|
|
|
@ -219,10 +219,10 @@ RbacConfig::RbacPolicy::Rules::Policy::CidrRange::JsonLoader(const JsonArgs&) { |
|
|
|
|
void RbacConfig::RbacPolicy::Rules::Policy::CidrRange::JsonPostLoad( |
|
|
|
|
const Json& json, const JsonArgs& args, ValidationErrors* errors) { |
|
|
|
|
auto address_prefix = LoadJsonObjectField<std::string>( |
|
|
|
|
json.object_value(), args, "addressPrefix", errors); |
|
|
|
|
auto prefix_len = LoadJsonObjectField<uint32_t>(json.object_value(), args, |
|
|
|
|
"prefixLen", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
json.object(), args, "addressPrefix", errors); |
|
|
|
|
auto prefix_len = |
|
|
|
|
LoadJsonObjectField<uint32_t>(json.object(), args, "prefixLen", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
cidr_range = |
|
|
|
|
Rbac::CidrRange(address_prefix.value_or(""), prefix_len.value_or(0)); |
|
|
|
|
} |
|
|
|
@ -269,13 +269,13 @@ RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonLoader( |
|
|
|
|
void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad( |
|
|
|
|
const Json& json, const JsonArgs& args, ValidationErrors* errors) { |
|
|
|
|
const size_t original_error_size = errors->size(); |
|
|
|
|
std::string name = LoadJsonObjectField<std::string>(json.object_value(), args, |
|
|
|
|
"name", errors) |
|
|
|
|
.value_or(""); |
|
|
|
|
bool invert_match = LoadJsonObjectField<bool>(json.object_value(), args, |
|
|
|
|
"invertMatch", errors, |
|
|
|
|
/*required=*/false) |
|
|
|
|
.value_or(false); |
|
|
|
|
std::string name = |
|
|
|
|
LoadJsonObjectField<std::string>(json.object(), args, "name", errors) |
|
|
|
|
.value_or(""); |
|
|
|
|
bool invert_match = |
|
|
|
|
LoadJsonObjectField<bool>(json.object(), args, "invertMatch", errors, |
|
|
|
|
/*required=*/false) |
|
|
|
|
.value_or(false); |
|
|
|
|
auto set_header_matcher = [&](absl::StatusOr<HeaderMatcher> header_matcher) { |
|
|
|
|
if (header_matcher.ok()) { |
|
|
|
|
matcher = *header_matcher; |
|
|
|
@ -285,7 +285,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad( |
|
|
|
|
}; |
|
|
|
|
auto check_match = [&](absl::string_view field_name, |
|
|
|
|
HeaderMatcher::Type type) { |
|
|
|
|
auto match = LoadJsonObjectField<std::string>(json.object_value(), args, |
|
|
|
|
auto match = LoadJsonObjectField<std::string>(json.object(), args, |
|
|
|
|
field_name, errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (match.has_value()) { |
|
|
|
@ -301,9 +301,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad( |
|
|
|
|
check_match("containsMatch", HeaderMatcher::Type::kContains)) { |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto present_match = LoadJsonObjectField<bool>(json.object_value(), args, |
|
|
|
|
"presentMatch", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto present_match = |
|
|
|
|
LoadJsonObjectField<bool>(json.object(), args, "presentMatch", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (present_match.has_value()) { |
|
|
|
|
set_header_matcher( |
|
|
|
|
HeaderMatcher::Create(name, HeaderMatcher::Type::kPresent, "", 0, 0, |
|
|
|
@ -311,7 +311,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad( |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto regex_match = LoadJsonObjectField<SafeRegexMatch>( |
|
|
|
|
json.object_value(), args, "safeRegexMatch", errors, |
|
|
|
|
json.object(), args, "safeRegexMatch", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (regex_match.has_value()) { |
|
|
|
|
set_header_matcher( |
|
|
|
@ -319,9 +319,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::HeaderMatch::JsonPostLoad( |
|
|
|
|
regex_match->regex, 0, 0, false, invert_match)); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto range_match = LoadJsonObjectField<RangeMatch>(json.object_value(), args, |
|
|
|
|
"rangeMatch", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto range_match = |
|
|
|
|
LoadJsonObjectField<RangeMatch>(json.object(), args, "rangeMatch", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (range_match.has_value()) { |
|
|
|
|
set_header_matcher(HeaderMatcher::Create(name, HeaderMatcher::Type::kRange, |
|
|
|
|
"", range_match->start, |
|
|
|
@ -349,7 +349,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad( |
|
|
|
|
const Json& json, const JsonArgs& args, ValidationErrors* errors) { |
|
|
|
|
const size_t original_error_size = errors->size(); |
|
|
|
|
bool ignore_case = |
|
|
|
|
LoadJsonObjectField<bool>(json.object_value(), args, "ignoreCase", errors, |
|
|
|
|
LoadJsonObjectField<bool>(json.object(), args, "ignoreCase", errors, |
|
|
|
|
/*required=*/false) |
|
|
|
|
.value_or(false); |
|
|
|
|
auto set_string_matcher = [&](absl::StatusOr<StringMatcher> string_matcher) { |
|
|
|
@ -361,7 +361,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad( |
|
|
|
|
}; |
|
|
|
|
auto check_match = [&](absl::string_view field_name, |
|
|
|
|
StringMatcher::Type type) { |
|
|
|
|
auto match = LoadJsonObjectField<std::string>(json.object_value(), args, |
|
|
|
|
auto match = LoadJsonObjectField<std::string>(json.object(), args, |
|
|
|
|
field_name, errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (match.has_value()) { |
|
|
|
@ -376,9 +376,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::StringMatch::JsonPostLoad( |
