mirror of https://github.com/grpc/grpc.git
Rbac Matcher implementation. (#25653)
Ashitha Santhosh
4 years ago
committed by
GitHub
parent
c0a78774f8
commit
1fb4f715db
22 changed files with 1253 additions and 292 deletions
@ -0,0 +1,202 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/authorization/matchers.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
namespace { |
||||||
|
|
||||||
|
bool AuthenticatedMatchesHelper(const EvaluateArgs& args, |
||||||
|
const StringMatcher& matcher) { |
||||||
|
if (args.GetTransportSecurityType() != GRPC_SSL_TRANSPORT_SECURITY_TYPE) { |
||||||
|
// Connection is not authenticated.
|
||||||
|
return false; |
||||||
|
} |
||||||
|
if (matcher.string_matcher().empty()) { |
||||||
|
// Allows any authenticated user.
|
||||||
|
return true; |
||||||
|
} |
||||||
|
absl::string_view spiffe_id = args.GetSpiffeId(); |
||||||
|
if (!spiffe_id.empty()) { |
||||||
|
return matcher.Match(spiffe_id); |
||||||
|
} |
||||||
|
// TODO(ashithasantosh): Check principal matches DNS SAN, followed by Subject
|
||||||
|
// field from certificate. This requires updating tsi_peer to expose these
|
||||||
|
// fields.
|
||||||
|
return false; |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace
|
||||||
|
|
||||||
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create( |
||||||
|
Rbac::Permission permission) { |
||||||
|
switch (permission.type) { |
||||||
|
case Rbac::Permission::RuleType::AND: |
||||||
|
return absl::make_unique<AndAuthorizationMatcher>( |
||||||
|
std::move(permission.permissions), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::OR: |
||||||
|
return absl::make_unique<OrAuthorizationMatcher>( |
||||||
|
std::move(permission.permissions), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::ANY: |
||||||
|
return absl::make_unique<AlwaysAuthorizationMatcher>(permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::HEADER: |
||||||
|
return absl::make_unique<HeaderAuthorizationMatcher>( |
||||||
|
std::move(permission.header_matcher), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::PATH: |
||||||
|
return absl::make_unique<PathAuthorizationMatcher>( |
||||||
|
std::move(permission.string_matcher), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::DEST_IP: |
||||||
|
return absl::make_unique<IpAuthorizationMatcher>(std::move(permission.ip), |
||||||
|
permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::DEST_PORT: |
||||||
|
return absl::make_unique<PortAuthorizationMatcher>(permission.port, |
||||||
|
permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::REQ_SERVER_NAME: |
||||||
|
return absl::make_unique<ReqServerNameAuthorizationMatcher>( |
||||||
|
std::move(permission.string_matcher), permission.not_rule); |
||||||
|
} |
||||||
|
return nullptr; |
||||||
|
} |
||||||
|
|
||||||
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create( |
||||||
|
Rbac::Principal principal) { |
||||||
|
switch (principal.type) { |
||||||
|
case Rbac::Principal::RuleType::AND: |
||||||
|
return absl::make_unique<AndAuthorizationMatcher>( |
||||||
|
std::move(principal.principals), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::OR: |
||||||
|
return absl::make_unique<OrAuthorizationMatcher>( |
||||||
|
std::move(principal.principals), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::ANY: |
||||||
|
return absl::make_unique<AlwaysAuthorizationMatcher>(principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::PRINCIPAL_NAME: |
||||||
|
return absl::make_unique<AuthenticatedAuthorizationMatcher>( |
||||||
|
std::move(principal.string_matcher), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::SOURCE_IP: |
||||||
|
case Rbac::Principal::RuleType::DIRECT_REMOTE_IP: |
||||||
|
case Rbac::Principal::RuleType::REMOTE_IP: |
||||||
|
return absl::make_unique<IpAuthorizationMatcher>(std::move(principal.ip), |
||||||
|
principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::HEADER: |
||||||
|
return absl::make_unique<HeaderAuthorizationMatcher>( |
||||||
|
std::move(principal.header_matcher), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::PATH: |
||||||
|
return absl::make_unique<PathAuthorizationMatcher>( |
||||||
|
std::move(principal.string_matcher), principal.not_rule); |
||||||
|
} |
||||||
|
return nullptr; |
||||||
|
} |
||||||
|
|
||||||
|
AndAuthorizationMatcher::AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (auto& rule : rules) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*rule))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
AndAuthorizationMatcher::AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& id : ids) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*id))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
