row_acl000755 001751 001751 00000000000 10453432563 012030 5ustar00anoano000000 000000 row_acl/row_acl.sql.in000644 001751 001751 00000011470 10453155570 014666 0ustar00anoano000000 000000 -- ROW_ACL type definition CREATE FUNCTION row_acl_in (CSTRING) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_in' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_out (ROW_ACL) RETURNS CSTRING AS 'MODULE_PATHNAME', 'row_acl_out' LANGUAGE 'c' IMMUTABLE STRICT; CREATE TYPE row_acl ( internallength = 2, input = row_acl_in, output = row_acl_out ); CREATE FUNCTION row_acl_eq (ROW_ACL, ROW_ACL) RETURNS BOOL AS 'MODULE_PATHNAME', 'row_acl_eq' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_is_intersects (ROW_ACL, ROW_ACL) RETURNS BOOL AS 'MODULE_PATHNAME', 'row_acl_is_intersects' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_contains (ROW_ACL, ROW_ACL) RETURNS BOOL AS 'MODULE_PATHNAME', 'row_acl_contains' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_within (ROW_ACL, ROW_ACL) RETURNS BOOL AS 'MODULE_PATHNAME', 'row_acl_within' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl (INT) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'int_to_row_acl' LANGUAGE 'c' IMMUTABLE STRICT; CREATE CAST (INT as ROW_ACL) WITH FUNCTION row_acl (INT) AS IMPLICIT; CREATE FUNCTION int4 (ROW_ACL) RETURNS INT AS 'MODULE_PATHNAME', 'row_acl_to_int' LANGUAGE 'c' IMMUTABLE STRICT; CREATE CAST (ROW_ACL as INT) WITH FUNCTION int4 (ROW_ACL) AS IMPLICIT; CREATE FUNCTION acl_set (ROW_ACL, TEXT) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_set' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION acl_set (TEXT) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_set_alt' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_intersect (ROW_ACL, ROW_ACL) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_intersect' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_union (ROW_ACL, ROW_ACL) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_union' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION row_acl_subtract (ROW_ACL, ROW_ACL) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'row_acl_subtract' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_compress (INTERNAL) RETURNS INTERNAL AS 'MODULE_PATHNAME', 'gist_row_acl_compress' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_decompress (INTERNAL) RETURNS INTERNAL AS 'MODULE_PATHNAME', 'gist_row_acl_decompress' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_same (ROW_ACL, ROW_ACL, INTERNAL) RETURNS INTERNAL AS 'MODULE_PATHNAME', 'gist_row_acl_same' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_penalty (INTERNAL, INTERNAL, INTERNAL) RETURNS INTERNAL AS 'MODULE_PATHNAME', 'gist_row_acl_penalty' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_union (INTERNAL, INTERNAL) RETURNS ROW_ACL AS 'MODULE_PATHNAME', 'gist_row_acl_union' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_consistent (INTERNAL, ROW_ACL, INT) RETURNS BOOL AS 'MODULE_PATHNAME', 'gist_row_acl_consistent' LANGUAGE 'c' IMMUTABLE STRICT; CREATE