kleunen
commented
3 years ago An alternative would be that on a subscribe you calculate which filters the session is actually allowed to subscribe. So you combined the authorization filter + requested topic filter into an authorized topic filter:
Auth: level1/level2/level3
Subscribe: level1/level2/level3
Result: level1/level2/level3
Auth: level1/+/level3
Subscribe: level1/level2/level3
Result: level1/level2/level3
Auth: level1/level2/level3
Subscribe: level1/+/level3
Result: level1/level2/level3
Auth: level1/+/level3
Subscribe: level1/+/level3
Result: level1/+/level3
Auth: level1/level2/#
Subscribe: level1/level2/#
Result: level1/level2/#
Auth: level1/level2/#
Subscribe: level1/level2/level3/+
Result: level1/level2/level3/+
Auth: level1/level2/level3/+
Subscribe: level1/level2/#
Result: level1/level2/level3/+
Auth: level1/level2/#
Subscribe: level1/level2/level3/level4
Result: level1/level2/level3/level4
Auth: level1/level2/+
Subscribe: level1/level2/level3/level4
Result: Not allowed
Auth: level1/level2/level3/level4
Subscribe: level1/level2/+
Result: level1/level2/level3/level4
Auth: level1/+/level3/+
Subscribe: level1/level2/+/level4
Result: level1/level2/level3/level4
Auth: level1/level2/+
Subscribe: nomatch/level2/+
Result: Not allowed
Auth: level1/+/level3/+
Subscribe: level1/+/+/level4
Result: level1/+/level3/level4I think the rules for this should be:`
<literal> + <literal> = <literal> (if literals are equal, otherwise not allowed)
<literal> + '#' = <literal> (remaining path also part of subscription)
'#' + <literal> = <literal> (and remaining path is allowed)
'#' + '#' = '#'
<literal> + '+' = <literal>
'+' + <literal>= <literal>
'+' + '+' = '+'
'#' + '+' = '+' (and remaining path is allowed)
'+' + '#' = '+' (and remaining path is allowed)
number of levels should be equal _or_ # should be usedLike so: https://wandbox.org/permlink/xH31CMPvYS1xpuBA
#include <algorithm>
#include <iostream>
static constexpr char topic_filter_separator = '/';
template<typename Iterator>
Iterator topic_filter_getnexttoken(Iterator first, Iterator last)
{
return std::find(first, last, topic_filter_separator);
}
template<typename Iterator, typename Output>
inline void topic_filter_tokenizer(Iterator first, Iterator last, Output write) {
auto pos = topic_filter_getnexttoken(first, last);
while (write(first, pos) && pos != last) {
first = std::next(pos);
pos = topic_filter_getnexttoken(first, last);
}
}
bool is_hash(std::string const &level) { return level == "#"; }
bool is_plus(std::string const &level) { return level == "+"; }
bool is_literal(std::string const &level) { return !is_hash(level) && !is_plus(level); }
std::optional<std::string> authorize_subscribe(std::string const &authorized_filter, std::string const &subscription_filter)
{
std::optional<std::string> result;
auto append_result = [&result](std::string const &token) {
if (result) {
result.value() += topic_filter_separator + token;
} else {
result = std::optional<std::string>(token);
}
};
auto filter_begin = authorized_filter.begin();
auto subscription_begin = subscription_filter.begin();
while (filter_begin < authorized_filter.end() && subscription_begin < subscription_filter.end()) {
auto filter_end = topic_filter_getnexttoken(filter_begin, authorized_filter.end());
std::string auth = std::string(filter_begin, filter_end);
filter_begin = std::next(filter_end);
auto subscription_end = topic_filter_getnexttoken(subscription_begin, subscription_filter.end());
if(subscription_begin == subscription_filter.end()) {
return std::optional<std::string>();
}
std::string sub = std::string(subscription_begin, subscription_end);
subscription_begin = std::next(subscription_end);
if (is_hash(auth)) {
append_result(sub);
while (subscription_begin < subscription_filter.end()) {
auto subscription_end = topic_filter_getnexttoken(subscription_begin, subscription_filter.end());
append_result(std::string(subscription_begin, subscription_end));
