Merge remote-tracking branch 'upstream/master' into celeval_constructor Iterate through policies and store CEL condition git push origin ce Merge remote-tracking branch 'upstream/master' into celeval_constructor added class and constructor comments for CelEvaluationEngine CelEvaluationEngine class and constructor Added cel_evaluation_engine to build ran clang_tidy_code.sh updated BUILD with cel_evaluation_engine added rbac.upb.h/cc to BUILD Rewrote cel_evaluation_engine code with upb conventions removed unnecessary deps for cel_evaluation_engine in BUILD Cel_evaluation_engine uses arenas to manage condition pointers Used upb::Arena instead of upb_arena*, added temp_arena to save memory Added action_allow_ member variable Added fullstops to comments initialize action_allow_ changed variable names to be more clear removed unnecessary headers correctly initialize the action_allow_ variable changed constructor to use an initializer list ran clang_tidy and clang_format scripts added cel_engine_test resolved merge conflicts and rewrote cel engine constructor to use new map api changed variables to be more clear and made them const changed syntax.upb.h so the build succeeds changed syntax.upb.h so the build succeeds changed version of upb in bazel_dpes regenerated upb files with new upb version added TODO regarding two-policy design modified CelEvaluationEngine and tests to use two rbac policies Made test messages consistent and added a case with too many policies changed name from cel_engine to authorization_engine fixed merge issues and updated authorization engine to v3 rbac made constructor public and added namespace grpc_corepull/23245/head
Michael Wang
5 years ago
parent
fc4c9d74ee
commit
d0311ac81a
27 changed files with 1103 additions and 0 deletions
@ -0,0 +1,47 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/metadata.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#include <stddef.h> |
||||
#include "upb/msg.h" |
||||
#include "envoy/type/matcher/v3/metadata.upb.h" |
||||
#include "envoy/type/matcher/v3/value.upb.h" |
||||
#include "udpa/annotations/status.upb.h" |
||||
#include "udpa/annotations/versioning.upb.h" |
||||
#include "validate/validate.upb.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
static const upb_msglayout *const envoy_type_matcher_v3_MetadataMatcher_submsgs[2] = { |
||||
&envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit, |
||||
&envoy_type_matcher_v3_ValueMatcher_msginit, |
||||
}; |
||||
|
||||
static const upb_msglayout_field envoy_type_matcher_v3_MetadataMatcher__fields[3] = { |
||||
{1, UPB_SIZE(0, 0), 0, 0, 9, 1}, |
||||
{2, UPB_SIZE(12, 24), 0, 0, 11, 3}, |
||||
{3, UPB_SIZE(8, 16), 0, 1, 11, 1}, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_MetadataMatcher_msginit = { |
||||
&envoy_type_matcher_v3_MetadataMatcher_submsgs[0], |
||||
&envoy_type_matcher_v3_MetadataMatcher__fields[0], |
||||
UPB_SIZE(16, 32), 3, false, |
||||
}; |
||||
|
||||
static const upb_msglayout_field envoy_type_matcher_v3_MetadataMatcher_PathSegment__fields[1] = { |
||||
{1, UPB_SIZE(0, 0), UPB_SIZE(-9, -17), 0, 9, 1}, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit = { |
||||
NULL, |
||||
&envoy_type_matcher_v3_MetadataMatcher_PathSegment__fields[0], |
||||
UPB_SIZE(16, 32), 1, false, |
||||
}; |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
@ -0,0 +1,114 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/metadata.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#ifndef ENVOY_TYPE_MATCHER_V3_METADATA_PROTO_UPB_H_ |
||||
#define ENVOY_TYPE_MATCHER_V3_METADATA_PROTO_UPB_H_ |
||||
|
||||
#include "upb/msg.h" |
||||
#include "upb/decode.h" |
||||
#include "upb/encode.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
#ifdef __cplusplus |
||||
extern "C" { |
||||
#endif |
||||
|
||||
struct envoy_type_matcher_v3_MetadataMatcher; |
||||
struct envoy_type_matcher_v3_MetadataMatcher_PathSegment; |
||||
typedef struct envoy_type_matcher_v3_MetadataMatcher envoy_type_matcher_v3_MetadataMatcher; |
||||
typedef struct envoy_type_matcher_v3_MetadataMatcher_PathSegment envoy_type_matcher_v3_MetadataMatcher_PathSegment; |
||||
extern const upb_msglayout envoy_type_matcher_v3_MetadataMatcher_msginit; |
||||
extern const upb_msglayout envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit; |
||||
struct envoy_type_matcher_v3_ValueMatcher; |
||||
extern const upb_msglayout envoy_type_matcher_v3_ValueMatcher_msginit; |
||||
|
||||
|
||||
/* envoy.type.matcher.v3.MetadataMatcher */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher *envoy_type_matcher_v3_MetadataMatcher_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_MetadataMatcher *)_upb_msg_new(&envoy_type_matcher_v3_MetadataMatcher_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher *envoy_type_matcher_v3_MetadataMatcher_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_MetadataMatcher *ret = envoy_type_matcher_v3_MetadataMatcher_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_MetadataMatcher_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_MetadataMatcher_serialize(const envoy_type_matcher_v3_MetadataMatcher *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_MetadataMatcher_msginit, arena, len); |