FUNCTION gist_row_acl_picksplit (INTERNAL, INTERNAL) RETURNS INTERNAL AS 'MODULE_PATHNAME', 'gist_row_acl_picksplit' LANGUAGE 'c' IMMUTABLE STRICT; CREATE OPERATOR = ( leftarg = row_acl, rightarg = row_acl, commutator = =, restrict = eqsel, join = eqjoinsel, procedure = row_acl_eq ); CREATE OPERATOR <> ( leftarg = row_acl, rightarg = row_acl, commutator = <>, negator = =, restrict = neqsel, join = neqjoinsel, procedure = row_acl_eq ); CREATE OPERATOR && ( leftarg = row_acl, rightarg = row_acl, commutator = &&, restrict = contsel, join = contjoinsel, procedure = row_acl_is_intersects ); CREATE OPERATOR &> ( leftarg = row_acl, rightarg = row_acl, commutator = &<, restrict = contsel, join = contjoinsel, procedure = row_acl_contains ); CREATE OPERATOR &< ( leftarg = row_acl, rightarg = row_acl, commutator = &>, restrict = contsel, join = contjoinsel, procedure = row_acl_within ); CREATE OPERATOR & ( leftarg = row_acl, rightarg = row_acl, commutator = &, procedure = row_acl_intersect ); CREATE OPERATOR + ( leftarg = row_acl, rightarg = row_acl, commutator = +, procedure = row_acl_union ); CREATE OPERATOR - ( leftarg = row_acl, rightarg = row_acl, procedure = row_acl_subtract ); CREATE OPERATOR CLASS gist_row_acl_ops DEFAULT FOR TYPE row_acl USING gist AS OPERATOR 3 && , OPERATOR 6 = , OPERATOR 7 &> , OPERATOR 8 &< , FUNCTION 1 gist_row_acl_consistent (INTERNAL, ROW_ACL, INT), FUNCTION 2 gist_row_acl_union (INTERNAL, INTERNAL), FUNCTION 3 gist_row_acl_compress (INTERNAL), FUNCTION 4 gist_row_acl_decompress (INTERNAL), FUNCTION 5 gist_row_acl_penalty (INTERNAL, INTERNAL, INTERNAL), FUNCTION 6 gist_row_acl_picksplit (INTERNAL, INTERNAL), FUNCTION 7 gist_row_acl_same (ROW_ACL, ROW_ACL, INTERNAL); row_acl/row_acl.c000644 001751 001751 00000036227 10453404267 013713 0ustar00anoano000000 000000 #include "row_acl.h" #include #include #include PG_FUNCTION_INFO_V1(row_acl_in); PG_FUNCTION_INFO_V1(row_acl_out); PG_FUNCTION_INFO_V1(row_acl_eq); PG_FUNCTION_INFO_V1(row_acl_is_intersects); PG_FUNCTION_INFO_V1(row_acl_contains); PG_FUNCTION_INFO_V1(row_acl_within); PG_FUNCTION_INFO_V1(int_to_row_acl); PG_FUNCTION_INFO_V1(row_acl_to_int); PG_FUNCTION_INFO_V1(row_acl_intersect); PG_FUNCTION_INFO_V1(row_acl_union); PG_FUNCTION_INFO_V1(row_acl_subtract); PG_FUNCTION_INFO_V1(row_acl_set); PG_FUNCTION_INFO_V1(row_acl_set_alt); PG_FUNCTION_INFO_V1(gist_row_acl_compress); PG_FUNCTION_INFO_V1(gist_row_acl_decompress); PG_FUNCTION_INFO_V1(gist_row_acl_same); PG_FUNCTION_INFO_V1(gist_row_acl_penalty); PG_FUNCTION_INFO_V1(gist_row_acl_union); PG_FUNCTION_INFO_V1(gist_row_acl_consistent); PG_FUNCTION_INFO_V1(gist_row_acl_picksplit); Datum row_acl_in(PG_FUNCTION_ARGS); Datum row_acl_out(PG_FUNCTION_ARGS); Datum row_acl_eq(PG_FUNCTION_ARGS); Datum row_acl_is_intersects(PG_FUNCTION_ARGS); Datum row_acl_contains(PG_FUNCTION_ARGS); Datum row_acl_within(PG_FUNCTION_ARGS); Datum int_to_row_acl(PG_FUNCTION_ARGS); Datum row_acl_to_int(PG_FUNCTION_ARGS); Datum row_acl_intersect(PG_FUNCTION_ARGS); Datum row_acl_union(PG_FUNCTION_ARGS); Datum