2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2018-01-19 10:43:36 +03:00
|
|
|
"context"
|
2017-10-24 00:15:56 +03:00
|
|
|
"fmt"
|
2017-01-18 03:40:21 +03:00
|
|
|
"reflect"
|
2019-04-11 00:46:17 +03:00
|
|
|
"sort"
|
2017-02-17 02:20:11 +03:00
|
|
|
"strings"
|
2017-01-18 03:40:21 +03:00
|
|
|
|
2019-04-11 00:46:17 +03:00
|
|
|
"github.com/armon/go-radix"
|
|
|
|
"github.com/hashicorp/go-multierror"
|
2021-07-16 03:17:31 +03:00
|
|
|
"github.com/hashicorp/go-secure-stdlib/strutil"
|
2017-10-24 00:15:56 +03:00
|
|
|
"github.com/hashicorp/vault/helper/identity"
|
2018-09-18 06:03:00 +03:00
|
|
|
"github.com/hashicorp/vault/helper/namespace"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2018-05-18 23:33:49 +03:00
|
|
|
"github.com/mitchellh/copystructure"
|
2015-03-18 04:31:20 +03:00
|
|
|
)
|
|
|
|
|
|
|
|
// ACL is used to wrap a set of policies to provide
|
|
|
|
// an efficient interface for access control.
|
|
|
|
type ACL struct {
|
2015-07-06 02:31:30 +03:00
|
|
|
// exactRules contains the path policies that are exact
|
|
|
|
exactRules *radix.Tree
|
|
|
|
|
2019-01-23 21:55:40 +03:00
|
|
|
// prefixRules contains the path policies that are a prefix
|
|
|
|
prefixRules *radix.Tree
|
2015-03-18 04:31:20 +03:00
|
|
|
|
2019-02-15 05:31:43 +03:00
|
|
|
segmentWildcardPaths map[string]interface{}
|
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
// root is enabled if the "root" named policy is present.
|
|
|
|
root bool
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
// Stores policies that are actually RGPs for later fetching
|
|
|
|
rgpPolicies []*Policy
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
|
|
|
|
2017-10-23 23:42:56 +03:00
|
|
|
type PolicyCheckOpts struct {
|
|
|
|
RootPrivsRequired bool
|
|
|
|
Unauth bool
|
|
|
|
}
|
|
|
|
|
|
|
|
type AuthResults struct {
|
2022-05-17 02:23:08 +03:00
|
|
|
ACLResults *ACLResults
|
|
|
|
SentinelResults *SentinelResults
|
|
|
|
Allowed bool
|
|
|
|
RootPrivs bool
|
|
|
|
DeniedError bool
|
|
|
|
Error *multierror.Error
|
2017-10-23 23:42:56 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
type ACLResults struct {
|
2018-09-18 06:03:00 +03:00
|
|
|
Allowed bool
|
|
|
|
RootPrivs bool
|
|
|
|
IsRoot bool
|
|
|
|
MFAMethods []string
|
|
|
|
ControlGroup *ControlGroup
|
|
|
|
CapabilitiesBitmap uint32
|
2022-05-17 02:23:08 +03:00
|
|
|
GrantingPolicies []logical.PolicyInfo
|
|
|
|
}
|
|
|
|
|
|
|
|
type SentinelResults struct {
|
|
|
|
GrantingPolicies []logical.PolicyInfo
|
2017-10-23 23:42:56 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// NewACL is used to construct a policy based ACL from a set of policies.
|
|
|
|
func NewACL(ctx context.Context, policies []*Policy) (*ACL, error) {
|
2015-03-18 04:31:20 +03:00
|
|
|
// Initialize
|
|
|
|
a := &ACL{
|
2019-02-15 05:31:43 +03:00
|
|
|
exactRules: radix.New(),
|
|
|
|
prefixRules: radix.New(),
|
|
|
|
segmentWildcardPaths: make(map[string]interface{}, len(policies)),
|
|
|
|
root: false,
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if ns == nil {
|
|
|
|
return nil, namespace.ErrNoNamespace
|
|
|
|
}
|
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
// Inject each policy
|
|
|
|
for _, policy := range policies {
|
2015-03-25 01:49:17 +03:00
|
|
|
// Ignore a nil policy object
|
|
|
|
if policy == nil {
|
|
|
|
continue
|
|
|
|
}
|
2017-10-23 23:42:56 +03:00
|
|
|
|
|
|
|
switch policy.Type {
|
|
|
|
case PolicyTypeACL:
|
2018-09-18 06:03:00 +03:00
|
|
|
case PolicyTypeRGP:
|
|
|
|
a.rgpPolicies = append(a.rgpPolicies, policy)
|
|
|
|
continue
|
2017-10-23 23:42:56 +03:00
|
|
|
default:
|
|
|
|
return nil, fmt.Errorf("unable to parse policy (wrong type)")
|
|
|
|
}
|
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
// Check if this is root
|
|
|
|
if policy.Name == "root" {
