mirror of https://github.com/grpc/grpc.git
RBAC engine matchers implementation. (#25997)
Ashitha Santhosh
4 years ago
committed by
GitHub
parent
d4f6cfd535
commit
628bf7fe08
11 changed files with 993 additions and 63 deletions
@ -0,0 +1,202 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/authorization/matchers.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
namespace { |
||||||
|
|
||||||
|
bool AuthenticatedMatchesHelper(const EvaluateArgs& args, |
||||||
|
const StringMatcher& matcher) { |
||||||
|
if (args.GetTransportSecurityType() != GRPC_SSL_TRANSPORT_SECURITY_TYPE) { |
||||||
|
// Connection is not authenticated.
|
||||||
|
return false; |
||||||
|
} |
||||||
|
if (matcher.string_matcher().empty()) { |
||||||
|
// Allows any authenticated user.
|
||||||
|
return true; |
||||||
|
} |
||||||
|
absl::string_view spiffe_id = args.GetSpiffeId(); |
||||||
|
if (!spiffe_id.empty()) { |
||||||
|
return matcher.Match(spiffe_id); |
||||||
|
} |
||||||
|
// TODO(ashithasantosh): Check principal matches DNS SAN, followed by Subject
|
||||||
|
// field from certificate. This requires updating tsi_peer to expose these
|
||||||
|
// fields.
|
||||||
|
return false; |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace
|
||||||
|
|
||||||
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create( |
||||||
|
Rbac::Permission permission) { |
||||||
|
switch (permission.type) { |
||||||
|
case Rbac::Permission::RuleType::AND: |
||||||
|
return absl::make_unique<AndAuthorizationMatcher>( |
||||||
|
std::move(permission.permissions), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::OR: |
||||||
|
return absl::make_unique<OrAuthorizationMatcher>( |
||||||
|
std::move(permission.permissions), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::ANY: |
||||||
|
return absl::make_unique<AlwaysAuthorizationMatcher>(permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::HEADER: |
||||||
|
return absl::make_unique<HeaderAuthorizationMatcher>( |
||||||
|
std::move(permission.header_matcher), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::PATH: |
||||||
|
return absl::make_unique<PathAuthorizationMatcher>( |
||||||
|
std::move(permission.string_matcher), permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::DEST_IP: |
||||||
|
return absl::make_unique<IpAuthorizationMatcher>(std::move(permission.ip), |
||||||
|
permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::DEST_PORT: |
||||||
|
return absl::make_unique<PortAuthorizationMatcher>(permission.port, |
||||||
|
permission.not_rule); |
||||||
|
case Rbac::Permission::RuleType::REQ_SERVER_NAME: |
||||||
|
return absl::make_unique<ReqServerNameAuthorizationMatcher>( |
||||||
|
std::move(permission.string_matcher), permission.not_rule); |
||||||
|
} |
||||||
|
return nullptr; |
||||||
|
} |
||||||
|
|
||||||
|
std::unique_ptr<AuthorizationMatcher> AuthorizationMatcher::Create( |
||||||
|
Rbac::Principal principal) { |
||||||
|
switch (principal.type) { |
||||||
|
case Rbac::Principal::RuleType::AND: |
||||||
|
return absl::make_unique<AndAuthorizationMatcher>( |
||||||
|
std::move(principal.principals), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::OR: |
||||||
|
return absl::make_unique<OrAuthorizationMatcher>( |
||||||
|
std::move(principal.principals), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::ANY: |
||||||
|
return absl::make_unique<AlwaysAuthorizationMatcher>(principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::PRINCIPAL_NAME: |
||||||
|
return absl::make_unique<AuthenticatedAuthorizationMatcher>( |
||||||
|
std::move(principal.string_matcher), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::SOURCE_IP: |
||||||
|
case Rbac::Principal::RuleType::DIRECT_REMOTE_IP: |
||||||
|
case Rbac::Principal::RuleType::REMOTE_IP: |
||||||
|
return absl::make_unique<IpAuthorizationMatcher>(std::move(principal.ip), |
||||||
|
principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::HEADER: |
||||||
|
return absl::make_unique<HeaderAuthorizationMatcher>( |
||||||
|
std::move(principal.header_matcher), principal.not_rule); |
||||||
|
case Rbac::Principal::RuleType::PATH: |
||||||
|
return absl::make_unique<PathAuthorizationMatcher>( |
||||||
|
std::move(principal.string_matcher), principal.not_rule); |
||||||
|
} |
||||||
|