row_acl_subtract(PG_FUNCTION_ARGS); Datum row_acl_set(PG_FUNCTION_ARGS); Datum row_acl_set_alt(PG_FUNCTION_ARGS); Datum gist_row_acl_compress(PG_FUNCTION_ARGS); Datum gist_row_acl_decompress(PG_FUNCTION_ARGS); Datum gist_row_acl_same(PG_FUNCTION_ARGS); Datum gist_row_acl_penalty(PG_FUNCTION_ARGS); Datum gist_row_acl_union(PG_FUNCTION_ARGS); Datum gist_row_acl_consistent(PG_FUNCTION_ARGS); Datum gist_row_acl_picksplit(PG_FUNCTION_ARGS); row_acl inner_row_acl_set(row_acl a, text *t); Datum row_acl_in(PG_FUNCTION_ARGS) { char *str = (char*)PG_GETARG_CSTRING(0); row_acl* result; int acl_error = 0; size_t sz = 0; text* t = NULL; if(str == NULL) PG_RETURN_NULL(); result = (row_acl*)palloc(sizeof(row_acl)); *result = ROW_ACL_NOTHING; if(strcmp(str, "") == 0) PG_RETURN_POINTER(result); if (str[0]=='u' || str[0]=='g' || str[0]=='o' || str[0]=='a') { /* Permissions in the "ug+rwdi,g-dw,o+r" form */ sz = strlen(str); t = (text*)palloc(VARHDRSZ + sz); memcpy(VARDATA(t), str, sz); VARATT_SIZEP(t) = VARHDRSZ + sz; *result = inner_row_acl_set(ROW_ACL_NOTHING, t); } else { /* User permissions */ switch (str[0]) { case 'r': *result |= ROW_ACL_USER_READ; break; case '-': break; default: acl_error = 1; } switch (str[1]) { case 'w': *result |= ROW_ACL_USER_WRITE; break; case '-': break; default: acl_error = 1; } switch (str[2]) { case 'd': *result |= ROW_ACL_USER_DELETE; break; case '-': break; default: acl_error = 1; } switch (str[3]) { case 'i': *result |= ROW_ACL_USER_INSERT; break; case '-': break; default: acl_error = 1; } switch (str[4]) { case 'x': *result |= ROW_ACL_USER_EXEC; break; case '-': break; default: acl_error = 1; } /* Group permissions */ switch (str[5]) { case 'r': *result |= ROW_ACL_GROUP_READ; break; case '-': break; default: acl_error = 1; } switch (str[6]) { case 'w': *result |= ROW_ACL_GROUP_WRITE; break; case '-': break; default: acl_error = 1; } switch (str[7]) { case 'd': *result |= ROW_ACL_GROUP_DELETE; break; case '-': break; default: acl_error = 1; } switch (str[8]) { case 'i': *result |= ROW_ACL_GROUP_INSERT; break; case '-': break; default: acl_error = 1; } switch (str[9]) { case 'x': *result |= ROW_ACL_GROUP_EXEC; break; case '-': break; default: acl_error = 1; } /* Other permissions */ switch (str[10]) { case 'r': *result |= ROW_ACL_OTHER_READ; break; case '-': break; default: acl_error = 1; } switch (str[11]) { case 'w': *result |= ROW_ACL_OTHER_WRITE; break; case '-': break; default: acl_error = 1; } switch (str[12]) { case 'd': *result |= ROW_ACL_OTHER_DELETE; break; case '-': break; default: acl_error = 1; } switch (str[13]) { case 'i': *result |= ROW_ACL_OTHER_INSERT; break; case '-': break; default: acl_error = 1; } switch (str[14]) { case 'x': *result |= ROW_ACL_OTHER_EXEC; break; case '-': break; default: acl_error = 1; } } if (acl_error) { elog(ERROR,"row_acl_in: incorrect access mode '%s'", str); PG_RETURN_NULL(); } PG_RETURN_POINTER(result); } Datum row_acl_out(PG_FUNCTION_ARGS) { row_acl *ma = (row_acl*)PG_GETARG_POINTER(0); char* result; if(ma == NULL) PG_RETURN_NULL(); result = (char*)palloc(ROW_ACL_STR_LENGTH); result[0] = 0; /* User permissions */ if (*ma & ROW_ACL_USER_READ) strcat(result, "r"); else strcat(result, "-"); if (*ma & ROW_ACL_USER_WRITE) strcat(result, "w"); else strcat(result, "-"); if (*ma & ROW_ACL_USER_DELETE) strcat(result, "d"); else strcat(result, "-"); if (*ma & ROW_ACL_USER_INSERT) strcat(result, "i"); else strcat(result, "-"); if (*ma & ROW_ACL_USER_EXEC) strcat(result, "x"); else strcat(result, "-"); /* Group permissions */ if (*ma & ROW_ACL_GROUP_READ) strcat(result, "r"); else strcat(result, "-"); if (*ma & ROW_ACL_GROUP_WRITE) strcat(result, "w"); else strcat(result, "-"); if (*ma & ROW_ACL_GROUP_DELETE) strcat(result, "d"); else strcat(result, "-"); if (*ma & ROW_ACL_GROUP_INSERT) strcat(result, "i"); else strcat(result, "-"); if (*ma & ROW_ACL_GROUP_EXEC) strcat(result, "x"); else strcat(result, "-"); /* Other permissions */ if (*ma & ROW_ACL_OTHER_READ) strcat(result, "r"); else strcat(result, "-"); if (*ma & ROW_ACL_OTHER_WRITE) strcat(result, "w"); else strcat(result, "-"); if (*ma & ROW_ACL_OTHER_DELETE) strcat(result, "d"); else strcat(result, "-"); if (*ma & ROW_ACL_OTHER_INSERT) strcat(result, "i"); else strcat(result, "-"); if (*ma & ROW_ACL_OTHER_EXEC) strcat(result, "x"); else strcat(result, "-"); PG_RETURN_CSTRING(result); } Datum row_acl_eq(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); if (*a == *b) PG_RETURN_BOOL(true); else PG_RETURN_BOOL(false); } Datum row_acl_is_intersects(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); if (*a & *b) PG_RETURN_BOOL(true); else PG_RETURN_BOOL(false); } Datum row_acl_contains(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); if ((*a & *b) == *b) PG_RETURN_BOOL(true); else PG_RETURN_BOOL(false); } Datum row_acl_within(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); if ((*a & *b) == *a) PG_RETURN_BOOL(true); else PG_RETURN_BOOL(false); } Datum int_to_row_acl(PG_FUNCTION_ARGS) { int32 mode = PG_GETARG_INT32(0); row_acl* result; result = (row_acl*)palloc(sizeof(row_acl)); *result = mode; PG_RETURN_POINTER(result); } Datum row_acl_to_int(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); int32 result; result = *a; PG_RETURN_INT32(result); } Datum row_acl_intersect(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); row_acl* result; result = (row_acl*)palloc(sizeof(row_acl)); *result = *a & *b; PG_RETURN_POINTER(result); } Datum row_acl_union(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); row_acl* result; result = (row_acl*)palloc(sizeof(row_acl)); *result = *a | *b; PG_RETURN_POINTER(result); } Datum row_acl_subtract(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); row_acl* result; result = (row_acl*)palloc(sizeof(row_acl)); *result = *a ^ *b; PG_RETURN_POINTER(result); } Datum row_acl_set(PG_FUNCTION_ARGS) { row_acl *a = (row_acl*)PG_GETARG_POINTER(0); text *t = PG_GETARG_TEXT_P(1); row_acl *result = (row_acl*)palloc(sizeof(row_acl)); *result = inner_row_acl_set(*a, t); PG_RETURN_POINTER(result); } Datum