|
2018-09-18 06:03:00 +03:00
|
|
|
if ns.ID != namespace.RootNamespaceID {
|
|
|
|
return nil, fmt.Errorf("root policy is only allowed in root namespace")
|
|
|
|
}
|
|
|
|
|
2018-08-21 23:12:23 +03:00
|
|
|
if len(policies) != 1 {
|
|
|
|
return nil, fmt.Errorf("other policies present along with root")
|
|
|
|
}
|
2015-03-18 04:31:20 +03:00
|
|
|
a.root = true
|
|
|
|
}
|
2018-08-21 23:12:23 +03:00
|
|
|
|
2016-01-07 23:10:05 +03:00
|
|
|
for _, pc := range policy.Paths {
|
2019-02-15 05:31:43 +03:00
|
|
|
var raw interface{}
|
|
|
|
var ok bool
|
|
|
|
var tree *radix.Tree
|
|
|
|
|
|
|
|
switch {
|
|
|
|
case pc.HasSegmentWildcards:
|
|
|
|
raw, ok = a.segmentWildcardPaths[pc.Path]
|
|
|
|
default:
|
|
|
|
// Check which tree to use
|
|
|
|
tree = a.exactRules
|
|
|
|
if pc.IsPrefix {
|
|
|
|
tree = a.prefixRules
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check for an existing policy
|
|
|
|
raw, ok = tree.Get(pc.Path)
|
2015-07-06 02:31:30 +03:00
|
|
|
}
|
2016-10-22 04:38:05 +03:00
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
if !ok {
|
2017-06-07 20:49:51 +03:00
|
|
|
clonedPerms, err := pc.Permissions.Clone()
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("error cloning ACL permissions: %w", err)
|
2017-06-07 20:49:51 +03:00
|
|
|
}
|
2022-05-17 02:23:08 +03:00
|
|
|
|
|
|
|
// Store this policy name as the policy that permits these
|
|
|
|
// capabilities
|
|
|
|
clonedPerms.GrantingPoliciesMap = addGrantingPoliciesToMap(nil, policy, clonedPerms.CapabilitiesBitmap)
|
2019-02-15 05:31:43 +03:00
|
|
|
switch {
|
|
|
|
case pc.HasSegmentWildcards:
|
|
|
|
a.segmentWildcardPaths[pc.Path] = clonedPerms
|
|
|
|
default:
|
|
|
|
tree.Insert(pc.Path, clonedPerms)
|
|
|
|
}
|
2015-03-18 04:31:20 +03:00
|
|
|
continue
|
|
|
|
}
|
2016-10-28 22:33:50 +03:00
|
|
|
|
|
|
|
// these are the ones already in the tree
|
2017-10-23 23:42:56 +03:00
|
|
|
existingPerms := raw.(*ACLPermissions)
|
2016-01-07 23:10:05 +03:00
|
|
|
|
|
|
|
switch {
|
2016-12-07 05:14:15 +03:00
|
|
|
case existingPerms.CapabilitiesBitmap&DenyCapabilityInt > 0:
|
2016-01-07 23:10:05 +03:00
|
|
|
// If we are explicitly denied in the existing capability set,
|
|
|
|
// don't save anything else
|
2016-12-07 05:14:15 +03:00
|
|
|
continue
|
2016-01-07 23:10:05 +03:00
|
|
|
|
2016-10-10 01:39:58 +03:00
|
|
|
case pc.Permissions.CapabilitiesBitmap&DenyCapabilityInt > 0:
|
2016-01-07 23:10:05 +03:00
|
|
|
// If this new policy explicitly denies, only save the deny value
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.CapabilitiesBitmap = DenyCapabilityInt
|
|
|
|
existingPerms.AllowedParameters = nil
|
|
|
|
existingPerms.DeniedParameters = nil
|
2016-12-07 05:14:15 +03:00
|
|
|
goto INSERT
|
2015-03-18 04:31:20 +03:00
|
|
|
|
2016-01-07 23:10:05 +03:00
|
|
|
default:
|
|
|
|
// Insert the capabilities in this new policy into the existing
|
2016-03-03 21:37:51 +03:00
|
|
|
// value
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.CapabilitiesBitmap = existingPerms.CapabilitiesBitmap | pc.Permissions.CapabilitiesBitmap
|
2022-05-17 02:23:08 +03:00
|
|
|
existingPerms.GrantingPoliciesMap = addGrantingPoliciesToMap(existingPerms.GrantingPoliciesMap, policy, pc.Permissions.CapabilitiesBitmap)
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
2016-10-17 01:24:32 +03:00
|
|
|
|
2017-02-27 22:42:00 +03:00
|
|
|
// Note: In these stanzas, we're preferring minimum lifetimes. So
|
|
|
|
// we take the lesser of two specified max values, or we take the
|
|
|
|
// lesser of two specified min values, the idea being, allowing
|
|
|
|
// token lifetime to be minimum possible.
|
|
|
|
//
|
|
|
|
// If we have an existing max, and we either don't have a current
|
|
|
|
// max, or the current is greater than the previous, use the
|
|
|
|
// existing.