bool AndAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = true; |
||||||
|
for (const auto& matcher : matchers_) { |
||||||
|
if (!matcher->Matches(args)) { |
||||||
|
matches = false; |
||||||
|
break; |
||||||
|
} |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
OrAuthorizationMatcher::OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& rule : rules) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*rule))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
OrAuthorizationMatcher::OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& id : ids) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*id))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
bool OrAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = false; |
||||||
|
for (const auto& matcher : matchers_) { |
||||||
|
if (matcher->Matches(args)) { |
||||||
|
matches = true; |
||||||
|
break; |
||||||
|
} |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
std::string concatenated_value; |
||||||
|
bool matches = |
||||||
|
matcher_.Match(args.GetHeaderValue(matcher_.name(), &concatenated_value)); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
// TODO(ashithasantosh): Implement IpAuthorizationMatcher::Matches.
|
||||||
|
bool IpAuthorizationMatcher::Matches(const EvaluateArgs&) const { |
||||||
|
bool matches = false; |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PortAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = (port_ == args.GetLocalPort()); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool AuthenticatedAuthorizationMatcher::Matches( |
||||||
|
const EvaluateArgs& args) const { |
||||||
|
bool matches = AuthenticatedMatchesHelper(args, matcher_); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool ReqServerNameAuthorizationMatcher::Matches(const EvaluateArgs&) const { |
||||||
|
// Currently we do not support matching rules containing
|
||||||
|
// "requested_server_name".
|
||||||
|
bool matches = false; |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PathAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = false; |
||||||
|
absl::string_view path = args.GetPath(); |
||||||
|
if (!path.empty()) { |
||||||
|
matches = matcher_.Match(path); |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PolicyAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
return permissions_->Matches(args) && principals_->Matches(args); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
@ -0,0 +1,206 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H |
||||||
|
#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H |
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include <memory> |
||||||
|
|
||||||
|
#include "src/core/lib/matchers/matchers.h" |
||||||
|
#include "src/core/lib/security/authorization/evaluate_args.h" |
||||||
|
#include "src/core/lib/security/authorization/rbac_policy.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
// Describes the rules for matching permission or principal.
|
||||||
|
class AuthorizationMatcher { |
||||||
|
public: |
||||||
|
virtual ~AuthorizationMatcher() = default; |
||||||
|
|
||||||
|
// Returns whether or not the permission/principal matches the rules of the
|
||||||
|
// matcher.
|
||||||
|
virtual bool Matches(const EvaluateArgs& args) const = 0; |
||||||
|
|
||||||
|
// Creates an instance of a matcher based off the rules defined in Permission
|
||||||
|
// config.
|
||||||
|
static std::unique_ptr<AuthorizationMatcher> Create( |
||||||
|
Rbac::Permission permission); |
||||||
|
|
||||||
|
// Creates an instance of a matcher based off the rules defined in Principal
|
||||||
|
// config.
|
||||||
|
static std::unique_ptr<AuthorizationMatcher> Create( |
||||||
|
Rbac::Principal principal); |
||||||
|
}; |
||||||
|
|
||||||
|
class AlwaysAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AlwaysAuthorizationMatcher(bool not_rule = false) |
||||||
|
: not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override { return !not_rule_; } |
||||||
|
|
||||||
|
private: |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
class AndAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, |
||||||
|
bool not_rule = false); |
||||||
|
explicit AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule = false); |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
class OrAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, |
||||||
|
bool not_rule = false); |
||||||
|
explicit OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule = false); |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// TODO(ashithasantosh): Add matcher implementation for metadata field.