row_acl_set_alt(PG_FUNCTION_ARGS) { text *t = PG_GETARG_TEXT_P(0); row_acl *result = (row_acl*)palloc(sizeof(row_acl)); *result = inner_row_acl_set(ROW_ACL_NOTHING, t); PG_RETURN_POINTER(result); } row_acl inner_row_acl_set(row_acl a, text *t) { row_acl result; char *tt; int u, g, o, i, d, who; u = g = o = i = d = 0; who = 1; result = (a) ? a : ROW_ACL_NOTHING; tt = VARDATA(t); for (i = 0; i < VARSIZE(t)-VARHDRSZ; i++) { if (who) { switch (*tt) { case 'u': u = 1; break; case 'g': g = 1; break; case 'o': o = 1; break; case 'a': u = 1; g = 1; o = 1; break; default: who = 0; } } if (!who) { switch (*tt) { case '+': d = 1; break; case '-': d = -1; break; case 'r': if (d > 0) { if (u) result |= ROW_ACL_USER_READ; if (g) result |= ROW_ACL_GROUP_READ; if (o) result |= ROW_ACL_OTHER_READ; } if (d < 0) { if (u) result ^= ROW_ACL_USER_READ; if (g) result ^= ROW_ACL_GROUP_READ; if (o) result ^= ROW_ACL_OTHER_READ; } break; case 'w': if (d > 0) { if (u) result |= ROW_ACL_USER_WRITE; if (g) result |= ROW_ACL_GROUP_WRITE; if (o) result |= ROW_ACL_OTHER_WRITE; } if (d < 0) { if (u) result ^= ROW_ACL_USER_WRITE; if (g) result ^= ROW_ACL_GROUP_WRITE; if (o) result ^= ROW_ACL_OTHER_WRITE; } break; case 'd': if (d > 0) { if (u) result |= ROW_ACL_USER_DELETE; if (g) result |= ROW_ACL_GROUP_DELETE; if (o) result |= ROW_ACL_OTHER_DELETE; } if (d < 0) { if (u) result ^= ROW_ACL_USER_DELETE; if (g) result ^= ROW_ACL_GROUP_DELETE; if (o) result ^= ROW_ACL_OTHER_DELETE; } break; case 'i': if (d > 0) { if (u) result |= ROW_ACL_USER_INSERT; if (g) result |= ROW_ACL_GROUP_INSERT; if (o) result |= ROW_ACL_OTHER_INSERT; } if (d < 0) { if (u) result ^= ROW_ACL_USER_INSERT; if (g) result ^= ROW_ACL_GROUP_INSERT; if (o) result ^= ROW_ACL_OTHER_INSERT; } break; case 'x': if (d > 0) { if (u) result |= ROW_ACL_USER_EXEC; if (g) result |= ROW_ACL_GROUP_EXEC; if (o) result |= ROW_ACL_OTHER_EXEC; } if (d < 0) { if (u) result ^= ROW_ACL_USER_EXEC; if (g) result ^= ROW_ACL_GROUP_EXEC; if (o) result ^= ROW_ACL_OTHER_EXEC; } break; case 'a': if (d > 0) { if (u) result |= ROW_ACL_USER_ALL; if (g) result |= ROW_ACL_GROUP_ALL; if (o) result |= ROW_ACL_OTHER_ALL; } if (d < 0) { if (u) result ^= ROW_ACL_USER_ALL; if (g) result ^= ROW_ACL_GROUP_ALL; if (o) result ^= ROW_ACL_OTHER_ALL; } break; default: u = g = o = d = 0; who = 1; } } tt++; } return result; } Datum gist_row_acl_compress(PG_FUNCTION_ARGS) { PG_RETURN_POINTER(PG_GETARG_POINTER(0)); } Datum gist_row_acl_decompress(PG_FUNCTION_ARGS) { PG_RETURN_POINTER(PG_GETARG_POINTER(0)); } Datum gist_row_acl_same(PG_FUNCTION_ARGS) { row_acl* a = (row_acl*)PG_GETARG_POINTER(0); row_acl* b = (row_acl*)PG_GETARG_POINTER(1); bool* result = (bool*)PG_GETARG_POINTER(2); if (a && b) *result = (*a == *b) ? TRUE : FALSE; else *result = (a == NULL && b == NULL) ? TRUE : FALSE; PG_RETURN_POINTER(result); } static int row_acl_count_ones(row_acl a) { int i, v = 0; for (i = 0; i < ROW_ACL_COUNT; i++) v += (a >> i) & 1; return(v); } Datum gist_row_acl_penalty(PG_FUNCTION_ARGS) { /* исходный ACL */ GISTENTRY *a = (GISTENTRY*)PG_GETARG_POINTER(0); /* добавляемый ACL */ GISTENTRY *b = (GISTENTRY*)PG_GETARG_POINTER(1); float *result = (float*)PG_GETARG_POINTER(2); row_acl* o = (row_acl*)DatumGetPointer(a->key); /* получаем объединяющий ACL */ row_acl u = *((row_acl*)DatumGetPointer(a->key)) | *((row_acl*)DatumGetPointer(b->key)); /* вычитаем "объём" исходного из "объёма" объединяющего ACL */ *result = (float)(row_acl_count_ones(u) - row_acl_count_ones(*o)); PG_RETURN_POINTER(result); } Datum gist_row_acl_union(PG_FUNCTION_ARGS) { GistEntryVector *ev = (GistEntryVector*)PG_GETARG_POINTER(0); int *sizep = (int*)PG_GETARG_POINTER(1); int i, n = ev->n; row_acl* u = (row_acl*)palloc(sizeof(row_acl)); *u = ROW_ACL_NOTHING; for (i = 0; i < n; i++) *u |= *((row_acl*)DatumGetPointer(ev->vector[i].key)); /* размер возвращаемого значения в байтах */ *sizep = sizeof(row_acl); PG_RETURN_POINTER(u); } Datum gist_row_acl_consistent(PG_FUNCTION_ARGS) { GISTENTRY *entry = (GISTENTRY*)PG_GETARG_POINTER(0); row_acl *query = (row_acl*)PG_GETARG_POINTER(1); StrategyNumber strategy = PG_GETARG_UINT16(2); row_acl* a; bool result = FALSE; if (DatumGetPointer(entry->key) == NULL || query == NULL) PG_RETURN_BOOL(FALSE); a = (row_acl*)DatumGetPointer(entry->key); /* если значение находится на концевой странице, то выполняется точное сравнение, * на внутренней мы должны вернуть true если значения на последующих * страницах (детях) МОГУТ удовлетворять условию */ switch (strategy) { case RTOverlapStrategyNumber: result = ((*a & *query) != ROW_ACL_NOTHING) ? TRUE : FALSE;; break; case RTSameStrategyNumber: if (GIST_LEAF(entry)) result = (*a == *query) ? TRUE : FALSE; else result = ((*a & *query) == *query) ? TRUE : FALSE; break; case RTContainsStrategyNumber: result = ((*a & *query) == *query) ? TRUE : FALSE; break; case RTContainedByStrategyNumber: if (GIST_LEAF(entry)) result = ((*a & *query) == *a) ? TRUE : FALSE; else result = ((*a & *query) != ROW_ACL_NOTHING) ? TRUE : FALSE; break; default: result = FALSE; } PG_RETURN_BOOL(result); } Datum gist_row_acl_picksplit(PG_FUNCTION_ARGS) { GistEntryVector *ev = (GistEntryVector*)PG_GETARG_POINTER(0); GIST_SPLITVEC *v = (GIST_SPLITVEC*)PG_GETARG_POINTER(1); OffsetNumber i, maxoff = ev->n - 1; int n; n = (maxoff + 2) * sizeof(OffsetNumber); v->spl_left = (OffsetNumber*)palloc(n); v->spl_right = (OffsetNumber*)palloc(n); v->spl_ldatum = PointerGetDatum(palloc(sizeof(row_acl))); v->spl_rdatum = PointerGetDatum(palloc(sizeof(row_acl))); v->spl_nleft = 0; v->spl_nright = 0; for (i = FirstOffsetNumber; i <= maxoff; i = OffsetNumberNext(i)) { row_acl* u; /* указатель на объединяющий ACL */ row_acl* a = (row_acl*)DatumGetPointer(ev->vector[i].key); // if (row_acl_count_ones(*a) > 7) { if (i%2 == 0) { v->spl_left[v->spl_nleft] = i; v->spl_nleft++; u = (row_acl*)DatumGetPointer(v->spl_ldatum); } else { v->spl_right[v->spl_nright] = i; v->spl_nright++; u = (row_acl*)DatumGetPointer(v->spl_rdatum); } if (i <= OffsetNumberNext(FirstOffsetNumber)) { /* первоначальная инициализация объединяющего ACL */ *u = *((row_acl*)DatumGetPointer(ev->vector[i].key)); } else { *u |= *a; } } PG_RETURN_POINTER(v); } row_acl/row_acl.h000644 001751 001751 00000002610 10453155744 013710 0ustar00anoano000000 000000 #ifndef _ROW_ACL_H_ #include #include typedef int16 row_acl; #define ROW_ACL_LENGTH sizeof(row_acl) #define ROW_ACL_COUNT ROW_ACL_LENGTH * 8 #define ROW_ACL_STR_LENGTH (ROW_ACL_COUNT + 1) #define ROW_ACL_USER_READ 16384 /* 10000 00000 00000 */ #define ROW_ACL_USER_WRITE 8192 /* 01000 00000 00000 */ #define ROW_ACL_USER_DELETE 4096 /* 00100 00000 00000 */ #define ROW_ACL_USER_INSERT 2048 /* 00010 00000 00000 */ #define ROW_ACL_USER_EXEC 1024 /* 00001 00000 00000 */ #define ROW_ACL_USER_ALL 31744 /* 11111 00000 00000 */ #define ROW_ACL_GROUP_READ 512 /* 00000 10000 00000 */ #define ROW_ACL_GROUP_WRITE 256 /* 00000 01000 00000 */ #define ROW_ACL_GROUP_DELETE 128 /* 00000 00100 00000 */ #define ROW_ACL_GROUP_INSERT 64 /* 00000 00010 00000 */ #define ROW_ACL_GROUP_EXEC 32 /* 00000 00001 00000 */ #define ROW_ACL_GROUP_ALL 992 /* 00000 11111 00000 */ #define ROW_ACL_OTHER_READ 16 /* 00000 00000 10000 */ #define ROW_ACL_OTHER_WRITE 8 /* 00000 00000 01000 */ #define ROW_ACL_OTHER_DELETE 4 /* 00000 00000 00100 */ #define ROW_ACL_OTHER_INSERT 2 /* 00000 00000 00010 */ #define ROW_ACL_OTHER_EXEC 1 /* 00000 00000 00001 */ #define ROW_ACL_OTHER_ALL 31 /* 00000 00000 11111 */ #define ROW_ACL_NOTHING 0 #define ROW_ACL_ALL ((1 << ROW_ACL_COUNT) - 1) #define ROW_SHL_USR 10 #define ROW_SHL_GRP 5 #define ROW_USER_NOAUTH 0 #define ROW_USER_ROOT 1 #define _ROW_ACL_H_ #endif row_acl/Makefile000644 001751 001751 00000004731 10453427717 013561 0ustar00anoano000000 000000 CCVER = $(shell $(CC) -v 2>&1 | tail -1 | cut -f1 -d' ') OS = $(shell uname -s) INSTALL = install PG_INCLUDE = $(shell pg_config --includedir) PG_INCLUDE_SERVER = $(shell pg_config --includedir-server) PG_LIBRARIES = $(shell pg_config --libdir) PG_CONTRIB_LIB = $(shell pg_config --pkglibdir) PG_CONTRIB_SQL = $(shell pg_config --sharedir)/contrib PG_CONTRIB_DOC = $(shell pg_config --docdir)/contrib EXTRA_INCLUDE = /opt/csw/include /usr/sfw/include /usr/local/include EXTRA_LIBRARIES = /opt/csw/lib /usr/sfw/lib /usr/ucblib /usr/local/lib /usr/lib64 MODULE_NAME = row_acl LIB_A = lib$(MODULE_NAME).a LIB_SO = $(MODULE_NAME).so SRCS = $(wildcard *.c) HDRS = $(wildcard *.h) HDRDEP = $(patsubst %.c, %.d, $(SRCS)) OBJS = $(patsubst %.c, %.o, $(SRCS)) SQLSRCS = $(wildcard *.sql.in) SQLS = $(patsubst %.sql.in, %.sql, $(SQLSRCS)) ifeq ($(CCVER),gcc) CXX = g++ RPATH = -Wl,-R WARNINGS = -Wall -Wmissing-prototypes -Wpointer-arith -Winline -Wendif-labels CFLAGS = -pipe -O2 -fpic -fno-strict-aliasing LDFLAGS = -pipe -O2 -fpic -shared else CXX = CC RPATH = -R WARNINGS = -v CFLAGS = -Xa -fast -Kpic -DHAVE_UNSETENV=1 LDFLAGS = -Xa -fast -Kpic -G endif CFLAGS += $(WARNINGS) -I. $(addprefix -I, $(PG_INCLUDE_SERVER) $(EXTRA_INCLUDE)) LDFLAGS += $(WARNINGS) $(addprefix -L, $(PG_LIBRARIES) $(EXTRA_LIBRARIES)) LDFLAGS += $(addprefix $(RPATH), $(PG_LIBRARIES) $(EXTRA_LIBRARIES)) .SUFFIXES: .c .o .sql .sql.in all: lib sql lib: $(LIB_SO) $(LIB_A) sql: $(SQLS) clean: -$(RM) *.d *.o $(SQLS) $(LIB_A) $(LIB_SO)* install: install_lib install_sql install_doc uninstall: -$(RM) $(PG_CONTRIB_LIB)/$(LIB_SO) -$(RM) $(PG_CONTRIB_SQL)/$(MODULE_NAME).sql -$(RM) $(PG_CONTRIB_DOC)/README.