|
2017-06-07 20:49:51 +03:00
|
|
|
if pc.Permissions.MaxWrappingTTL > 0 &&
|
|
|
|
(existingPerms.MaxWrappingTTL == 0 ||
|
|
|
|
pc.Permissions.MaxWrappingTTL < existingPerms.MaxWrappingTTL) {
|
|
|
|
existingPerms.MaxWrappingTTL = pc.Permissions.MaxWrappingTTL
|
2017-02-27 22:42:00 +03:00
|
|
|
}
|
|
|
|
// If we have an existing min, and we either don't have a current
|
|
|
|
// min, or the current is greater than the previous, use the
|
|
|
|
// existing
|
2017-06-07 20:49:51 +03:00
|
|
|
if pc.Permissions.MinWrappingTTL > 0 &&
|
|
|
|
(existingPerms.MinWrappingTTL == 0 ||
|
|
|
|
pc.Permissions.MinWrappingTTL < existingPerms.MinWrappingTTL) {
|
|
|
|
existingPerms.MinWrappingTTL = pc.Permissions.MinWrappingTTL
|
2017-02-27 22:42:00 +03:00
|
|
|
}
|
|
|
|
|
2017-06-07 20:49:51 +03:00
|
|
|
if len(pc.Permissions.AllowedParameters) > 0 {
|
|
|
|
if existingPerms.AllowedParameters == nil {
|
2018-05-18 23:33:49 +03:00
|
|
|
clonedAllowed, err := copystructure.Copy(pc.Permissions.AllowedParameters)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
existingPerms.AllowedParameters = clonedAllowed.(map[string][]interface{})
|
2017-02-22 02:02:39 +03:00
|
|
|
} else {
|
2017-06-07 20:49:51 +03:00
|
|
|
for key, value := range pc.Permissions.AllowedParameters {
|
|
|
|
pcValue, ok := existingPerms.AllowedParameters[key]
|
2017-02-22 02:53:27 +03:00
|
|
|
// If an empty array exist it should overwrite any other
|
|
|
|
// value.
|
|
|
|
if len(value) == 0 || (ok && len(pcValue) == 0) {
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.AllowedParameters[key] = []interface{}{}
|
2017-02-22 02:53:27 +03:00
|
|
|
} else {
|
|
|
|
// Merge the two maps, appending values on key conflict.
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.AllowedParameters[key] = append(value, existingPerms.AllowedParameters[key]...)
|
2017-02-22 02:53:27 +03:00
|
|
|
}
|
2017-02-22 02:02:39 +03:00
|
|
|
}
|
2016-12-07 05:14:15 +03:00
|
|
|
}
|
2016-10-22 04:38:05 +03:00
|
|
|
}
|
|
|
|
|
2017-06-07 20:49:51 +03:00
|
|
|
if len(pc.Permissions.DeniedParameters) > 0 {
|
|
|
|
if existingPerms.DeniedParameters == nil {
|
2018-05-18 23:33:49 +03:00
|
|
|
clonedDenied, err := copystructure.Copy(pc.Permissions.DeniedParameters)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
existingPerms.DeniedParameters = clonedDenied.(map[string][]interface{})
|
2017-02-22 02:02:39 +03:00
|
|
|
} else {
|
2017-06-07 20:49:51 +03:00
|
|
|
for key, value := range pc.Permissions.DeniedParameters {
|
|
|
|
pcValue, ok := existingPerms.DeniedParameters[key]
|
2017-02-22 02:53:27 +03:00
|
|
|
// If an empty array exist it should overwrite any other
|
|
|
|
// value.
|
|
|
|
if len(value) == 0 || (ok && len(pcValue) == 0) {
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.DeniedParameters[key] = []interface{}{}
|
2017-02-22 02:53:27 +03:00
|
|
|
} else {
|
|
|
|
// Merge the two maps, appending values on key conflict.
|
2017-06-07 20:49:51 +03:00
|
|
|
existingPerms.DeniedParameters[key] = append(value, existingPerms.DeniedParameters[key]...)
|
2017-02-22 02:53:27 +03:00
|
|
|
}
|
2017-02-22 02:02:39 +03:00
|
|
|
}
|
2016-12-07 05:14:15 +03:00
|
|
|
}
|
2016-10-22 04:38:05 +03:00
|
|
|
}
|
|
|
|
|
2017-11-02 14:18:49 +03:00
|
|
|
if len(pc.Permissions.RequiredParameters) > 0 {
|
|
|
|
if len(existingPerms.RequiredParameters) == 0 {
|
|
|
|
existingPerms.RequiredParameters = pc.Permissions.RequiredParameters
|
|
|
|
} else {
|
|
|
|
for _, v := range pc.Permissions.RequiredParameters {
|
|
|
|
if !strutil.StrListContains(existingPerms.RequiredParameters, v) {
|
|
|
|
existingPerms.RequiredParameters = append(existingPerms.RequiredParameters, v)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
if len(pc.Permissions.MFAMethods) > 0 {
|
|
|
|
if existingPerms.MFAMethods == nil {
|
|
|
|
existingPerms.MFAMethods = pc.Permissions.MFAMethods
|
|
|
|
} else {
|
2022-07-22 21:13:14 +03:00
|
|
|
existingPerms.MFAMethods = append(existingPerms.MFAMethods, pc.Permissions.MFAMethods...)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
existingPerms.MFAMethods = strutil.RemoveDuplicates(existingPerms.MFAMethods, false)
|
|
|
|
}
|
|
|
|
|
2021-06-07 19:15:35 +03:00
|
|
|
// No need to dedupe this list since any authorization can satisfy any factor, so long as
|
|
|
|
// the factor matches the specified permission requested.
