.hpp
+  node/src/ecflow/node/permissions/Permissions.hpp
   # Node -- Sources
   node/src/ecflow/node/Alias.cpp
   node/src/ecflow/node/Attr.cpp
@@ -428,6 +432,7 @@ set(srcs
   node/src/ecflow/node/ClientSuiteMgr.cpp
   node/src/ecflow/node/ClientSuites.cpp
   node/src/ecflow/node/CmdContext.cpp
+  node/src/ecflow/node/AuthorisationContext.cpp
   node/src/ecflow/node/Defs.cpp
   node/src/ecflow/node/DefsDelta.cpp
   node/src/ecflow/node/EcfFile.cpp
@@ -459,7 +464,6 @@ set(srcs
   node/src/ecflow/node/NodeStats.cpp
   node/src/ecflow/node/NodeTime.cpp
   node/src/ecflow/node/NodeTreeVisitor.cpp
-  node/src/ecflow/node/Permissions.cpp
   node/src/ecflow/node/ResolveExternsVisitor.cpp
   node/src/ecflow/node/ServerState.cpp
   node/src/ecflow/node/Signal.cpp
@@ -501,6 +505,10 @@ set(srcs
   node/src/ecflow/node/parser/VariableParser.cpp
   node/src/ecflow/node/parser/VerifyParser.cpp
   node/src/ecflow/node/parser/ZombieAttrParser.cpp
+  node/src/ecflow/node/permissions/ActivePermissions.cpp
+  node/src/ecflow/node/permissions/Allowed.cpp
+  node/src/ecflow/node/permissions/Permission.cpp
+  node/src/ecflow/node/permissions/Permissions.cpp
 
   # Server -- Headers
   server/src/ecflow/server/AuthenticationService.hpp

libs/base/CMakeLists.txt

@@ -25,7 +25,6 @@ set(test_srcs
   test/TestInLimitParsing.cpp
   test/TestLogCmd.cpp
   test/TestMeterCmd.cpp
-  test/TestPermissions.cpp
   test/TestProgramOptions.cpp
   test/TestQueryCmd.cpp
   test/TestQueueCmd.cpp