subscription_begin = std::next(subscription_end);
}
return result;
}
if (is_hash(sub)) {
append_result(auth);
while(filter_begin < authorized_filter.end()) {
auto filter_end = topic_filter_getnexttoken(filter_begin, authorized_filter.end());
append_result(std::string(filter_begin, filter_end));
filter_begin = std::next(filter_end);
}
return result;
}
if (is_plus(auth)) {
append_result(sub);
} else if (is_plus(sub)) {
append_result(auth);
} else
{
if (auth != sub) {
return std::optional<std::string>();
}
append_result(auth);
}
}
if ( filter_begin < authorized_filter.end() || subscription_begin < subscription_filter.end()) {
return std::optional<std::string>();
}
return result;
}
std::vector<std::string> authorize_subscribe(std::vector<std::string> const &authorized_filters, std::string const &subscription_filter)
{
std::vector<std::string> result;
for(auto const& i: authorized_filters) {
auto topic_filter = authorize_subscribe(i, subscription_filter);
if (topic_filter) {
result.push_back(topic_filter.value());
} else
{
std::cout << "Not authorized" << std::endl;
}
}
return result;
}
int main()
{
std::vector<std::string> authorized_filters = {
"example/#"
};
auto result = authorize_subscribe(authorized_filters, "example/value/a");
for(auto const& i: result) {
std::cout << i << std::endl;
}
authorized_filters = {
"example/value/a"
};
result = authorize_subscribe(authorized_filters, "example/#");
for(auto const& i: result) {
std::cout << i << std::endl;
}
authorized_filters = {
"example/value/+"
};
result = authorize_subscribe(authorized_filters, "example/value/test");
for(auto const& i: result) {
std::cout << i << std::endl;
}
result = authorize_subscribe(authorized_filters, "example/value");
for(auto const& i: result) {
std::cout << i << std::endl;
}
authorized_filters = {
"example/value/test"
};
result = authorize_subscribe(authorized_filters, "example/value/+");
for(auto const& i: result) {
std::cout << i << std::endl;
}
result = authorize_subscribe(authorized_filters, "example/value");
for(auto const& i: result) {
std::cout << i << std::endl;
}
}
redboltz
I had an idea how to add topic authorization to the broker. I would like to propose this idea. To start with, you need a database of accounts with possible topic filters as follows:
USER1: Password1 topic: example/+/test, rights: publish
USER2: Password2 topic: example/+/test, rights: subscribe
USER3: Password3 topic: example/+/test, rights: publish + subscribe
So accounts get a list of users with passwords, and topic filters with rights if they are allowed to publish/subscribe to a topic.
Now, in the broker, when a connect enters: https://github.com/redboltz/mqtt_cpp/blob/master/include/mqtt/broker/broker.hpp#L405-L450
Rather than calling 'connect_handler' directly: https://github.com/redboltz/mqtt_cpp/blob/master/include/mqtt/broker/broker.hpp#L439-L448
You pass the connect request to some authorization class:
This will lookup the username/password in the databae (possibly a json file or some external authenticator). And finally forward the request to the connect handler within the broker with the rights:
The user rights are stored in a subscription map, such that we know for each session which rights apply (first set is list of sessions that are allowed to publish, second is list of sessions which are allowed to subscribe): using sub_rights_map = multiple_subscription_map<buffer, std::pair< std::set, std::set > >;
Now, when a message is published in
Lookup the topic_name in sub_rights_map. The publisher should have rights: Publish The sessions that receive the messages should have rights: Subscribe
The publisher should be somewhere in any of the filters which is allowed to publish to the topic.
You can lookup the set of subscribers by looking up the complete set of sessions which are allowed to subscribe to this topic std::set < session_state_ref> >, and then calculating the intersection with sessions which are actually subscribed to this topic.