|
2018-09-18 06:03:00 +03:00
|
|
|
if pc.Permissions.ControlGroup != nil {
|
|
|
|
if len(pc.Permissions.ControlGroup.Factors) > 0 {
|
|
|
|
if existingPerms.ControlGroup == nil {
|
2022-10-15 02:15:15 +03:00
|
|
|
cg, err := pc.Permissions.ControlGroup.Clone()
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
existingPerms.ControlGroup = cg
|
2018-09-18 06:03:00 +03:00
|
|
|
} else {
|
2022-07-22 21:13:14 +03:00
|
|
|
existingPerms.ControlGroup.Factors = append(existingPerms.ControlGroup.Factors, pc.Permissions.ControlGroup.Factors...)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-10-28 22:33:50 +03:00
|
|
|
INSERT:
|
2019-02-15 05:31:43 +03:00
|
|
|
switch {
|
|
|
|
case pc.HasSegmentWildcards:
|
|
|
|
a.segmentWildcardPaths[pc.Path] = existingPerms
|
|
|
|
default:
|
|
|
|
tree.Insert(pc.Path, existingPerms)
|
|
|
|
}
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return a, nil
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
func (a *ACL) Capabilities(ctx context.Context, path string) (pathCapabilities []string) {
|
|
|
|
req := &logical.Request{
|
|
|
|
Path: path,
|
|
|
|
// doesn't matter, but use List to trigger fallback behavior so we can
|
|
|
|
// model real behavior
|
|
|
|
Operation: logical.ListOperation,
|
2016-03-04 20:04:26 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
res := a.AllowOperation(ctx, req, true)
|
|
|
|
if res.IsRoot {
|
|
|
|
return []string{RootCapability}
|
2018-08-28 02:44:07 +03:00
|
|
|
}
|
2016-03-04 20:04:26 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
capabilities := res.CapabilitiesBitmap
|
2016-03-04 20:04:26 +03:00
|
|
|
|
|
|
|
if capabilities&SudoCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, SudoCapability)
|
|
|
|
}
|
|
|
|
if capabilities&ReadCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, ReadCapability)
|
|
|
|
}
|
|
|
|
if capabilities&ListCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, ListCapability)
|
|
|
|
}
|
|
|
|
if capabilities&UpdateCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, UpdateCapability)
|
|
|
|
}
|
|
|
|
if capabilities&DeleteCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, DeleteCapability)
|
|
|
|
}
|
|
|
|
if capabilities&CreateCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, CreateCapability)
|
|
|
|
}
|
2021-10-13 22:24:31 +03:00
|
|
|
if capabilities&PatchCapabilityInt > 0 {
|
|
|
|
pathCapabilities = append(pathCapabilities, PatchCapability)
|
|
|
|
}
|
2016-03-04 21:21:07 +03:00
|
|
|
|
|
|
|
// If "deny" is explicitly set or if the path has no capabilities at all,
|
|
|
|
// set the path capabilities to "deny"
|
|
|
|
if capabilities&DenyCapabilityInt > 0 || len(pathCapabilities) == 0 {
|
2016-03-04 20:04:26 +03:00
|
|
|
pathCapabilities = []string{DenyCapability}
|
|
|
|
}
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-10-23 23:42:56 +03:00
|
|
|
// AllowOperation is used to check if the given operation is permitted.
|
2019-03-05 01:08:21 +03:00
|
|
|
func (a *ACL) AllowOperation(ctx context.Context, req *logical.Request, capCheckOnly bool) (ret *ACLResults) {
|
|
|
|
ret = new(ACLResults)
|
2017-10-23 23:42:56 +03:00
|
|
|
|
2015-03-18 04:31:20 +03:00
|
|
|
// Fast-path root
|
|
|
|
if a.root {
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
ret.RootPrivs = true
|
|
|
|
ret.IsRoot = true
|
2022-05-17 02:23:08 +03:00
|
|
|
ret.GrantingPolicies = []logical.PolicyInfo{{
|
2023-05-05 01:08:22 +03:00
|
|
|
Name: "root",
|
|
|
|
NamespaceId: "root",
|
|
|
|
NamespacePath: "",
|
|
|
|
Type: "acl",
|
2022-05-17 02:23:08 +03:00
|
|
|
}}
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
2016-10-22 04:38:05 +03:00
|
|
|
op := req.Operation
|
2016-10-10 01:39:58 +03:00
|
|
|
|
2016-01-07 23:10:05 +03:00
|
|
|
// Help is always allowed
|
|
|
|
if op == logical.HelpOperation {
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
return
|
2015-07-06 02:31:30 +03:00
|
|
|
}
|
|
|
|
|
2017-10-23 23:42:56 +03:00
|
|
|
var permissions *ACLPermissions
|
2016-10-22 07:12:02 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
path := ns.Path + req.Path
|
|
|
|
|
2019-02-15 05:31:43 +03:00
|
|
|
// The request path should take care of this already but this is useful for
|
|
|
|
// tests and as defense in depth
|
|
|
|
for {
|
|
|
|
if len(path) > 0 && path[0] == '/' {
|
|
|
|
path = path[1:]
|
|
|
|
} else {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Find an exact matching rule, look for prefix if no match
|
2016-01-13 01:24:01 +03:00
|
|
|
var capabilities uint32
|
2015-07-06 02:31:30 +03:00
|
|
|
raw, ok := a.exactRules.Get(path)
|
2015-03-18 04:31:20 +03:00
|
|
|
if ok {
|
2017-10-23 23:42:56 +03:00
|
|
|
permissions = raw.(*ACLPermissions)
|
2016-10-22 07:12:02 +03:00
|
|
|
capabilities = permissions.CapabilitiesBitmap
|
2015-07-06 02:31:30 +03:00
|
|
|
goto CHECK
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
2018-08-28 02:44:07 +03:00
|
|
|
if op == logical.ListOperation {
|
|
|
|
raw, ok = a.exactRules.Get(strings.TrimSuffix(path, "/"))
|
|
|
|
if ok {
|
|
|
|
permissions = raw.(*ACLPermissions)