|
|
|
|
check_match("contains", StringMatcher::Type::kContains)) { |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto regex_match = LoadJsonObjectField<SafeRegexMatch>( |
|
|
|
|
json.object_value(), args, "safeRegex", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto regex_match = LoadJsonObjectField<SafeRegexMatch>(json.object(), args, |
|
|
|
|
"safeRegex", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (regex_match.has_value()) { |
|
|
|
|
set_string_matcher(StringMatcher::Create(StringMatcher::Type::kSafeRegex, |
|
|
|
|
regex_match->regex, ignore_case)); |
|
|
|
@ -450,32 +450,32 @@ RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonLoader(const JsonArgs&) { |
|
|
|
|
void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad( |
|
|
|
|
const Json& json, const JsonArgs& args, ValidationErrors* errors) { |
|
|
|
|
const size_t original_error_size = errors->size(); |
|
|
|
|
auto any = LoadJsonObjectField<bool>(json.object_value(), args, "any", errors, |
|
|
|
|
auto any = LoadJsonObjectField<bool>(json.object(), args, "any", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (any.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeAnyPermission()); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto header = LoadJsonObjectField<HeaderMatch>(json.object_value(), args, |
|
|
|
|
"header", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto header = |
|
|
|
|
LoadJsonObjectField<HeaderMatch>(json.object(), args, "header", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (header.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeHeaderPermission(std::move(header->matcher))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto url_path = LoadJsonObjectField<PathMatch>(json.object_value(), args, |
|
|
|
|
"urlPath", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto url_path = |
|
|
|
|
LoadJsonObjectField<PathMatch>(json.object(), args, "urlPath", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (url_path.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakePathPermission(url_path->path.matcher)); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto destination_ip = LoadJsonObjectField<CidrRange>( |
|
|
|
|
json.object_value(), args, "destinationIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto destination_ip = LoadJsonObjectField<CidrRange>(json.object(), args, |
|
|
|
|
"destinationIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (destination_ip.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeDestIpPermission( |
|
|
|
@ -483,23 +483,23 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad( |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto destination_port = LoadJsonObjectField<uint32_t>( |
|
|
|
|
json.object_value(), args, "destinationPort", errors, |
|
|
|
|
json.object(), args, "destinationPort", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (destination_port.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeDestPortPermission(*destination_port)); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto metadata = LoadJsonObjectField<Metadata>(json.object_value(), args, |
|
|
|
|
"metadata", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto metadata = |
|
|
|
|
LoadJsonObjectField<Metadata>(json.object(), args, "metadata", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (metadata.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeMetadataPermission(metadata->invert)); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto requested_server_name = LoadJsonObjectField<StringMatch>( |
|
|
|
|
json.object_value(), args, "requestedServerName", errors, |
|
|
|
|
json.object(), args, "requestedServerName", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (requested_server_name.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
@ -507,7 +507,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad( |
|
|
|
|
std::move(requested_server_name->matcher))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto rules = LoadJsonObjectField<PermissionList>(json.object_value(), args, |
|
|
|
|
auto rules = LoadJsonObjectField<PermissionList>(json.object(), args, |
|
|
|
|
"andRules", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (rules.has_value()) { |
|
|
|
@ -516,8 +516,8 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad( |
|
|
|
|
MakeRbacPermissionList(std::move(rules->rules)))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
rules = LoadJsonObjectField<PermissionList>(json.object_value(), args, |
|
|
|
|
"orRules", errors, |
|
|
|
|
rules = LoadJsonObjectField<PermissionList>(json.object(), args, "orRules", |
|
|
|
|
errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (rules.has_value()) { |
|
|
|
|
permission = |
|
|
|
@ -525,9 +525,9 @@ void RbacConfig::RbacPolicy::Rules::Policy::Permission::JsonPostLoad( |
|
|
|
|
MakeRbacPermissionList(std::move(rules->rules)))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto not_rule = LoadJsonObjectField<Permission>(json.object_value(), args, |
|
|
|
|
"notRule", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto not_rule = |
|
|
|
|
LoadJsonObjectField<Permission>(json.object(), args, "notRule", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (not_rule.has_value()) { |