$(MODULE_NAME) $(LIB_SO): $(OBJS) $(CC) $(LDFLAGS) $^ -o $@ $(LIB_A): $(OBJS) $(AR) $(ARFLAGS) $@ $^ .c.o: ifeq ($(CCVER),gcc) $(CC) $(CFLAGS) -MD -c $< else $(CC) $(CFLAGS) -xM $< > $(<:.c=.d) $(CC) $(CFLAGS) -c $< endif .sql.in.sql: sed -e 's,MODULE_PATHNAME,$(PG_CONTRIB_LIB)/$(MODULE_NAME),g' \ -e 's,MODULE_NAME,$(MODULE_NAME),g' \ < $< > $@ install_lib: $(LIB_A) $(LIB_SO) $(INSTALL) -d -m 755 $(PG_CONTRIB_LIB) $(INSTALL) -m 755 $(LIB_SO) $(PG_CONTRIB_LIB) install_sql: $(SQLS) $(INSTALL) -d -m 755 $(PG_CONTRIB_SQL) $(INSTALL) -m 644 $(SQLS) $(PG_CONTRIB_SQL) install_doc: README.$(MODULE_NAME) $(INSTALL) -d -m 755 $(PG_CONTRIB_DOC) $(INSTALL) -m 644 README.$(MODULE_NAME) $(PG_CONTRIB_DOC) include $(wildcard *.d) row_acl/README.row_acl000644 001751 001751 00000004041 10453424636 014415 0ustar00anoano000000 000000 --Example of use. CREATE LANGUAGE plpgsql; CREATE TABLE obj ( id SERIAL NOT NULL PRIMARY KEY, pid INT NOT NULL REFERENCES obj (id), usr TEXT NOT NULL CHECK (usr ~ '^[A-Za-z0-9_]+$'), grp TEXT NOT NULL CHECK (grp ~ '^[A-Za-z0-9_]+$'), acl ROW_ACL NOT NULL DEFAULT 'u+a, g+rx, o+x', a TEXT NOT NULL DEFAULT '' ); -- Check privilege (r,w,d,i,x) for user on object CREATE OR REPLACE FUNCTION acl_check ( who_tries NAME, acl_mask CHAR, obj_acl ROW_ACL, obj_usr NAME, obj_grp NAME ) RETURNS BOOLEAN AS $$ BEGIN IF obj_acl && acl_set('o+' || acl_mask) OR obj_acl && acl_set('u+' || acl_mask) AND who_tries = obj_usr OR obj_acl && acl_set('g+' || acl_mask) AND pg_has_role(who_tries, obj_grp, 'MEMBER') THEN RETURN TRUE; END IF; RETURN FALSE; END; $$ LANGUAGE plpgsql; -- Trigger function for INSERT/UPDATE/DELETE in OBJ (AFTER INSERT/UPDATE/DELETE) CREATE OR REPLACE FUNCTION obj_after_ins_up_del () RETURNS TRIGGER AS $$ BEGIN IF TG_OP = 'INSERT' THEN IF session_user = 'super_user' AND new.id = new.pid THEN RETURN new; ELSIF NOT EXISTS (SELECT id FROM obj WHERE id = new.pid AND acl_check(session_user, 'i', acl, usr, grp)) THEN RAISE EXCEPTION '% have not rights for insert into % %', session_user, TG_RELNAME, new.pid; END IF; ELSIF TG_OP = 'UPDATE' THEN IF NOT acl_check(session_user, 'w', old.acl, old.usr, old.grp) THEN RAISE EXCEPTION '% have not rights for update % %', session_user, TG_RELNAME, old.id; END IF; ELSIF TG_OP = 'DELETE' THEN IF NOT acl_check(session_user, 'd', old.acl, old.usr, old.grp) THEN RAISE EXCEPTION '% have not rights for delete % %', session_user, TG_RELNAME, old.id; END IF; END IF; RETURN new; END; $$ LANGUAGE plpgsql; CREATE TRIGGER obj_after_ins_up_del AFTER INSERT OR UPDATE OR DELETE ON obj FOR EACH ROW EXECUTE PROCEDURE obj_after_ins_up_del(); CREATE VIEW _obj AS SELECT * FROM obj o WHERE o.acl && 'o+r' OR o.acl && 'u+r' AND o.usr = session_user OR o.acl && 'g+r' AND pg_has_role(session_user, o.grp, 'MEMBER');