return nullptr; |
||||||
|
} |
||||||
|
|
||||||
|
AndAuthorizationMatcher::AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (auto& rule : rules) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*rule))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
AndAuthorizationMatcher::AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& id : ids) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*id))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
bool AndAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = true; |
||||||
|
for (const auto& matcher : matchers_) { |
||||||
|
if (!matcher->Matches(args)) { |
||||||
|
matches = false; |
||||||
|
break; |
||||||
|
} |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
OrAuthorizationMatcher::OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& rule : rules) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*rule))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
OrAuthorizationMatcher::OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule) |
||||||
|
: not_rule_(not_rule) { |
||||||
|
for (const auto& id : ids) { |
||||||
|
matchers_.push_back(AuthorizationMatcher::Create(std::move(*id))); |
||||||
|
} |
||||||
|
} |
||||||
|
|
||||||
|
bool OrAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = false; |
||||||
|
for (const auto& matcher : matchers_) { |
||||||
|
if (matcher->Matches(args)) { |
||||||
|
matches = true; |
||||||
|
break; |
||||||
|
} |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool HeaderAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
std::string concatenated_value; |
||||||
|
bool matches = |
||||||
|
matcher_.Match(args.GetHeaderValue(matcher_.name(), &concatenated_value)); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
// TODO(ashithasantosh): Implement IpAuthorizationMatcher::Matches.
|
||||||
|
bool IpAuthorizationMatcher::Matches(const EvaluateArgs&) const { |
||||||
|
bool matches = false; |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PortAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = (port_ == args.GetLocalPort()); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool AuthenticatedAuthorizationMatcher::Matches( |
||||||
|
const EvaluateArgs& args) const { |
||||||
|
bool matches = AuthenticatedMatchesHelper(args, matcher_); |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool ReqServerNameAuthorizationMatcher::Matches(const EvaluateArgs&) const { |
||||||
|
// Currently we do not support matching rules containing
|
||||||
|
// "requested_server_name".
|
||||||
|
bool matches = false; |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PathAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
bool matches = false; |
||||||
|
absl::string_view path = args.GetPath(); |
||||||
|
if (!path.empty()) { |
||||||
|
matches = matcher_.Match(path); |
||||||
|
} |
||||||
|
return matches != not_rule_; |
||||||
|
} |
||||||
|
|
||||||
|
bool PolicyAuthorizationMatcher::Matches(const EvaluateArgs& args) const { |
||||||
|
return permissions_->Matches(args) && principals_->Matches(args); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
@ -0,0 +1,206 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H |
||||||
|
#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H |
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include <memory> |
||||||
|
|
||||||
|
#include "src/core/lib/matchers/matchers.h" |
||||||
|
#include "src/core/lib/security/authorization/evaluate_args.h" |
||||||
|
#include "src/core/lib/security/authorization/rbac_policy.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
// Describes the rules for matching permission or principal.
|
||||||
|
class AuthorizationMatcher { |
||||||
|
public: |
||||||
|
virtual ~AuthorizationMatcher() = default; |
||||||
|
|
||||||
|
// Returns whether or not the permission/principal matches the rules of the
|
||||||
|
// matcher.
|
||||||
|
virtual bool Matches(const EvaluateArgs& args) const = 0; |
||||||
|
|
||||||
|
// Creates an instance of a matcher based off the rules defined in Permission
|
||||||
|
// config.
|
||||||
|
static std::unique_ptr<AuthorizationMatcher> Create( |
||||||
|
Rbac::Permission permission); |
||||||
|
|
||||||
|
// Creates an instance of a matcher based off the rules defined in Principal
|
||||||
|
// config.