|
||||||
|
|
||||||
|
// Perform a match against HTTP headers.
|
||||||
|
class HeaderAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit HeaderAuthorizationMatcher(HeaderMatcher matcher, |
||||||
|
bool not_rule = false) |
||||||
|
: matcher_(std::move(matcher)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const HeaderMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against IP Cidr Range.
|
||||||
|
// TODO(ashithasantosh): Handle type of Ip or use seperate matchers for each
|
||||||
|
// type. Implement Match functionality, this would require updating EvaluateArgs
|
||||||
|
// getters, to return format of IP as well.
|
||||||
|
class IpAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit IpAuthorizationMatcher(Rbac::CidrRange range, bool not_rule = false) |
||||||
|
: range_(std::move(range)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const Rbac::CidrRange range_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against port number of the destination (local) address.
|
||||||
|
class PortAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PortAuthorizationMatcher(int port, bool not_rule = false) |
||||||
|
: port_(port), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const int port_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Matches the principal name as described in the peer certificate. Uses URI SAN
|
||||||
|
// or DNS SAN in that order, otherwise uses subject field.
|
||||||
|
class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AuthenticatedAuthorizationMatcher(StringMatcher auth, |
||||||
|
bool not_rule = false) |
||||||
|
: matcher_(std::move(auth)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against the request server from the client's connection
|
||||||
|
// request. This is typically TLS SNI. Currently unsupported.
|
||||||
|
class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit ReqServerNameAuthorizationMatcher( |
||||||
|
StringMatcher requested_server_name, bool not_rule = false) |
||||||
|
: matcher_(std::move(requested_server_name)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against the path header of HTTP request.
|
||||||
|
class PathAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PathAuthorizationMatcher(StringMatcher path, bool not_rule = false) |
||||||
|
: matcher_(std::move(path)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Performs a match for policy field in RBAC, which is a collection of
|
||||||
|
// permission and principal matchers. Policy matches iff, we find a match in one
|
||||||
|
// of its permissions and a match in one of its principals.
|
||||||
|
class PolicyAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PolicyAuthorizationMatcher(Rbac::Policy policy) |
||||||
|
: permissions_( |
||||||
|
AuthorizationMatcher::Create(std::move(policy.permissions))), |
||||||
|
principals_( |
||||||
|
AuthorizationMatcher::Create(std::move(policy.principals))) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::unique_ptr<AuthorizationMatcher> permissions_; |
||||||
|
std::unique_ptr<AuthorizationMatcher> principals_; |
||||||
|
}; |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
#endif // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
|
||||||
@ -0,0 +1,454 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include <list> |
||||||
|
|
||||||
|
#include <gmock/gmock.h> |
||||||
|
#include <gtest/gtest.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/authorization/evaluate_args.h" |
||||||
|
#include "src/core/lib/security/authorization/matchers.h" |
||||||
|
#include "test/core/util/mock_eval_args_endpoint.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
class AuthorizationMatchersTest : public ::testing::Test { |
||||||
|
protected: |
||||||
|
void SetUp() override { grpc_metadata_batch_init(&metadata_); } |
||||||
|
|
||||||
|
void TearDown() override { grpc_metadata_batch_destroy(&metadata_); } |
||||||
|
|
||||||
|
void AddPairToMetadata(const char* key, const char* value) { |
||||||
|
metadata_storage_.emplace_back(); |
||||||
|
auto& storage = metadata_storage_.back(); |
||||||
|
ASSERT_EQ(grpc_metadata_batch_add_tail( |
||||||
|
&metadata_, &storage, |
||||||
|
grpc_mdelem_from_slices( |
||||||
|
grpc_slice_intern(grpc_slice_from_static_string(key)), |
||||||
|
grpc_slice_intern(grpc_slice_from_static_string(value)))), |
||||||
|
GRPC_ERROR_NONE); |
||||||
|
} |
||||||
|
|
||||||
|
void SetLocalEndpoint(absl::string_view local_uri) { |