|
|
|
|
capabilities = permissions.CapabilitiesBitmap
|
|
|
|
goto CHECK
|
|
|
|
}
|
|
|
|
}
|
2015-03-18 04:31:20 +03:00
|
|
|
|
2023-10-27 17:28:07 +03:00
|
|
|
// List operations need to check without the trailing slash first, because
|
|
|
|
// there could be other rules with trailing wildcards that will match the
|
|
|
|
// path
|
|
|
|
if op == logical.ListOperation && strings.HasSuffix(path, "/") {
|
|
|
|
permissions = a.CheckAllowedFromNonExactPaths(strings.TrimSuffix(path, "/"), false)
|
|
|
|
if permissions != nil {
|
|
|
|
capabilities = permissions.CapabilitiesBitmap
|
|
|
|
goto CHECK
|
|
|
|
}
|
|
|
|
}
|
2019-04-11 00:46:17 +03:00
|
|
|
permissions = a.CheckAllowedFromNonExactPaths(path, false)
|
|
|
|
if permissions != nil {
|
2019-02-15 05:31:43 +03:00
|
|
|
capabilities = permissions.CapabilitiesBitmap
|
|
|
|
goto CHECK
|
2015-07-06 02:31:30 +03:00
|
|
|
}
|
2019-02-15 05:31:43 +03:00
|
|
|
|
|
|
|
// No exact, prefix, or segment wildcard paths found, return without
|
|
|
|
// setting allowed
|
|
|
|
return
|
2015-03-18 04:31:20 +03:00
|
|
|
|
2015-07-06 02:31:30 +03:00
|
|
|
CHECK:
|
2015-03-18 04:31:20 +03:00
|
|
|
// Check if the minimum permissions are met
|
2016-01-07 23:10:05 +03:00
|
|
|
// If "deny" has been explicitly set, only deny will be in the map, so we
|
|
|
|
// only need to check for the existence of other values
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.RootPrivs = capabilities&SudoCapabilityInt > 0
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// This is after the RootPrivs check so we can gate on it being from sudo
|
|
|
|
// rather than policy root
|
|
|
|
if capCheckOnly {
|
|
|
|
ret.CapabilitiesBitmap = capabilities
|
|
|
|
return ret
|
|
|
|
}
|
|
|
|
|
|
|
|
ret.MFAMethods = permissions.MFAMethods
|
|
|
|
ret.ControlGroup = permissions.ControlGroup
|
|
|
|
|
2022-05-17 02:23:08 +03:00
|
|
|
var grantingPolicies []logical.PolicyInfo
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed := false
|
2016-01-13 05:16:31 +03:00
|
|
|
switch op {
|
|
|
|
case logical.ReadOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&ReadCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[ReadCapabilityInt]
|
2016-01-13 05:16:31 +03:00
|
|
|
case logical.ListOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&ListCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[ListCapabilityInt]
|
2016-01-13 05:16:31 +03:00
|
|
|
case logical.UpdateOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&UpdateCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[UpdateCapabilityInt]
|
2016-01-13 05:16:31 +03:00
|
|
|
case logical.DeleteOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&DeleteCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[DeleteCapabilityInt]
|
2016-01-13 05:16:31 +03:00
|
|
|
case logical.CreateOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&CreateCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[CreateCapabilityInt]
|
2021-10-13 22:24:31 +03:00
|
|
|
case logical.PatchOperation:
|
|
|
|
operationAllowed = capabilities&PatchCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[PatchCapabilityInt]
|
2016-01-13 01:10:48 +03:00
|
|
|
|
2017-02-16 09:13:18 +03:00
|
|
|
// These three re-use UpdateCapabilityInt since that's the most appropriate
|
|
|
|
// capability/operation mapping
|
2016-01-13 05:16:31 +03:00
|
|
|
case logical.RevokeOperation, logical.RenewOperation, logical.RollbackOperation:
|
2016-10-10 21:21:25 +03:00
|
|
|
operationAllowed = capabilities&UpdateCapabilityInt > 0
|
2022-05-17 02:23:08 +03:00
|
|
|
grantingPolicies = permissions.GrantingPoliciesMap[UpdateCapabilityInt]
|
2016-01-13 01:10:48 +03:00
|
|
|
|
2016-01-13 01:08:10 +03:00
|
|
|
default:
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2016-01-13 01:08:10 +03:00
|
|
|
}
|
2016-10-10 21:21:25 +03:00
|
|
|
|
|
|
|
if !operationAllowed {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2016-10-10 21:21:25 +03:00
|
|
|
}
|
|
|
|
|
2022-05-17 02:23:08 +03:00
|
|
|
ret.GrantingPolicies = grantingPolicies
|
|
|
|
|
2017-02-27 22:42:00 +03:00
|
|
|
if permissions.MaxWrappingTTL > 0 {
|
|
|
|
if req.WrapInfo == nil || req.WrapInfo.TTL > permissions.MaxWrappingTTL {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2017-02-27 22:42:00 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
if permissions.MinWrappingTTL > 0 {
|
|
|
|
if req.WrapInfo == nil || req.WrapInfo.TTL < permissions.MinWrappingTTL {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2017-02-27 22:42:00 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
// This situation can happen because of merging, even though in a single
|
|
|
|
// path statement we check on ingress
|
|
|
|
if permissions.MinWrappingTTL != 0 &&
|
|
|
|
permissions.MaxWrappingTTL != 0 &&
|
|
|
|
permissions.MaxWrappingTTL < permissions.MinWrappingTTL {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2017-02-27 22:42:00 +03:00
|
|
|
}
|
|
|
|
|
2017-02-16 09:13:18 +03:00
|
|
|
// Only check parameter permissions for operations that can modify
|
|
|
|
// parameters.