|
||||||
|
static std::unique_ptr<AuthorizationMatcher> Create( |
||||||
|
Rbac::Principal principal); |
||||||
|
}; |
||||||
|
|
||||||
|
class AlwaysAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AlwaysAuthorizationMatcher(bool not_rule = false) |
||||||
|
: not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override { return !not_rule_; } |
||||||
|
|
||||||
|
private: |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
class AndAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, |
||||||
|
bool not_rule = false); |
||||||
|
explicit AndAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule = false); |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
class OrAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules, |
||||||
|
bool not_rule = false); |
||||||
|
explicit OrAuthorizationMatcher( |
||||||
|
std::vector<std::unique_ptr<Rbac::Principal>> ids, bool not_rule = false); |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::vector<std::unique_ptr<AuthorizationMatcher>> matchers_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// TODO(ashithasantosh): Add matcher implementation for metadata field.
|
||||||
|
|
||||||
|
// Perform a match against HTTP headers.
|
||||||
|
class HeaderAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit HeaderAuthorizationMatcher(HeaderMatcher matcher, |
||||||
|
bool not_rule = false) |
||||||
|
: matcher_(std::move(matcher)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const HeaderMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against IP Cidr Range.
|
||||||
|
// TODO(ashithasantosh): Handle type of Ip or use seperate matchers for each
|
||||||
|
// type. Implement Match functionality, this would require updating EvaluateArgs
|
||||||
|
// getters, to return format of IP as well.
|
||||||
|
class IpAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit IpAuthorizationMatcher(Rbac::CidrRange range, bool not_rule = false) |
||||||
|
: range_(std::move(range)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const Rbac::CidrRange range_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against port number of the destination (local) address.
|
||||||
|
class PortAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PortAuthorizationMatcher(int port, bool not_rule = false) |
||||||
|
: port_(port), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const int port_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Matches the principal name as described in the peer certificate. Uses URI SAN
|
||||||
|
// or DNS SAN in that order, otherwise uses subject field.
|
||||||
|
class AuthenticatedAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit AuthenticatedAuthorizationMatcher(StringMatcher auth, |
||||||
|
bool not_rule = false) |
||||||
|
: matcher_(std::move(auth)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against the request server from the client's connection
|
||||||
|
// request. This is typically TLS SNI. Currently unsupported.
|
||||||
|
class ReqServerNameAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit ReqServerNameAuthorizationMatcher( |
||||||
|
StringMatcher requested_server_name, bool not_rule = false) |
||||||
|
: matcher_(std::move(requested_server_name)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs&) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Perform a match against the path header of HTTP request.
|
||||||
|
class PathAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PathAuthorizationMatcher(StringMatcher path, bool not_rule = false) |
||||||
|
: matcher_(std::move(path)), not_rule_(not_rule) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
const StringMatcher matcher_; |
||||||
|
// Negates matching the provided permission/principal.
|
||||||
|
const bool not_rule_; |
||||||
|
}; |
||||||
|
|
||||||
|
// Performs a match for policy field in RBAC, which is a collection of
|
||||||
|
// permission and principal matchers. Policy matches iff, we find a match in one
|
||||||
|
// of its permissions and a match in one of its principals.
|
||||||
|
class PolicyAuthorizationMatcher : public AuthorizationMatcher { |
||||||
|
public: |
||||||
|
explicit PolicyAuthorizationMatcher(Rbac::Policy policy) |
||||||
|
: permissions_( |
||||||
|
AuthorizationMatcher::Create(std::move(policy.permissions))), |
||||||
|
principals_( |
||||||
|
AuthorizationMatcher::Create(std::move(policy.principals))) {} |
||||||
|
|
||||||
|
bool Matches(const EvaluateArgs& args) const override; |
||||||
|
|
||||||
|
private: |
||||||
|
std::unique_ptr<AuthorizationMatcher> permissions_; |
||||||
|
std::unique_ptr<AuthorizationMatcher> principals_; |
||||||
|
}; |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
#endif // GRPC_CORE_LIB_SECURITY_AUTHORIZATION_MATCHERS_H
|
||||||
@ -0,0 +1,420 @@ |
|||||||
|
// Copyright 2021 gRPC authors.