||||||
|
endpoint_.SetLocalAddress(local_uri); |
||||||
|
} |
||||||
|
|
||||||
|
void SetPeerEndpoint(absl::string_view peer_uri) { |
||||||
|
endpoint_.SetPeer(peer_uri); |
||||||
|
} |
||||||
|
|
||||||
|
void AddPropertyToAuthContext(const char* name, const char* value) { |
||||||
|
auth_context_.add_cstring_property(name, value); |
||||||
|
} |
||||||
|
|
||||||
|
EvaluateArgs MakeEvaluateArgs() { |
||||||
|
return EvaluateArgs(&metadata_, &auth_context_, &endpoint_); |
||||||
|
} |
||||||
|
|
||||||
|
std::list<grpc_linked_mdelem> metadata_storage_; |
||||||
|
grpc_metadata_batch metadata_; |
||||||
|
MockEvalArgsEndpoint endpoint_{/*local_uri=*/"", /*peer_uri=*/""}; |
||||||
|
grpc_auth_context auth_context_{nullptr}; |
||||||
|
}; |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AlwaysAuthorizationMatcher) { |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AlwaysAuthorizationMatcher matcher; |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAlwaysAuthorizationMatcher) { |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AlwaysAuthorizationMatcher matcher(/*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AndAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata("foo", "bar"); |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
AndAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AndAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata("foo", "not_bar"); |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
AndAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Header rule fails. Expected value "bar", got "not_bar" for key "foo".
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAndAuthorizationMatcher) { |
||||||
|
AddPairToMetadata(":path", "/expected/foo"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
StringMatcher string_matcher = |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"/expected/foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> ids; |
||||||
|
ids.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::PATH, std::move(string_matcher))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(ids), /*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, OrAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata("foo", "bar"); |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderMatcher header_matcher = |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, header_matcher)); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/456)); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Matches as header rule matches even though port rule fails.
|
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, OrAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata("foo", "not_bar"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Header rule fails. Expected value "bar", got "not_bar" for key "foo".
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotOrAuthorizationMatcher) { |
||||||
|
AddPairToMetadata("foo", "not_bar"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules), /*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HybridAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata("foo", "bar"); |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_and_rules; |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_or_rules; |
||||||
|
sub_or_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> and_rules; |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::AND, std::move(sub_and_rules))); |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::OR, std::move(std::move(sub_or_rules)))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(and_rules)); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HybridAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata("foo", "bar"); |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_and_rules; |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"absent_key", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"some_value") |
||||||
|
.value())); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_or_rules; |
||||||
|
sub_or_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> and_rules; |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::AND, std::move(sub_and_rules))); |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::OR, std::move(std::move(sub_or_rules)))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(and_rules)); |
||||||
|
// Fails as "absent_key" header was not present.