||||
} |
||||
|
||||
UPB_INLINE upb_strview envoy_type_matcher_v3_MetadataMatcher_filter(const envoy_type_matcher_v3_MetadataMatcher *msg) { return *UPB_PTR_AT(msg, UPB_SIZE(0, 0), upb_strview); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_MetadataMatcher_has_path(const envoy_type_matcher_v3_MetadataMatcher *msg) { return _upb_has_submsg_nohasbit(msg, UPB_SIZE(12, 24)); } |
||||
UPB_INLINE const envoy_type_matcher_v3_MetadataMatcher_PathSegment* const* envoy_type_matcher_v3_MetadataMatcher_path(const envoy_type_matcher_v3_MetadataMatcher *msg, size_t *len) { return (const envoy_type_matcher_v3_MetadataMatcher_PathSegment* const*)_upb_array_accessor(msg, UPB_SIZE(12, 24), len); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_MetadataMatcher_has_value(const envoy_type_matcher_v3_MetadataMatcher *msg) { return _upb_has_submsg_nohasbit(msg, UPB_SIZE(8, 16)); } |
||||
UPB_INLINE const struct envoy_type_matcher_v3_ValueMatcher* envoy_type_matcher_v3_MetadataMatcher_value(const envoy_type_matcher_v3_MetadataMatcher *msg) { return *UPB_PTR_AT(msg, UPB_SIZE(8, 16), const struct envoy_type_matcher_v3_ValueMatcher*); } |
||||
|
||||
UPB_INLINE void envoy_type_matcher_v3_MetadataMatcher_set_filter(envoy_type_matcher_v3_MetadataMatcher *msg, upb_strview value) { |
||||
*UPB_PTR_AT(msg, UPB_SIZE(0, 0), upb_strview) = value; |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher_PathSegment** envoy_type_matcher_v3_MetadataMatcher_mutable_path(envoy_type_matcher_v3_MetadataMatcher *msg, size_t *len) { |
||||
return (envoy_type_matcher_v3_MetadataMatcher_PathSegment**)_upb_array_mutable_accessor(msg, UPB_SIZE(12, 24), len); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher_PathSegment** envoy_type_matcher_v3_MetadataMatcher_resize_path(envoy_type_matcher_v3_MetadataMatcher *msg, size_t len, upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_MetadataMatcher_PathSegment**)_upb_array_resize_accessor(msg, UPB_SIZE(12, 24), len, UPB_TYPE_MESSAGE, arena); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_MetadataMatcher_PathSegment* envoy_type_matcher_v3_MetadataMatcher_add_path(envoy_type_matcher_v3_MetadataMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_MetadataMatcher_PathSegment* sub = (struct envoy_type_matcher_v3_MetadataMatcher_PathSegment*)_upb_msg_new(&envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit, arena); |
||||
bool ok = _upb_array_append_accessor( |
||||
msg, UPB_SIZE(12, 24), UPB_SIZE(4, 8), UPB_TYPE_MESSAGE, &sub, arena); |
||||
if (!ok) return NULL; |
||||
return sub; |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_MetadataMatcher_set_value(envoy_type_matcher_v3_MetadataMatcher *msg, struct envoy_type_matcher_v3_ValueMatcher* value) { |
||||
*UPB_PTR_AT(msg, UPB_SIZE(8, 16), struct envoy_type_matcher_v3_ValueMatcher*) = value; |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_ValueMatcher* envoy_type_matcher_v3_MetadataMatcher_mutable_value(envoy_type_matcher_v3_MetadataMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_ValueMatcher* sub = (struct envoy_type_matcher_v3_ValueMatcher*)envoy_type_matcher_v3_MetadataMatcher_value(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_ValueMatcher*)_upb_msg_new(&envoy_type_matcher_v3_ValueMatcher_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_MetadataMatcher_set_value(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
|
||||
/* envoy.type.matcher.v3.MetadataMatcher.PathSegment */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher_PathSegment *envoy_type_matcher_v3_MetadataMatcher_PathSegment_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_MetadataMatcher_PathSegment *)_upb_msg_new(&envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher_PathSegment *envoy_type_matcher_v3_MetadataMatcher_PathSegment_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_MetadataMatcher_PathSegment *ret = envoy_type_matcher_v3_MetadataMatcher_PathSegment_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_MetadataMatcher_PathSegment_serialize(const envoy_type_matcher_v3_MetadataMatcher_PathSegment *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_MetadataMatcher_PathSegment_msginit, arena, len); |
||||
} |
||||
|
||||
typedef enum { |
||||
envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_key = 1, |
||||
envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_NOT_SET = 0 |
||||
} envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_oneofcases; |
||||
UPB_INLINE envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_oneofcases envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_case(const envoy_type_matcher_v3_MetadataMatcher_PathSegment* msg) { return (envoy_type_matcher_v3_MetadataMatcher_PathSegment_segment_oneofcases)*UPB_PTR_AT(msg, UPB_SIZE(8, 16), int32_t); } |
||||
|
||||
UPB_INLINE bool envoy_type_matcher_v3_MetadataMatcher_PathSegment_has_key(const envoy_type_matcher_v3_MetadataMatcher_PathSegment *msg) { return _upb_getoneofcase(msg, UPB_SIZE(8, 16)) == 1; } |