|
2021-10-13 22:24:31 +03:00
|
|
|
if op == logical.ReadOperation || op == logical.UpdateOperation || op == logical.CreateOperation || op == logical.PatchOperation {
|
2017-11-02 14:18:49 +03:00
|
|
|
for _, parameter := range permissions.RequiredParameters {
|
|
|
|
if _, ok := req.Data[strings.ToLower(parameter)]; !ok {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-02-22 02:02:39 +03:00
|
|
|
// If there are no data fields, allow
|
2017-02-17 02:20:11 +03:00
|
|
|
if len(req.Data) == 0 {
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
return
|
2017-02-17 02:20:11 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if len(permissions.DeniedParameters) == 0 {
|
|
|
|
goto ALLOWED_PARAMETERS
|
|
|
|
}
|
|
|
|
|
2016-10-22 04:38:05 +03:00
|
|
|
// Check if all parameters have been denied
|
2016-10-22 09:45:39 +03:00
|
|
|
if _, ok := permissions.DeniedParameters["*"]; ok {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2016-10-22 04:38:05 +03:00
|
|
|
}
|
2017-01-17 04:48:22 +03:00
|
|
|
|
|
|
|
for parameter, value := range req.Data {
|
2018-03-20 21:54:10 +03:00
|
|
|
// Check if parameter has been explicitly denied
|
2017-02-17 02:20:11 +03:00
|
|
|
if valueSlice, ok := permissions.DeniedParameters[strings.ToLower(parameter)]; ok {
|
2017-01-17 04:48:22 +03:00
|
|
|
// If the value exists in denied values slice, deny
|
2017-02-16 09:13:18 +03:00
|
|
|
if valueInParameterList(value, valueSlice) {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2017-02-16 09:13:18 +03:00
|
|
|
}
|
2016-10-22 04:38:05 +03:00
|
|
|
}
|
2017-02-17 02:20:11 +03:00
|
|
|
}
|
2017-01-17 04:48:22 +03:00
|
|
|
|
2017-02-17 02:20:11 +03:00
|
|
|
ALLOWED_PARAMETERS:
|
|
|
|
// If we don't have any allowed parameters set, allow
|
|
|
|
if len(permissions.AllowedParameters) == 0 {
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
return
|
2017-02-17 02:20:11 +03:00
|
|
|
}
|
2017-02-16 09:18:20 +03:00
|
|
|
|
2017-02-17 02:20:11 +03:00
|
|
|
_, allowedAll := permissions.AllowedParameters["*"]
|
|
|
|
if len(permissions.AllowedParameters) == 1 && allowedAll {
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
return
|
2017-02-17 02:20:11 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
for parameter, value := range req.Data {
|
|
|
|
valueSlice, ok := permissions.AllowedParameters[strings.ToLower(parameter)]
|
|
|
|
// Requested parameter is not in allowed list
|
|
|
|
if !ok && !allowedAll {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2017-02-17 02:20:11 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// If the value doesn't exists in the allowed values slice,
|
|
|
|
// deny
|
|
|
|
if ok && !valueInParameterList(value, valueSlice) {
|
2017-10-23 23:42:56 +03:00
|
|
|
return
|
2016-10-22 04:38:05 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2016-10-10 21:21:25 +03:00
|
|
|
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
|
|
|
return
|
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2019-04-11 00:46:17 +03:00
|
|
|
type wcPathDescr struct {
|
|
|
|
firstWCOrGlob int
|
|
|
|
wildcards int
|
|
|
|
isPrefix bool
|
|
|
|
wcPath string
|
|
|
|
perms *ACLPermissions
|
|
|
|
}
|
|
|
|
|
|
|
|
// CheckAllowedFromNonExactPaths returns permissions corresponding to a
|
|
|
|
// matching path with wildcards/globs. If bareMount is true, the path should
|
|
|
|
// correspond to a mount prefix, and what is returned is either a non-nil set
|
|
|
|
// of permissions from some allowed path underneath the mount (for use in mount
|
|
|
|
// access checks), or nil indicating no non-deny permissions were found.