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PathAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata(":path", "expected/path"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PathAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata(":path", "different/path"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotPathAuthorizationMatcher) { |
||||||
|
AddPairToMetadata(":path", "expected/path"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, "expected/path", false) |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
PathAuthorizationMatcherFailedMatchMissingPath) { |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HeaderAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata("key123", "foo_xxx"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::PREFIX, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HeaderAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
HeaderAuthorizationMatcherFailedMatchMultivaluedHeader) { |
||||||
|
AddPairToMetadata("key123", "foo"); |
||||||
|
AddPairToMetadata("key123", "bar"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
HeaderAuthorizationMatcherFailedMatchMissingHeader) { |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::SUFFIX, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotHeaderAuthorizationMatcher) { |
||||||
|
AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PortAuthorizationMatcherSuccessfulMatch) { |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/123); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PortAuthorizationMatcherFailedMatch) { |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/456); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotPortAuthorizationMatcher) { |
||||||
|
SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/123, /*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherUnAuthenticatedConnection) { |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo.com", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherAuthenticatedConnectionMatcherUnset) { |
||||||
|
AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherSuccessfulSpiffeIdMatches) { |
||||||
|
AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
AddPropertyToAuthContext(GRPC_PEER_SPIFFE_ID_PROPERTY_NAME, |
||||||
|
"spiffe://foo.abc"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"spiffe://foo.abc", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherFailedSpiffeIdMatches) { |
||||||
|
AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
AddPropertyToAuthContext(GRPC_PEER_SPIFFE_ID_PROPERTY_NAME, |
||||||
|
"spiffe://bar.abc"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"spiffe://foo.abc", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherFailedNothingMatches) { |
||||||
|
AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAuthenticatedMatcher) { |
||||||
|
AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, /*matcher=*/"foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PolicyAuthorizationMatcherSuccessfulMatch) { |
||||||
|
AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value())); |
||||||
|
PolicyAuthorizationMatcher matcher(Rbac::Policy( |
||||||
|
Rbac::Permission(Rbac::Permission::RuleType::OR, std::move(rules)), |
||||||
|
Rbac::Principal(Rbac::Principal::RuleType::ANY))); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PolicyAuthorizationMatcherFailedMatch) { |
||||||
|
AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
PolicyAuthorizationMatcher matcher(Rbac::Policy( |
||||||
|
Rbac::Permission(Rbac::Permission::RuleType::OR, std::move(rules)), |
||||||
|
Rbac::Principal(Rbac::Principal::RuleType::ANY))); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
int main(int argc, char** argv) { |
||||||
|
::testing::InitGoogleTest(&argc, argv); |
||||||
|
grpc_init(); |
||||||
|
int ret = RUN_ALL_TESTS(); |
||||||
|
grpc_shutdown(); |
||||||
|
return ret; |
||||||
|
} |
||||||
@ -1,119 +0,0 @@ |
|||||||
// Copyright 2020 gRPC authors.
|
|
||||||
//
|
|
||||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
// you may not use this file except in compliance with the License.
|
|
||||||
// You may obtain a copy of the License at
|
|
||||||
//
|
|
||||||
// http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
//
|
|
||||||
// Unless required by applicable law or agreed to in writing, software
|
|
||||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
// See the License for the specific language governing permissions and
|
|
||||||