||||
UPB_INLINE upb_strview envoy_type_matcher_v3_MetadataMatcher_PathSegment_key(const envoy_type_matcher_v3_MetadataMatcher_PathSegment *msg) { return UPB_READ_ONEOF(msg, upb_strview, UPB_SIZE(0, 0), UPB_SIZE(8, 16), 1, upb_strview_make("", strlen(""))); } |
||||
|
||||
UPB_INLINE void envoy_type_matcher_v3_MetadataMatcher_PathSegment_set_key(envoy_type_matcher_v3_MetadataMatcher_PathSegment *msg, upb_strview value) { |
||||
UPB_WRITE_ONEOF(msg, upb_strview, UPB_SIZE(0, 0), value, UPB_SIZE(8, 16), 1); |
||||
} |
||||
|
||||
#ifdef __cplusplus |
||||
} /* extern "C" */ |
||||
#endif |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
#endif /* ENVOY_TYPE_MATCHER_V3_METADATA_PROTO_UPB_H_ */ |
||||
@ -0,0 +1,35 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/number.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#include <stddef.h> |
||||
#include "upb/msg.h" |
||||
#include "envoy/type/matcher/v3/number.upb.h" |
||||
#include "envoy/type/v3/range.upb.h" |
||||
#include "udpa/annotations/status.upb.h" |
||||
#include "udpa/annotations/versioning.upb.h" |
||||
#include "validate/validate.upb.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
static const upb_msglayout *const envoy_type_matcher_v3_DoubleMatcher_submsgs[1] = { |
||||
&envoy_type_v3_DoubleRange_msginit, |
||||
}; |
||||
|
||||
static const upb_msglayout_field envoy_type_matcher_v3_DoubleMatcher__fields[2] = { |
||||
{1, UPB_SIZE(0, 0), UPB_SIZE(-9, -9), 0, 11, 1}, |
||||
{2, UPB_SIZE(0, 0), UPB_SIZE(-9, -9), 0, 1, 1}, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_DoubleMatcher_msginit = { |
||||
&envoy_type_matcher_v3_DoubleMatcher_submsgs[0], |
||||
&envoy_type_matcher_v3_DoubleMatcher__fields[0], |
||||
UPB_SIZE(16, 16), 2, false, |
||||
}; |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
@ -0,0 +1,77 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/number.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#ifndef ENVOY_TYPE_MATCHER_V3_NUMBER_PROTO_UPB_H_ |
||||
#define ENVOY_TYPE_MATCHER_V3_NUMBER_PROTO_UPB_H_ |
||||
|
||||
#include "upb/msg.h" |
||||
#include "upb/decode.h" |
||||
#include "upb/encode.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
#ifdef __cplusplus |
||||
extern "C" { |
||||
#endif |
||||
|
||||
struct envoy_type_matcher_v3_DoubleMatcher; |
||||
typedef struct envoy_type_matcher_v3_DoubleMatcher envoy_type_matcher_v3_DoubleMatcher; |
||||
extern const upb_msglayout envoy_type_matcher_v3_DoubleMatcher_msginit; |
||||
struct envoy_type_v3_DoubleRange; |
||||
extern const upb_msglayout envoy_type_v3_DoubleRange_msginit; |
||||
|
||||
|
||||
/* envoy.type.matcher.v3.DoubleMatcher */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_DoubleMatcher *envoy_type_matcher_v3_DoubleMatcher_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_DoubleMatcher *)_upb_msg_new(&envoy_type_matcher_v3_DoubleMatcher_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_DoubleMatcher *envoy_type_matcher_v3_DoubleMatcher_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_DoubleMatcher *ret = envoy_type_matcher_v3_DoubleMatcher_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_DoubleMatcher_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_DoubleMatcher_serialize(const envoy_type_matcher_v3_DoubleMatcher *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_DoubleMatcher_msginit, arena, len); |
||||
} |
||||
|
||||
typedef enum { |
||||
envoy_type_matcher_v3_DoubleMatcher_match_pattern_range = 1, |
||||
envoy_type_matcher_v3_DoubleMatcher_match_pattern_exact = 2, |
||||
envoy_type_matcher_v3_DoubleMatcher_match_pattern_NOT_SET = 0 |
||||
} envoy_type_matcher_v3_DoubleMatcher_match_pattern_oneofcases; |
||||
UPB_INLINE envoy_type_matcher_v3_DoubleMatcher_match_pattern_oneofcases envoy_type_matcher_v3_DoubleMatcher_match_pattern_case(const envoy_type_matcher_v3_DoubleMatcher* msg) { return (envoy_type_matcher_v3_DoubleMatcher_match_pattern_oneofcases)*UPB_PTR_AT(msg, UPB_SIZE(8, 8), int32_t); } |
||||
|
||||
UPB_INLINE bool envoy_type_matcher_v3_DoubleMatcher_has_range(const envoy_type_matcher_v3_DoubleMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(8, 8)) == 1; } |
||||
UPB_INLINE const struct envoy_type_v3_DoubleRange* envoy_type_matcher_v3_DoubleMatcher_range(const envoy_type_matcher_v3_DoubleMatcher *msg) { return UPB_READ_ONEOF(msg, const struct envoy_type_v3_DoubleRange*, UPB_SIZE(0, 0), UPB_SIZE(8, 8), 1, NULL); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_DoubleMatcher_has_exact(const envoy_type_matcher_v3_DoubleMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(8, 8)) == 2; } |
||||
UPB_INLINE double envoy_type_matcher_v3_DoubleMatcher_exact(const envoy_type_matcher_v3_DoubleMatcher *msg) { return UPB_READ_ONEOF(msg, double, UPB_SIZE(0, 0), UPB_SIZE(8, 8), 2, 0); } |
||||
|
||||
UPB_INLINE void envoy_type_matcher_v3_DoubleMatcher_set_range(envoy_type_matcher_v3_DoubleMatcher *msg, struct envoy_type_v3_DoubleRange* value) { |
||||