|
|
|
|
permission = std::make_unique<Rbac::Permission>( |
|
|
|
|
Rbac::Permission::MakeNotPermission(std::move(*not_rule->permission))); |
|
|
|
@ -590,7 +590,7 @@ RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonLoader(const JsonArgs&) { |
|
|
|
|
void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad( |
|
|
|
|
const Json& json, const JsonArgs& args, ValidationErrors* errors) { |
|
|
|
|
const size_t original_error_size = errors->size(); |
|
|
|
|
auto any = LoadJsonObjectField<bool>(json.object_value(), args, "any", errors, |
|
|
|
|
auto any = LoadJsonObjectField<bool>(json.object(), args, "any", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (any.has_value()) { |
|
|
|
|
principal = |
|
|
|
@ -598,7 +598,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad( |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto authenticated = LoadJsonObjectField<Authenticated>( |
|
|
|
|
json.object_value(), args, "authenticated", errors, |
|
|
|
|
json.object(), args, "authenticated", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (authenticated.has_value()) { |
|
|
|
|
if (authenticated->principal_name.has_value()) { |
|
|
|
@ -612,16 +612,16 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad( |
|
|
|
|
} |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args, |
|
|
|
|
"sourceIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto cidr_range = |
|
|
|
|
LoadJsonObjectField<CidrRange>(json.object(), args, "sourceIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (cidr_range.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|
Rbac::Principal::MakeSourceIpPrincipal( |
|
|
|
|
std::move(cidr_range->cidr_range))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args, |
|
|
|
|
cidr_range = LoadJsonObjectField<CidrRange>(json.object(), args, |
|
|
|
|
"directRemoteIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (cidr_range.has_value()) { |
|
|
|
@ -630,50 +630,49 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad( |
|
|
|
|
std::move(cidr_range->cidr_range))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
cidr_range = LoadJsonObjectField<CidrRange>(json.object_value(), args, |
|
|
|
|
"remoteIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
cidr_range = |
|
|
|
|
LoadJsonObjectField<CidrRange>(json.object(), args, "remoteIp", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (cidr_range.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|
Rbac::Principal::MakeRemoteIpPrincipal( |
|
|
|
|
std::move(cidr_range->cidr_range))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto header = LoadJsonObjectField<HeaderMatch>(json.object_value(), args, |
|
|
|
|
"header", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto header = |
|
|
|
|
LoadJsonObjectField<HeaderMatch>(json.object(), args, "header", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (header.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|
Rbac::Principal::MakeHeaderPrincipal(std::move(header->matcher))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto url_path = LoadJsonObjectField<PathMatch>(json.object_value(), args, |
|
|
|
|
"urlPath", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto url_path = |
|
|
|
|
LoadJsonObjectField<PathMatch>(json.object(), args, "urlPath", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (url_path.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|
Rbac::Principal::MakePathPrincipal(std::move(url_path->path.matcher))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto metadata = LoadJsonObjectField<Metadata>(json.object_value(), args, |
|
|
|
|
"metadata", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto metadata = |
|
|
|
|
LoadJsonObjectField<Metadata>(json.object(), args, "metadata", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (metadata.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|
Rbac::Principal::MakeMetadataPrincipal(metadata->invert)); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto ids = LoadJsonObjectField<PrincipalList>(json.object_value(), args, |
|
|
|
|
"andIds", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
auto ids = |
|
|
|
|
LoadJsonObjectField<PrincipalList>(json.object(), args, "andIds", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (ids.has_value()) { |
|
|
|
|
principal = |
|
|
|
|
std::make_unique<Rbac::Principal>(Rbac::Principal::MakeAndPrincipal( |
|
|
|
|
MakeRbacPrincipalList(std::move(ids->ids)))); |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
ids = LoadJsonObjectField<PrincipalList>(json.object_value(), args, "orIds", |
|
|
|
|
errors, |
|
|
|
|
ids = LoadJsonObjectField<PrincipalList>(json.object(), args, "orIds", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (ids.has_value()) { |
|
|
|
|
principal = |
|
|
|
@ -682,7 +681,7 @@ void RbacConfig::RbacPolicy::Rules::Policy::Principal::JsonPostLoad( |
|
|
|
|
return; |
|
|
|
|
} |
|
|
|
|
auto not_rule = |
|
|
|
|
LoadJsonObjectField<Principal>(json.object_value(), args, "notId", errors, |
|
|
|
|
LoadJsonObjectField<Principal>(json.object(), args, "notId", errors, |
|
|
|
|
/*required=*/false); |
|
|
|
|
if (not_rule.has_value()) { |
|
|
|
|
principal = std::make_unique<Rbac::Principal>( |
|
|
|
|