|
|
|
|
func (a *ACL) CheckAllowedFromNonExactPaths(path string, bareMount bool) *ACLPermissions {
|
|
|
|
wcPathDescrs := make([]wcPathDescr, 0, len(a.segmentWildcardPaths)+1)
|
|
|
|
|
|
|
|
less := func(i, j int) bool {
|
|
|
|
// In the case of multiple matches, we use this priority order,
|
|
|
|
// which tries to most closely match longest-prefix:
|
|
|
|
//
|
|
|
|
// * First glob or wildcard position (prefer foo/a* over foo/+,
|
|
|
|
// foo/bar/+/baz over foo/+/bar/baz)
|
|
|
|
// * Whether it's a prefix (prefer foo/+/bar over foo/+/ba*,
|
|
|
|
// foo/+ over foo/*)
|
|
|
|
// * Number of wildcard segments (prefer foo/bar/+/baz over foo/+/+/baz)
|
|
|
|
// * Length check (prefer foo/+/bar/ba* over foo/+/bar/b*)
|
|
|
|
// * Lexicographical ordering (preferring less, arbitrarily)
|
|
|
|
//
|
|
|
|
// That final case (lexigraphical) should never really come up. It's more
|
|
|
|
// of a throwing-up-hands scenario akin to panic("should not be here")
|
|
|
|
// statements, but less panicky.
|
|
|
|
|
|
|
|
pdi, pdj := wcPathDescrs[i], wcPathDescrs[j]
|
|
|
|
|
|
|
|
// If the first wildcard (+) or glob (*) occurs earlier in pdi,
|
|
|
|
// pdi is lower priority
|
|
|
|
if pdi.firstWCOrGlob < pdj.firstWCOrGlob {
|
|
|
|
return true
|
|
|
|
} else if pdi.firstWCOrGlob > pdj.firstWCOrGlob {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// If pdi ends in * and pdj doesn't, pdi is lower priority
|
|
|
|
if pdi.isPrefix && !pdj.isPrefix {
|
|
|
|
return true
|
|
|
|
} else if !pdi.isPrefix && pdj.isPrefix {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// If pdi has more wc segs, pdi is lower priority
|
|
|
|
if pdi.wildcards > pdj.wildcards {
|
|
|
|
return true
|
|
|
|
} else if pdi.wildcards < pdj.wildcards {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// If pdi is shorter, it is lower priority
|
|
|
|
if len(pdi.wcPath) < len(pdj.wcPath) {
|
|
|
|
return true
|
|
|
|
} else if len(pdi.wcPath) > len(pdj.wcPath) {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// If pdi is smaller lexicographically, it is lower priority
|
|
|
|
if pdi.wcPath < pdj.wcPath {
|
|
|
|
return true
|
|
|
|
} else if pdi.wcPath > pdj.wcPath {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Find a prefix rule if any.
|
|
|
|
{
|
|
|
|
prefix, raw, ok := a.prefixRules.LongestPrefix(path)
|
|
|
|
if ok {
|
|
|
|
if len(a.segmentWildcardPaths) == 0 {
|
|
|
|
return raw.(*ACLPermissions)
|
|
|
|
}
|
|
|
|
wcPathDescrs = append(wcPathDescrs, wcPathDescr{
|
|
|
|
firstWCOrGlob: len(prefix),
|
|
|
|
wcPath: prefix,
|
|
|
|
isPrefix: true,
|
|
|
|
perms: raw.(*ACLPermissions),
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(a.segmentWildcardPaths) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
pathParts := strings.Split(path, "/")
|
|
|
|
|
|
|
|
SWCPATH:
|
|
|
|
for fullWCPath := range a.segmentWildcardPaths {
|
|
|
|
if fullWCPath == "" {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
pd := wcPathDescr{firstWCOrGlob: strings.Index(fullWCPath, "+")}
|
|
|
|
|
|
|
|
currWCPath := fullWCPath
|
|
|
|
if currWCPath[len(currWCPath)-1] == '*' {
|
|
|
|
pd.isPrefix = true
|
|
|
|
currWCPath = currWCPath[0 : len(currWCPath)-1]
|
|
|
|
}
|
|
|
|
pd.wcPath = currWCPath
|
|
|
|
|
|
|
|
splitCurrWCPath := strings.Split(currWCPath, "/")
|
|
|
|
|
|
|
|
if !bareMount && len(pathParts) < len(splitCurrWCPath) {
|
|
|
|
// check if the path coming in is shorter; if so it can't match
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
if !bareMount && !pd.isPrefix && len(splitCurrWCPath) != len(pathParts) {
|
|
|
|
// If it's not a prefix we expect the same number of segments
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
segments := make([]string, 0, len(splitCurrWCPath))
|
|
|
|
for i, aclPart := range splitCurrWCPath {
|
|
|
|
switch {
|
|
|
|
case aclPart == "+":
|
|
|
|
pd.wildcards++
|
|
|
|
segments = append(segments, pathParts[i])
|
|
|
|
|
|
|
|
case aclPart == pathParts[i]:
|
|
|
|
segments = append(segments, pathParts[i])
|
|
|
|
|
|
|
|
case pd.isPrefix && i == len(splitCurrWCPath)-1 && strings.HasPrefix(pathParts[i], aclPart):
|
|
|
|
segments = append(segments, pathParts[i:]...)