UPB_WRITE_ONEOF(msg, struct envoy_type_v3_DoubleRange*, UPB_SIZE(0, 0), value, UPB_SIZE(8, 8), 1); |
||||
} |
||||
UPB_INLINE struct envoy_type_v3_DoubleRange* envoy_type_matcher_v3_DoubleMatcher_mutable_range(envoy_type_matcher_v3_DoubleMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_v3_DoubleRange* sub = (struct envoy_type_v3_DoubleRange*)envoy_type_matcher_v3_DoubleMatcher_range(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_v3_DoubleRange*)_upb_msg_new(&envoy_type_v3_DoubleRange_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_DoubleMatcher_set_range(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_DoubleMatcher_set_exact(envoy_type_matcher_v3_DoubleMatcher *msg, double value) { |
||||
UPB_WRITE_ONEOF(msg, double, UPB_SIZE(0, 0), value, UPB_SIZE(8, 8), 2); |
||||
} |
||||
|
||||
#ifdef __cplusplus |
||||
} /* extern "C" */ |
||||
#endif |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
#endif /* ENVOY_TYPE_MATCHER_V3_NUMBER_PROTO_UPB_H_ */ |
||||
@ -0,0 +1,63 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/value.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#include <stddef.h> |
||||
#include "upb/msg.h" |
||||
#include "envoy/type/matcher/v3/value.upb.h" |
||||
#include "envoy/type/matcher/v3/number.upb.h" |
||||
#include "envoy/type/matcher/v3/string.upb.h" |
||||
#include "udpa/annotations/status.upb.h" |
||||
#include "udpa/annotations/versioning.upb.h" |
||||
#include "validate/validate.upb.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
static const upb_msglayout *const envoy_type_matcher_v3_ValueMatcher_submsgs[4] = { |
||||
&envoy_type_matcher_v3_DoubleMatcher_msginit, |
||||
&envoy_type_matcher_v3_ListMatcher_msginit, |
||||
&envoy_type_matcher_v3_StringMatcher_msginit, |
||||
&envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit, |
||||
}; |
||||
|
||||
static const upb_msglayout_field envoy_type_matcher_v3_ValueMatcher__fields[6] = { |
||||
{1, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 3, 11, 1}, |
||||
{2, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 0, 11, 1}, |
||||
{3, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 2, 11, 1}, |
||||
{4, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 0, 8, 1}, |
||||
{5, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 0, 8, 1}, |
||||
{6, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 1, 11, 1}, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_ValueMatcher_msginit = { |
||||
&envoy_type_matcher_v3_ValueMatcher_submsgs[0], |
||||
&envoy_type_matcher_v3_ValueMatcher__fields[0], |
||||
UPB_SIZE(8, 16), 6, false, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit = { |
||||
NULL, |
||||
NULL, |
||||
UPB_SIZE(0, 0), 0, false, |
||||
}; |
||||
|
||||
static const upb_msglayout *const envoy_type_matcher_v3_ListMatcher_submsgs[1] = { |
||||
&envoy_type_matcher_v3_ValueMatcher_msginit, |
||||
}; |
||||
|
||||
static const upb_msglayout_field envoy_type_matcher_v3_ListMatcher__fields[1] = { |
||||
{1, UPB_SIZE(0, 0), UPB_SIZE(-5, -9), 0, 11, 1}, |
||||
}; |
||||
|
||||
const upb_msglayout envoy_type_matcher_v3_ListMatcher_msginit = { |
||||
&envoy_type_matcher_v3_ListMatcher_submsgs[0], |
||||
&envoy_type_matcher_v3_ListMatcher__fields[0], |
||||
UPB_SIZE(8, 16), 1, false, |
||||
}; |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
@ -0,0 +1,188 @@ |
||||
/* This file was generated by upbc (the upb compiler) from the input
|
||||
* file: |
||||
* |
||||
* envoy/type/matcher/v3/value.proto |
||||
* |
||||
* Do not edit -- your changes will be discarded when the file is |
||||
* regenerated. */ |
||||
|
||||
#ifndef ENVOY_TYPE_MATCHER_V3_VALUE_PROTO_UPB_H_ |
||||
#define ENVOY_TYPE_MATCHER_V3_VALUE_PROTO_UPB_H_ |
||||
|
||||
#include "upb/msg.h" |
||||
#include "upb/decode.h" |
||||
#include "upb/encode.h" |
||||
|
||||
#include "upb/port_def.inc" |
||||
|
||||
#ifdef __cplusplus |
||||
extern "C" { |
||||
#endif |
||||
|
||||
struct envoy_type_matcher_v3_ValueMatcher; |
||||
struct envoy_type_matcher_v3_ValueMatcher_NullMatch; |
||||
struct envoy_type_matcher_v3_ListMatcher; |
||||
typedef struct envoy_type_matcher_v3_ValueMatcher envoy_type_matcher_v3_ValueMatcher; |
||||
typedef struct envoy_type_matcher_v3_ValueMatcher_NullMatch envoy_type_matcher_v3_ValueMatcher_NullMatch; |
||||
typedef struct envoy_type_matcher_v3_ListMatcher envoy_type_matcher_v3_ListMatcher; |
||||
extern const upb_msglayout envoy_type_matcher_v3_ValueMatcher_msginit; |
||||
extern const upb_msglayout envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit; |
||||
extern const upb_msglayout envoy_type_matcher_v3_ListMatcher_msginit; |
||||
struct envoy_type_matcher_v3_DoubleMatcher; |
||||
struct envoy_type_matcher_v3_StringMatcher; |
||||
extern const upb_msglayout envoy_type_matcher_v3_DoubleMatcher_msginit; |
||||
extern const upb_msglayout envoy_type_matcher_v3_StringMatcher_msginit; |
||||
|
||||
|
||||