|
||||||
|
//
|
||||||
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
// you may not use this file except in compliance with the License.
|
||||||
|
// You may obtain a copy of the License at
|
||||||
|
//
|
||||||
|
// http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
//
|
||||||
|
// Unless required by applicable law or agreed to in writing, software
|
||||||
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
// See the License for the specific language governing permissions and
|
||||||
|
// limitations under the License.
|
||||||
|
|
||||||
|
#include <grpc/support/port_platform.h> |
||||||
|
|
||||||
|
#include <list> |
||||||
|
|
||||||
|
#include <gmock/gmock.h> |
||||||
|
#include <gtest/gtest.h> |
||||||
|
|
||||||
|
#include "src/core/lib/security/authorization/evaluate_args.h" |
||||||
|
#include "src/core/lib/security/authorization/matchers.h" |
||||||
|
#include "test/core/util/evaluate_args_test_util.h" |
||||||
|
|
||||||
|
namespace grpc_core { |
||||||
|
|
||||||
|
class AuthorizationMatchersTest : public ::testing::Test { |
||||||
|
protected: |
||||||
|
EvaluateArgsTestUtil args_; |
||||||
|
}; |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AlwaysAuthorizationMatcher) { |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AlwaysAuthorizationMatcher matcher; |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAlwaysAuthorizationMatcher) { |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AlwaysAuthorizationMatcher matcher(/*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AndAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "bar"); |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
AndAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AndAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "not_bar"); |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
AndAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Header rule fails. Expected value "bar", got "not_bar" for key "foo".
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAndAuthorizationMatcher) { |
||||||
|
args_.AddPairToMetadata(":path", "/expected/foo"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
StringMatcher string_matcher = |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"/expected/foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> ids; |
||||||
|
ids.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::PATH, std::move(string_matcher))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(ids), /*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, OrAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "bar"); |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderMatcher header_matcher = |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, header_matcher)); |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/456)); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Matches as header rule matches even though port rule fails.
|
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, OrAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "not_bar"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules)); |
||||||
|
// Header rule fails. Expected value "bar", got "not_bar" for key "foo".
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotOrAuthorizationMatcher) { |
||||||
|
args_.AddPairToMetadata("foo", "not_bar"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
OrAuthorizationMatcher matcher(std::move(rules), /*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HybridAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "bar"); |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_and_rules; |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_or_rules; |
||||||
|
sub_or_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> and_rules; |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::AND, std::move(sub_and_rules))); |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::OR, std::move(std::move(sub_or_rules)))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(and_rules)); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HybridAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata("foo", "bar"); |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_and_rules; |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"foo", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
sub_and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"absent_key", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"some_value") |
||||||
|
.value())); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> sub_or_rules; |
||||||
|
sub_or_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::DEST_PORT, /*port=*/123)); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> and_rules; |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::AND, std::move(sub_and_rules))); |
||||||
|
and_rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::OR, std::move(std::move(sub_or_rules)))); |
||||||
|
AndAuthorizationMatcher matcher(std::move(and_rules)); |
||||||
|
// Fails as "absent_key" header was not present.