|
|
|
|
|
|
|
|
case !bareMount:
|
|
|
|
// Found a mismatch, give up on this segmentWildcardPath
|
|
|
|
continue SWCPATH
|
|
|
|
}
|
|
|
|
|
|
|
|
// -2 because we're always invoked with a trailing "/" in case bareMount.
|
|
|
|
if bareMount && i == len(pathParts)-2 {
|
|
|
|
joinedPath := strings.Join(segments, "/") + "/"
|
|
|
|
// Check the current joined path so far. If we find a prefix,
|
|
|
|
// check permissions. If they're defined but not deny, success.
|
|
|
|
if strings.HasPrefix(joinedPath, path) {
|
|
|
|
permissions := a.segmentWildcardPaths[fullWCPath].(*ACLPermissions)
|
|
|
|
if permissions.CapabilitiesBitmap&DenyCapabilityInt == 0 && permissions.CapabilitiesBitmap > 0 {
|
|
|
|
return permissions
|
|
|
|
}
|
|
|
|
}
|
|
|
|
continue SWCPATH
|
|
|
|
}
|
|
|
|
}
|
|
|
|
pd.perms = a.segmentWildcardPaths[fullWCPath].(*ACLPermissions)
|
|
|
|
wcPathDescrs = append(wcPathDescrs, pd)
|
|
|
|
}
|
|
|
|
|
|
|
|
if bareMount || len(wcPathDescrs) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// We don't do this in the bare mount check because we don't care about
|
|
|
|
// priority, we only care about any capability at all.
|
|
|
|
sort.Slice(wcPathDescrs, less)
|
|
|
|
|
|
|
|
return wcPathDescrs[len(wcPathDescrs)-1].perms
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
func (c *Core) performPolicyChecks(ctx context.Context, acl *ACL, te *logical.TokenEntry, req *logical.Request, inEntity *identity.Entity, opts *PolicyCheckOpts) *AuthResults {
|
|
|
|
ret := new(AuthResults)
|
2017-10-23 23:42:56 +03:00
|
|
|
|
|
|
|
// First, perform normal ACL checks if requested. The only time no ACL
|
|
|
|
// should be applied is if we are only processing EGPs against a login
|
|
|
|
// path in which case opts.Unauth will be set.
|
|
|
|
if acl != nil && !opts.Unauth {
|
2019-03-05 01:08:21 +03:00
|
|
|
ret.ACLResults = acl.AllowOperation(ctx, req, false)
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.RootPrivs = ret.ACLResults.RootPrivs
|
|
|
|
// Root is always allowed; skip Sentinel/MFA checks
|
|
|
|
if ret.ACLResults.IsRoot {
|
2021-04-08 19:43:39 +03:00
|
|
|
// logger.Warn("token is root, skipping checks")
|
2017-10-23 23:42:56 +03:00
|
|
|
ret.Allowed = true
|
2018-09-18 06:03:00 +03:00
|
|
|
return ret
|
2017-10-23 23:42:56 +03:00
|
|
|
}
|
|
|
|
if !ret.ACLResults.Allowed {
|
2018-09-18 06:03:00 +03:00
|
|
|
return ret
|
2017-10-23 23:42:56 +03:00
|
|
|
}
|
2023-01-10 21:17:16 +03:00
|
|
|
// Since HelpOperation was fast-pathed inside AllowOperation, RootPrivs will not have been populated in this
|
|
|
|
// case, so we need to special-case that here as well, or we'll block HelpOperation on all sudo-protected paths.
|
|
|
|
if !ret.RootPrivs && opts.RootPrivsRequired && req.Operation != logical.HelpOperation {
|
2018-09-18 06:03:00 +03:00
|
|
|
return ret
|
2017-10-23 23:42:56 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
c.performEntPolicyChecks(ctx, acl, te, req, inEntity, opts, ret)
|
|
|
|
|
|
|
|
return ret
|
2015-03-18 04:31:20 +03:00
|
|
|
}
|
2017-01-17 04:48:22 +03:00
|
|
|
|
|
|
|
func valueInParameterList(v interface{}, list []interface{}) bool {
|
2017-02-22 03:06:00 +03:00
|
|
|
// Empty list is equivalent to the item always existing in the list
|
2017-02-17 02:20:11 +03:00
|
|
|
if len(list) == 0 {
|
2017-01-17 04:48:22 +03:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
return valueInSlice(v, list)
|
|
|
|
}
|
|
|
|
|
|
|
|
func valueInSlice(v interface{}, list []interface{}) bool {
|
|
|
|
for _, el := range list {
|
2019-04-27 01:57:00 +03:00
|
|
|
if el == nil || v == nil {
|
|
|
|
// It doesn't seem possible to set up a nil entry in the list, but it is possible
|
|
|
|
// to pass in a null entry in the API request being checked. Just in case,
|
|
|
|
// nil will match nil.
|
|
|
|
if el == v {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
} else if reflect.TypeOf(el).String() == "string" && reflect.TypeOf(v).String() == "string" {
|
2017-03-04 01:50:55 +03:00
|
|
|
item := el.(string)
|
|
|
|
val := v.(string)
|
|
|
|
|
|
|
|
if strutil.GlobbedStringsMatch(item, val) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
} else if reflect.DeepEqual(el, v) {
|
2017-01-17 04:48:22 +03:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|