/* envoy.type.matcher.v3.ValueMatcher */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_ValueMatcher *envoy_type_matcher_v3_ValueMatcher_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_ValueMatcher *)_upb_msg_new(&envoy_type_matcher_v3_ValueMatcher_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_ValueMatcher *envoy_type_matcher_v3_ValueMatcher_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_ValueMatcher *ret = envoy_type_matcher_v3_ValueMatcher_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_ValueMatcher_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_ValueMatcher_serialize(const envoy_type_matcher_v3_ValueMatcher *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_ValueMatcher_msginit, arena, len); |
||||
} |
||||
|
||||
typedef enum { |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_null_match = 1, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_double_match = 2, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_string_match = 3, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_bool_match = 4, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_present_match = 5, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_list_match = 6, |
||||
envoy_type_matcher_v3_ValueMatcher_match_pattern_NOT_SET = 0 |
||||
} envoy_type_matcher_v3_ValueMatcher_match_pattern_oneofcases; |
||||
UPB_INLINE envoy_type_matcher_v3_ValueMatcher_match_pattern_oneofcases envoy_type_matcher_v3_ValueMatcher_match_pattern_case(const envoy_type_matcher_v3_ValueMatcher* msg) { return (envoy_type_matcher_v3_ValueMatcher_match_pattern_oneofcases)*UPB_PTR_AT(msg, UPB_SIZE(4, 8), int32_t); } |
||||
|
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_null_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 1; } |
||||
UPB_INLINE const envoy_type_matcher_v3_ValueMatcher_NullMatch* envoy_type_matcher_v3_ValueMatcher_null_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, const envoy_type_matcher_v3_ValueMatcher_NullMatch*, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 1, NULL); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_double_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 2; } |
||||
UPB_INLINE const struct envoy_type_matcher_v3_DoubleMatcher* envoy_type_matcher_v3_ValueMatcher_double_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, const struct envoy_type_matcher_v3_DoubleMatcher*, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 2, NULL); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_string_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 3; } |
||||
UPB_INLINE const struct envoy_type_matcher_v3_StringMatcher* envoy_type_matcher_v3_ValueMatcher_string_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, const struct envoy_type_matcher_v3_StringMatcher*, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 3, NULL); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_bool_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 4; } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_bool_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, bool, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 4, false); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_present_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 5; } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_present_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, bool, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 5, false); } |
||||
UPB_INLINE bool envoy_type_matcher_v3_ValueMatcher_has_list_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 6; } |
||||
UPB_INLINE const envoy_type_matcher_v3_ListMatcher* envoy_type_matcher_v3_ValueMatcher_list_match(const envoy_type_matcher_v3_ValueMatcher *msg) { return UPB_READ_ONEOF(msg, const envoy_type_matcher_v3_ListMatcher*, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 6, NULL); } |
||||
|
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_null_match(envoy_type_matcher_v3_ValueMatcher *msg, envoy_type_matcher_v3_ValueMatcher_NullMatch* value) { |
||||
UPB_WRITE_ONEOF(msg, envoy_type_matcher_v3_ValueMatcher_NullMatch*, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 1); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_ValueMatcher_NullMatch* envoy_type_matcher_v3_ValueMatcher_mutable_null_match(envoy_type_matcher_v3_ValueMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_ValueMatcher_NullMatch* sub = (struct envoy_type_matcher_v3_ValueMatcher_NullMatch*)envoy_type_matcher_v3_ValueMatcher_null_match(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_ValueMatcher_NullMatch*)_upb_msg_new(&envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_ValueMatcher_set_null_match(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_double_match(envoy_type_matcher_v3_ValueMatcher *msg, struct envoy_type_matcher_v3_DoubleMatcher* value) { |
||||