|
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PathAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata(":path", "expected/path"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PathAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata(":path", "different/path"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotPathAuthorizationMatcher) { |
||||||
|
args_.AddPairToMetadata(":path", "expected/path"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, "expected/path", false) |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
PathAuthorizationMatcherFailedMatchMissingPath) { |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PathAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"expected/path", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HeaderAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata("key123", "foo_xxx"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::PREFIX, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, HeaderAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
HeaderAuthorizationMatcherFailedMatchMultivaluedHeader) { |
||||||
|
args_.AddPairToMetadata("key123", "foo"); |
||||||
|
args_.AddPairToMetadata("key123", "bar"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
HeaderAuthorizationMatcherFailedMatchMissingHeader) { |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::SUFFIX, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotHeaderAuthorizationMatcher) { |
||||||
|
args_.AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
HeaderAuthorizationMatcher matcher( |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PortAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/123); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PortAuthorizationMatcherFailedMatch) { |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/456); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotPortAuthorizationMatcher) { |
||||||
|
args_.SetLocalEndpoint("ipv4:255.255.255.255:123"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
PortAuthorizationMatcher matcher(/*port=*/123, /*not_rule=*/true); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherUnAuthenticatedConnection) { |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo.com", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherAuthenticatedConnectionMatcherUnset) { |
||||||
|
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, |
||||||
|
AuthenticatedMatcherSuccessfulSpiffeIdMatches) { |
||||||
|
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
args_.AddPropertyToAuthContext(GRPC_PEER_SPIFFE_ID_PROPERTY_NAME, |
||||||
|
"spiffe://foo.abc"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"spiffe://foo.abc", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherFailedSpiffeIdMatches) { |
||||||
|
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
args_.AddPropertyToAuthContext(GRPC_PEER_SPIFFE_ID_PROPERTY_NAME, |
||||||
|
"spiffe://bar.abc"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"spiffe://foo.abc", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, AuthenticatedMatcherFailedNothingMatches) { |
||||||
|
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value()); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, NotAuthenticatedMatcher) { |
||||||
|
args_.AddPropertyToAuthContext(GRPC_TRANSPORT_SECURITY_TYPE_PROPERTY_NAME, |
||||||
|
GRPC_SSL_TRANSPORT_SECURITY_TYPE); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
AuthenticatedAuthorizationMatcher matcher( |
||||||
|
StringMatcher::Create(StringMatcher::Type::EXACT, /*matcher=*/"foo", |
||||||
|
/*case_sensitive=*/false) |
||||||
|
.value(), |
||||||
|
/*not_rule=*/true); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PolicyAuthorizationMatcherSuccessfulMatch) { |
||||||
|
args_.AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"foo") |
||||||
|
.value())); |
||||||
|
PolicyAuthorizationMatcher matcher(Rbac::Policy( |
||||||
|
Rbac::Permission(Rbac::Permission::RuleType::OR, std::move(rules)), |
||||||
|
Rbac::Principal(Rbac::Principal::RuleType::ANY))); |
||||||
|
EXPECT_TRUE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
TEST_F(AuthorizationMatchersTest, PolicyAuthorizationMatcherFailedMatch) { |
||||||
|
args_.AddPairToMetadata("key123", "foo"); |
||||||
|
EvaluateArgs args = args_.MakeEvaluateArgs(); |
||||||
|
std::vector<std::unique_ptr<Rbac::Permission>> rules; |
||||||
|
rules.push_back(absl::make_unique<Rbac::Permission>( |
||||||
|
Rbac::Permission::RuleType::HEADER, |
||||||
|
HeaderMatcher::Create(/*name=*/"key123", HeaderMatcher::Type::EXACT, |
||||||
|
/*matcher=*/"bar") |
||||||
|
.value())); |
||||||
|
PolicyAuthorizationMatcher matcher(Rbac::Policy( |
||||||
|
Rbac::Permission(Rbac::Permission::RuleType::OR, std::move(rules)), |
||||||
|
Rbac::Principal(Rbac::Principal::RuleType::ANY))); |
||||||
|
EXPECT_FALSE(matcher.Matches(args)); |
||||||
|
} |
||||||
|
|
||||||
|
} // namespace grpc_core
|
||||||
|
|
||||||
|
int main(int argc, char** argv) { |
||||||
|
::testing::InitGoogleTest(&argc, argv); |
||||||
|
grpc_init(); |
||||||
|
int ret = RUN_ALL_TESTS(); |
||||||
|
grpc_shutdown(); |
||||||
|
return ret; |
||||||
|
} |
||||||
Loading…
Reference in new issue