// limitations under the License.
|
|
||||||
|
|
||||||
#include <grpc/support/port_platform.h> |
|
||||||
|
|
||||||
#include "test/core/util/eval_args_mock_endpoint.h" |
|
||||||
|
|
||||||
#include <inttypes.h> |
|
||||||
|
|
||||||
#include <string> |
|
||||||
|
|
||||||
#include "absl/strings/str_format.h" |
|
||||||
|
|
||||||
#include <grpc/support/alloc.h> |
|
||||||
#include <grpc/support/string_util.h> |
|
||||||
#include "src/core/lib/iomgr/sockaddr.h" |
|
||||||
#include "src/core/lib/iomgr/sockaddr_utils.h" |
|
||||||
|
|
||||||
namespace grpc_core { |
|
||||||
|
|
||||||
class EvalArgsMockEndpoint { |
|
||||||
public: |
|
||||||
EvalArgsMockEndpoint(absl::string_view local_uri, absl::string_view peer_uri) |
|
||||||
: local_address_(local_uri), peer_(peer_uri) { |
|
||||||
base_.vtable = &vtable_; |
|
||||||
} |
|
||||||
grpc_endpoint* base() const { return const_cast<grpc_endpoint*>(&base_); } |
|
||||||
static void Read(grpc_endpoint* /*ep*/, grpc_slice_buffer* /*slices*/, |
|
||||||
grpc_closure* /*cb*/, bool /*unused*/) {} |
|
||||||
static void Write(grpc_endpoint* /*ep*/, grpc_slice_buffer* /*slices*/, |
|
||||||
grpc_closure* /*cb*/, void* /*unused*/) {} |
|
||||||
static void AddToPollset(grpc_endpoint* /*ep*/, grpc_pollset* /*unused*/) {} |
|
||||||
static void AddToPollsetSet(grpc_endpoint* /*ep*/, |
|
||||||
grpc_pollset_set* /*unused*/) {} |
|
||||||
static void DeleteFromPollsetSet(grpc_endpoint* /*ep*/, |
|
||||||
grpc_pollset_set* /*unused*/) {} |
|
||||||
static void Shutdown(grpc_endpoint* /*ep*/, grpc_error* /*why*/) {} |
|
||||||
static void Destroy(grpc_endpoint* ep) { |
|
||||||
EvalArgsMockEndpoint* m = reinterpret_cast<EvalArgsMockEndpoint*>(ep); |
|
||||||
delete m; |
|
||||||
} |
|
||||||
|
|
||||||
static absl::string_view GetPeer(grpc_endpoint* ep) { |
|
||||||
EvalArgsMockEndpoint* m = reinterpret_cast<EvalArgsMockEndpoint*>(ep); |
|
||||||
return m->peer_; |
|
||||||
} |
|
||||||
|
|
||||||
static absl::string_view GetLocalAddress(grpc_endpoint* ep) { |
|
||||||
EvalArgsMockEndpoint* m = reinterpret_cast<EvalArgsMockEndpoint*>(ep); |
|
||||||
return m->local_address_; |
|
||||||
} |
|
||||||
|
|
||||||
static grpc_resource_user* GetResourceUser(grpc_endpoint* /*ep*/) { |
|
||||||
return nullptr; |
|
||||||
} |
|
||||||
|
|
||||||
static int GetFd(grpc_endpoint* /*unused*/) { return -1; } |
|
||||||
static bool CanTrackErr(grpc_endpoint* /*unused*/) { return false; } |
|
||||||
|
|
||||||
private: |
|
||||||
static constexpr grpc_endpoint_vtable vtable_ = { |
|
||||||
EvalArgsMockEndpoint::Read, |
|
||||||
EvalArgsMockEndpoint::Write, |
|
||||||
EvalArgsMockEndpoint::AddToPollset, |
|
||||||
EvalArgsMockEndpoint::AddToPollsetSet, |
|
||||||
EvalArgsMockEndpoint::DeleteFromPollsetSet, |
|
||||||
EvalArgsMockEndpoint::Shutdown, |
|
||||||
EvalArgsMockEndpoint::Destroy, |
|
||||||
EvalArgsMockEndpoint::GetResourceUser, |
|
||||||
EvalArgsMockEndpoint::GetPeer, |
|
||||||
EvalArgsMockEndpoint::GetLocalAddress, |
|
||||||
EvalArgsMockEndpoint::GetFd, |
|
||||||
EvalArgsMockEndpoint::CanTrackErr}; |
|
||||||
grpc_endpoint base_; |
|
||||||
std::string local_address_; |
|
||||||
std::string peer_; |
|
||||||
}; |
|
||||||
|
|
||||||
constexpr grpc_endpoint_vtable EvalArgsMockEndpoint::vtable_; |
|
||||||
|
|
||||||
namespace { |
|
||||||
|
|
||||||
std::string NameAndPortToURI(const char* addr, const int port) { |
|
||||||
grpc_sockaddr_in address; |
|
||||||
memset(&address, 0, sizeof(address)); |
|
||||||
address.sin_family = AF_INET; |
|
||||||
address.sin_port = htons(port); |
|
||||||
inet_pton(AF_INET, addr, &address.sin_addr); |
|
||||||
grpc_resolved_address resolved; |
|
||||||
memset(&resolved, 0, sizeof(resolved)); |
|
||||||
memcpy(resolved.addr, &address, sizeof(address)); |
|
||||||
resolved.len = sizeof(address); |
|
||||||
return grpc_sockaddr_to_uri(&resolved); |
|
||||||
} |
|
||||||
|
|
||||||
} // namespace
|
|
||||||
|
|
||||||
grpc_endpoint* CreateEvalArgsMockEndpoint(const char* local_address, |
|
||||||
const int local_port, |
|
||||||
const char* peer_address, |
|
||||||
const int peer_port) { |
|
||||||
EvalArgsMockEndpoint* m = |
|
||||||
new EvalArgsMockEndpoint(NameAndPortToURI(local_address, local_port), |
|
||||||
NameAndPortToURI(peer_address, peer_port)); |
|
||||||
return m->base(); |
|
||||||
} |
|
||||||
|
|
||||||
} // namespace grpc_core
|
|
||||||
@ -1,31 +0,0 @@ |
|||||||
// Copyright 2020 gRPC authors.