UPB_WRITE_ONEOF(msg, struct envoy_type_matcher_v3_DoubleMatcher*, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 2); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_DoubleMatcher* envoy_type_matcher_v3_ValueMatcher_mutable_double_match(envoy_type_matcher_v3_ValueMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_DoubleMatcher* sub = (struct envoy_type_matcher_v3_DoubleMatcher*)envoy_type_matcher_v3_ValueMatcher_double_match(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_DoubleMatcher*)_upb_msg_new(&envoy_type_matcher_v3_DoubleMatcher_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_ValueMatcher_set_double_match(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_string_match(envoy_type_matcher_v3_ValueMatcher *msg, struct envoy_type_matcher_v3_StringMatcher* value) { |
||||
UPB_WRITE_ONEOF(msg, struct envoy_type_matcher_v3_StringMatcher*, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 3); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_StringMatcher* envoy_type_matcher_v3_ValueMatcher_mutable_string_match(envoy_type_matcher_v3_ValueMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_StringMatcher* sub = (struct envoy_type_matcher_v3_StringMatcher*)envoy_type_matcher_v3_ValueMatcher_string_match(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_StringMatcher*)_upb_msg_new(&envoy_type_matcher_v3_StringMatcher_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_ValueMatcher_set_string_match(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_bool_match(envoy_type_matcher_v3_ValueMatcher *msg, bool value) { |
||||
UPB_WRITE_ONEOF(msg, bool, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 4); |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_present_match(envoy_type_matcher_v3_ValueMatcher *msg, bool value) { |
||||
UPB_WRITE_ONEOF(msg, bool, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 5); |
||||
} |
||||
UPB_INLINE void envoy_type_matcher_v3_ValueMatcher_set_list_match(envoy_type_matcher_v3_ValueMatcher *msg, envoy_type_matcher_v3_ListMatcher* value) { |
||||
UPB_WRITE_ONEOF(msg, envoy_type_matcher_v3_ListMatcher*, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 6); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_ListMatcher* envoy_type_matcher_v3_ValueMatcher_mutable_list_match(envoy_type_matcher_v3_ValueMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_ListMatcher* sub = (struct envoy_type_matcher_v3_ListMatcher*)envoy_type_matcher_v3_ValueMatcher_list_match(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_ListMatcher*)_upb_msg_new(&envoy_type_matcher_v3_ListMatcher_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_ValueMatcher_set_list_match(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
|
||||
/* envoy.type.matcher.v3.ValueMatcher.NullMatch */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_ValueMatcher_NullMatch *envoy_type_matcher_v3_ValueMatcher_NullMatch_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_ValueMatcher_NullMatch *)_upb_msg_new(&envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_ValueMatcher_NullMatch *envoy_type_matcher_v3_ValueMatcher_NullMatch_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_ValueMatcher_NullMatch *ret = envoy_type_matcher_v3_ValueMatcher_NullMatch_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_ValueMatcher_NullMatch_serialize(const envoy_type_matcher_v3_ValueMatcher_NullMatch *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_ValueMatcher_NullMatch_msginit, arena, len); |
||||
} |
||||
|
||||
|
||||
|
||||
/* envoy.type.matcher.v3.ListMatcher */ |
||||
|
||||
UPB_INLINE envoy_type_matcher_v3_ListMatcher *envoy_type_matcher_v3_ListMatcher_new(upb_arena *arena) { |
||||
return (envoy_type_matcher_v3_ListMatcher *)_upb_msg_new(&envoy_type_matcher_v3_ListMatcher_msginit, arena); |
||||
} |
||||
UPB_INLINE envoy_type_matcher_v3_ListMatcher *envoy_type_matcher_v3_ListMatcher_parse(const char *buf, size_t size, |
||||
upb_arena *arena) { |
||||
envoy_type_matcher_v3_ListMatcher *ret = envoy_type_matcher_v3_ListMatcher_new(arena); |
||||
return (ret && upb_decode(buf, size, ret, &envoy_type_matcher_v3_ListMatcher_msginit, arena)) ? ret : NULL; |
||||
} |
||||
UPB_INLINE char *envoy_type_matcher_v3_ListMatcher_serialize(const envoy_type_matcher_v3_ListMatcher *msg, upb_arena *arena, size_t *len) { |
||||
return upb_encode(msg, &envoy_type_matcher_v3_ListMatcher_msginit, arena, len); |
||||
} |
||||
|
||||
typedef enum { |
||||
envoy_type_matcher_v3_ListMatcher_match_pattern_one_of = 1, |
||||
envoy_type_matcher_v3_ListMatcher_match_pattern_NOT_SET = 0 |
||||
} envoy_type_matcher_v3_ListMatcher_match_pattern_oneofcases; |
||||
UPB_INLINE envoy_type_matcher_v3_ListMatcher_match_pattern_oneofcases envoy_type_matcher_v3_ListMatcher_match_pattern_case(const envoy_type_matcher_v3_ListMatcher* msg) { return (envoy_type_matcher_v3_ListMatcher_match_pattern_oneofcases)*UPB_PTR_AT(msg, UPB_SIZE(4, 8), int32_t); } |
||||
|
||||
UPB_INLINE bool envoy_type_matcher_v3_ListMatcher_has_one_of(const envoy_type_matcher_v3_ListMatcher *msg) { return _upb_getoneofcase(msg, UPB_SIZE(4, 8)) == 1; } |
||||
UPB_INLINE const envoy_type_matcher_v3_ValueMatcher* envoy_type_matcher_v3_ListMatcher_one_of(const envoy_type_matcher_v3_ListMatcher *msg) { return UPB_READ_ONEOF(msg, const envoy_type_matcher_v3_ValueMatcher*, UPB_SIZE(0, 0), UPB_SIZE(4, 8), 1, NULL); } |
||||
|
||||
UPB_INLINE void envoy_type_matcher_v3_ListMatcher_set_one_of(envoy_type_matcher_v3_ListMatcher *msg, envoy_type_matcher_v3_ValueMatcher* value) { |
||||
UPB_WRITE_ONEOF(msg, envoy_type_matcher_v3_ValueMatcher*, UPB_SIZE(0, 0), value, UPB_SIZE(4, 8), 1); |
||||
} |
||||
UPB_INLINE struct envoy_type_matcher_v3_ValueMatcher* envoy_type_matcher_v3_ListMatcher_mutable_one_of(envoy_type_matcher_v3_ListMatcher *msg, upb_arena *arena) { |
||||
struct envoy_type_matcher_v3_ValueMatcher* sub = (struct envoy_type_matcher_v3_ValueMatcher*)envoy_type_matcher_v3_ListMatcher_one_of(msg); |
||||
if (sub == NULL) { |
||||
sub = (struct envoy_type_matcher_v3_ValueMatcher*)_upb_msg_new(&envoy_type_matcher_v3_ValueMatcher_msginit, arena); |
||||
if (!sub) return NULL; |
||||
envoy_type_matcher_v3_ListMatcher_set_one_of(msg, sub); |
||||
} |
||||
return sub; |
||||
} |
||||
|
||||
#ifdef __cplusplus |
||||
} /* extern "C" */ |
||||
#endif |
||||
|
||||
#include "upb/port_undef.inc" |
||||
|
||||
#endif /* ENVOY_TYPE_MATCHER_V3_VALUE_PROTO_UPB_H_ */ |
||||
@ -0,0 +1,77 @@ |
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include "absl/memory/memory.h" |
||||
|
||||
#include "src/core/lib/security/authorization/authorization_engine.h" |
||||
|
||||
namespace grpc_core { |
||||
|
||||
std::unique_ptr<AuthorizationEngine> |
||||
AuthorizationEngine::CreateAuthorizationEngine( |
||||
const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) { |
||||
if (rbac_policies.size() < 1 || rbac_policies.size() > 2) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid rbac policies vector. Must contain either one or two rbac " |
||||
"policies."); |
||||
return nullptr; |
||||
} else if (rbac_policies.size() == 2 && |
||||
(envoy_config_rbac_v3_RBAC_action(rbac_policies[0]) != kDeny || |
||||
envoy_config_rbac_v3_RBAC_action(rbac_policies[1]) != kAllow)) { |
||||
gpr_log(GPR_ERROR, |
||||
"Invalid rbac policies vector. Must contain one deny \
|
||||
policy and one allow policy, in that order."); |
||||
return nullptr; |
||||
} else { |
||||
return absl::make_unique<AuthorizationEngine>(rbac_policies); |
||||
} |
||||
} |
||||
|
||||
AuthorizationEngine::AuthorizationEngine( |
||||
const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies) { |
||||
for (const auto& rbac_policy : rbac_policies) { |
||||
// Extract array of policies and store their condition fields in either
|
||||
// allow_if_matched_ or deny_if_matched_, depending on the policy action.
|
||||
upb::Arena temp_arena; |
||||
size_t policy_num = UPB_MAP_BEGIN; |
||||
const envoy_config_rbac_v3_RBAC_PoliciesEntry* policy_entry; |
||||
while ((policy_entry = envoy_config_rbac_v3_RBAC_policies_next( |
||||
rbac_policy, &policy_num)) != nullptr) { |
||||
const upb_strview policy_name_strview = |
||||
envoy_config_rbac_v3_RBAC_PoliciesEntry_key(policy_entry); |
||||
const std::string policy_name(policy_name_strview.data, |
||||
policy_name_strview.size); |
||||
const envoy_config_rbac_v3_Policy* policy = |
||||
envoy_config_rbac_v3_RBAC_PoliciesEntry_value(policy_entry); |
||||
const google_api_expr_v1alpha1_Expr* condition = |
||||
envoy_config_rbac_v3_Policy_condition(policy); |
||||
// Parse condition to make a pointer tied to the lifetime of arena_.
|
||||
size_t serial_len; |
||||
const char* serialized = google_api_expr_v1alpha1_Expr_serialize( |
||||
condition, temp_arena.ptr(), &serial_len); |
||||
const google_api_expr_v1alpha1_Expr* parsed_condition = |
||||
google_api_expr_v1alpha1_Expr_parse(serialized, serial_len, |
||||
arena_.ptr()); |
||||
if (envoy_config_rbac_v3_RBAC_action(rbac_policy) == kAllow) { |
||||
allow_if_matched_.insert(std::make_pair(policy_name, parsed_condition)); |
||||
} else { |
||||
deny_if_matched_.insert(std::make_pair(policy_name, parsed_condition)); |
||||
} |
||||
} |
||||
} |
||||
} |
||||
|
||||
} // namespace grpc_core
|
||||
@ -0,0 +1,74 @@ |
||||
|
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#ifndef GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H |
||||
#define GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H |
||||
|
||||
#include <grpc/support/port_platform.h> |
||||
|
||||
#include <grpc/support/log.h> |
||||
#include <map> |
||||
#include <memory> |
||||
#include <string> |
||||
#include <vector> |
||||
|
||||
#include "src/core/ext/upb-generated/envoy/config/rbac/v3/rbac.upb.h" |
||||
#include "src/core/ext/upb-generated/google/api/expr/v1alpha1/syntax.upb.h" |
||||
#include "upb/upb.hpp" |
||||
|
||||
namespace grpc_core { |
||||
|
||||
// AuthorizationEngine makes an AuthorizationDecision to ALLOW or DENY the
|
||||
// current action based on the condition fields in provided RBAC policies.
|
||||
// The engine may be constructed with one or two policies. If two polcies,
|
||||
// the first policy is deny-if-matched and the second is allow-if-matched.
|
||||
// The engine returns UNDECIDED decision if it fails to find a match in any
|
||||
// policy. This engine ignores the principal and permission fields in RBAC
|
||||
// policies. It is the caller's responsibility to provide RBAC policies that
|
||||
// are compatible with this engine.