|
|
||||||
//
|
|
||||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
// you may not use this file except in compliance with the License.
|
|
||||||
// You may obtain a copy of the License at
|
|
||||||
//
|
|
||||||
// http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
//
|
|
||||||
// Unless required by applicable law or agreed to in writing, software
|
|
||||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
// See the License for the specific language governing permissions and
|
|
||||||
// limitations under the License.
|
|
||||||
|
|
||||||
#ifndef GRPC_TEST_CORE_UTIL_EVAL_ARGS_MOCK_ENDPOINT_H |
|
||||||
#define GRPC_TEST_CORE_UTIL_EVAL_ARGS_MOCK_ENDPOINT_H |
|
||||||
|
|
||||||
#include <grpc/support/port_platform.h> |
|
||||||
|
|
||||||
#include "src/core/lib/iomgr/endpoint.h" |
|
||||||
|
|
||||||
namespace grpc_core { |
|
||||||
|
|
||||||
grpc_endpoint* CreateEvalArgsMockEndpoint(const char* local_address, |
|
||||||
const int local_port, |
|
||||||
const char* peer_address, |
|
||||||
const int peer_port); |
|
||||||
|
|
||||||
} // namespace grpc_core
|
|
||||||
|
|
||||||
#endif // GRPC_TEST_CORE_UTIL_EVAL_ARGS_MOCK_ENDPOINT_H
|
|
||||||
@ -0,0 +1,59 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#ifndef GRPC_TEST_CORE_UTIL_MOCK_EVAL_ARGS_ENDPOINT_H |
||||||
|
#define GRPC_TEST_CORE_UTIL_MOCK_EVAL_ARGS_ENDPOINT_H |
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include "src/core/lib/iomgr/endpoint.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
class MockEvalArgsEndpoint : public grpc_endpoint { |
||||||
|
public: |
||||||
|
MockEvalArgsEndpoint(absl::string_view local_uri, absl::string_view peer_uri) |
||||||
|
: local_address_(local_uri), peer_address_(peer_uri) { |
||||||
|
static constexpr grpc_endpoint_vtable vtable = { |
||||||
|
nullptr, nullptr, nullptr, nullptr, nullptr, nullptr, |
||||||
|
nullptr, nullptr, GetPeer, GetLocalAddress, nullptr, nullptr}; |
||||||
|
grpc_endpoint::vtable = &vtable; |
||||||
|
} |
||||||
|
|
||||||
|
static absl::string_view GetPeer(grpc_endpoint* ep) { |
||||||
|
MockEvalArgsEndpoint* m = reinterpret_cast<MockEvalArgsEndpoint*>(ep); |
||||||
|
return m->peer_address_; |
||||||
|
} |
||||||
|
|
||||||
|
static absl::string_view GetLocalAddress(grpc_endpoint* ep) { |
||||||
|
MockEvalArgsEndpoint* m = reinterpret_cast<MockEvalArgsEndpoint*>(ep); |
||||||
|
return m->local_address_; |
||||||
|
} |
||||||
|
|
||||||
|
void SetPeer(absl::string_view peer_address) { |
||||||
|
peer_address_ = std::string(peer_address); |
||||||
|
} |
||||||
|
|
||||||
|
void SetLocalAddress(absl::string_view local_address) { |
||||||
|
local_address_ = std::string(local_address); |
||||||
|
} |
||||||
|
|
||||||
|
private: |
||||||
|
std::string local_address_; |
||||||
|
std::string peer_address_; |
||||||
|
}; |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
#endif // GRPC_TEST_CORE_UTIL_MOCK_EVAL_ARGS_ENDPOINT_H
|
||||||
Loading…
Reference in new issue