|
||||
//
|
||||
// Example:
|
||||
// AuthorizationEngine*
|
||||
// auth_engine = AuthorizationEngine::CreateAuthorizationEngine(rbac_policies);
|
||||
// auth_engine->Evaluate(evaluate_args); // returns authorization decision.
|
||||
class AuthorizationEngine { |
||||
public: |
||||
// rbac_policies must be a vector containing either a single policy of any
|
||||
// kind, or one deny policy and one allow policy, in that order.
|
||||
static std::unique_ptr<AuthorizationEngine> CreateAuthorizationEngine( |
||||
const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies); |
||||
|
||||
// Users should use the CreateAuthorizationEngine factory function
|
||||
// instead of calling the AuthorizationEngine constructor directly.
|
||||
explicit AuthorizationEngine( |
||||
const std::vector<envoy_config_rbac_v3_RBAC*>& rbac_policies); |
||||
// TODO(mywang@google.com): add an Evaluate member function.
|
||||
|
||||
private: |
||||
enum Action { |
||||
kAllow, |
||||
kDeny, |
||||
}; |
||||
|
||||
std::map<const std::string, const google_api_expr_v1alpha1_Expr*> |
||||
deny_if_matched_; |
||||
std::map<const std::string, const google_api_expr_v1alpha1_Expr*> |
||||
allow_if_matched_; |
||||
upb::Arena arena_; |
||||
}; |
||||
|
||||
} // namespace grpc_core
|
||||
|
||||
#endif /* GRPC_CORE_LIB_SECURITY_AUTHORIZATION_AUTHORIZATION_ENGINE_H */ |
||||
@ -0,0 +1,80 @@ |
||||
// Copyright 2020 gRPC authors.
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
#include "src/core/lib/security/authorization/authorization_engine.h" |
||||
|
||||
#include <gtest/gtest.h> |
||||
|
||||
namespace grpc_core { |
||||
|
||||
class AuthorizationEngineTest : public ::testing::Test { |
||||
protected: |
||||
void SetUp() override { |
||||
deny_policy_ = envoy_config_rbac_v3_RBAC_new(arena_.ptr()); |
||||
envoy_config_rbac_v3_RBAC_set_action(deny_policy_, 1); |
||||
allow_policy_ = envoy_config_rbac_v3_RBAC_new(arena_.ptr()); |
||||
envoy_config_rbac_v3_RBAC_set_action(allow_policy_, 0); |
||||
} |
||||
upb::Arena arena_; |
||||
envoy_config_rbac_v3_RBAC* deny_policy_; |
||||
envoy_config_rbac_v3_RBAC* allow_policy_; |
||||
}; |
||||
|
||||
TEST_F(AuthorizationEngineTest, CreateEngineSuccessOnePolicy) { |
||||
std::vector<envoy_config_rbac_v3_RBAC*> policies{allow_policy_}; |
||||
std::unique_ptr<AuthorizationEngine> engine = |
||||
AuthorizationEngine::CreateAuthorizationEngine(policies); |
||||
EXPECT_NE(engine, nullptr) |
||||
<< "Error: Failed to create an AuthorizationEngine with one policy."; |
||||
} |
||||
|
||||
TEST_F(AuthorizationEngineTest, CreateEngineSuccessTwoPolicies) { |
||||
std::vector<envoy_config_rbac_v3_RBAC*> policies{deny_policy_, allow_policy_}; |
||||
std::unique_ptr<AuthorizationEngine> engine = |
||||
AuthorizationEngine::CreateAuthorizationEngine(policies); |
||||
EXPECT_NE(engine, nullptr) |
||||
<< "Error: Failed to create an AuthorizationEngine with two policies."; |
||||
} |
||||
|
||||
TEST_F(AuthorizationEngineTest, CreateEngineFailNoPolicies) { |
||||
std::vector<envoy_config_rbac_v3_RBAC*> policies{}; |
||||
std::unique_ptr<AuthorizationEngine> engine = |
||||
AuthorizationEngine::CreateAuthorizationEngine(policies); |
||||
EXPECT_EQ(engine, nullptr) |
||||
<< "Error: Created an AuthorizationEngine without policies."; |
||||
} |
||||
|
||||
TEST_F(AuthorizationEngineTest, CreateEngineFailTooManyPolicies) { |
||||
std::vector<envoy_config_rbac_v3_RBAC*> policies{deny_policy_, allow_policy_, |
||||
deny_policy_}; |
||||
std::unique_ptr<AuthorizationEngine> engine = |
||||
AuthorizationEngine::CreateAuthorizationEngine(policies); |
||||
EXPECT_EQ(engine, nullptr) |
||||
<< "Error: Created an AuthorizationEngine with more than two policies."; |
||||
} |
||||
|
||||
TEST_F(AuthorizationEngineTest, CreateEngineFailWrongPolicyOrder) { |
||||
std::vector<envoy_config_rbac_v3_RBAC*> policies{allow_policy_, deny_policy_}; |
||||
std::unique_ptr<AuthorizationEngine> engine = |
||||
AuthorizationEngine::CreateAuthorizationEngine(policies); |
||||
EXPECT_EQ(engine, nullptr) << "Error: Created an AuthorizationEngine with " |
||||
"policies in the wrong order."; |
||||
} |
||||
|
||||
} // namespace grpc_core
|
||||
|
||||
int main(int argc, char** argv) { |
||||
::testing::InitGoogleTest(&argc, argv); |
||||
return RUN_ALL_TESTS(); |
||||
} |
||||
Loading…
Reference in new issue