2023-03-15 19:00:52 +03:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2024-01-02 21:36:20 +03:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-15 19:00:52 +03:00
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
package vault
|
|
|
|
|
|
|
|
import (
|
2018-01-19 09:44:44 +03:00
|
|
|
"context"
|
2015-03-18 22:17:03 +03:00
|
|
|
"fmt"
|
2018-09-18 06:03:00 +03:00
|
|
|
"path"
|
2017-02-17 04:13:19 +03:00
|
|
|
"strings"
|
2017-10-23 22:11:29 +03:00
|
|
|
"sync"
|
2015-04-09 02:43:17 +03:00
|
|
|
"time"
|
2015-03-18 22:17:03 +03:00
|
|
|
|
2023-01-03 17:02:01 +03:00
|
|
|
"github.com/armon/go-metrics"
|
2018-04-03 03:46:59 +03:00
|
|
|
log "github.com/hashicorp/go-hclog"
|
2021-07-16 03:17:31 +03:00
|
|
|
"github.com/hashicorp/go-secure-stdlib/strutil"
|
2019-01-09 03:48:57 +03:00
|
|
|
lru "github.com/hashicorp/golang-lru"
|
2018-08-15 21:42:56 +03:00
|
|
|
"github.com/hashicorp/vault/helper/identity"
|
2018-09-18 06:03:00 +03:00
|
|
|
"github.com/hashicorp/vault/helper/namespace"
|
2019-04-13 10:44:06 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/helper/consts"
|
2019-04-13 00:54:35 +03:00
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
2015-03-18 22:17:03 +03:00
|
|
|
)
|
|
|
|
|
2015-03-19 00:00:42 +03:00
|
|
|
const (
|
2018-09-18 06:03:00 +03:00
|
|
|
// policySubPath is the sub-path used for the policy store view. This is
|
|
|
|
// nested under the system view. policyRGPSubPath/policyEGPSubPath are
|
|
|
|
// similar but for RGPs/EGPs.
|
2017-10-23 21:59:37 +03:00
|
|
|
policyACLSubPath = "policy/"
|
2018-09-18 06:03:00 +03:00
|
|
|
policyRGPSubPath = "policy-rgp/"
|
|
|
|
policyEGPSubPath = "policy-egp/"
|
2015-04-07 02:41:48 +03:00
|
|
|
|
|
|
|
// policyCacheSize is the number of policies that are kept cached
|
|
|
|
policyCacheSize = 1024
|
2016-05-02 07:08:07 +03:00
|
|
|
|
2017-11-13 23:31:32 +03:00
|
|
|
// defaultPolicyName is the name of the default policy
|
|
|
|
defaultPolicyName = "default"
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
// responseWrappingPolicyName is the name of the fixed policy
|
|
|
|
responseWrappingPolicyName = "response-wrapping"
|
|
|
|
|
2017-11-13 23:31:32 +03:00
|
|
|
// controlGroupPolicyName is the name of the fixed policy for control group
|
|
|
|
// tokens
|
|
|
|
controlGroupPolicyName = "control-group"
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
// responseWrappingPolicy is the policy that ensures cubbyhole response
|
2017-07-31 23:16:16 +03:00
|
|
|
// wrapping can always succeed.
|
2016-09-29 07:01:28 +03:00
|
|
|
responseWrappingPolicy = `
|
2016-05-02 07:08:07 +03:00
|
|
|
path "cubbyhole/response" {
|
|
|
|
capabilities = ["create", "read"]
|
|
|
|
}
|
2016-09-29 07:01:28 +03:00
|
|
|
|
|
|
|
path "sys/wrapping/unwrap" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
2016-08-09 01:33:31 +03:00
|
|
|
`
|
2018-09-18 06:03:00 +03:00
|
|
|
// controlGroupPolicy is the policy that ensures control group requests can
|
|
|
|
// commit themselves
|
|
|
|
controlGroupPolicy = `
|
|
|
|
path "cubbyhole/control-group" {
|
|
|
|
capabilities = ["update", "create", "read"]
|
|
|
|
}
|
2016-08-09 01:33:31 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
path "sys/wrapping/unwrap" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
`
|
2016-08-09 01:33:31 +03:00
|
|
|
// defaultPolicy is the "default" policy
|
|
|
|
defaultPolicy = `
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow tokens to look up their own properties
|
2016-08-09 01:33:31 +03:00
|
|
|
path "auth/token/lookup-self" {
|
|
|
|
capabilities = ["read"]
|
|
|
|
}
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow tokens to renew themselves
|
2016-08-09 01:33:31 +03:00
|
|
|
path "auth/token/renew-self" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow tokens to revoke themselves
|
2016-08-09 01:33:31 +03:00
|
|
|
path "auth/token/revoke-self" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow a token to look up its own capabilities on a path
|
|
|
|
path "sys/capabilities-self" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
2019-01-29 18:43:59 +03:00
|
|
|
# Allow a token to look up its own entity by id or name
|
|
|
|
path "identity/entity/id/{{identity.entity.id}}" {
|
|
|
|
capabilities = ["read"]
|
|
|
|
}
|
|
|
|
path "identity/entity/name/{{identity.entity.name}}" {
|
|
|
|
capabilities = ["read"]
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2018-04-20 21:19:04 +03:00
|
|
|
# Allow a token to look up its resultant ACL from all policies. This is useful
|
|
|
|
# for UIs. It is an internal path because the format may change at any time
|
|
|
|
# based on how the internal ACL features and capabilities change.
|
|
|
|
path "sys/internal/ui/resultant-acl" {
|
|
|
|
capabilities = ["read"]
|
|
|
|
}
|
|
|
|
|
2017-05-04 03:22:16 +03:00
|
|
|
# Allow a token to renew a lease via lease_id in the request body; old path for
|
|
|
|
# old clients, new path for newer
|
2016-09-29 07:01:28 +03:00
|
|
|
path "sys/renew" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
2017-05-04 03:22:16 +03:00
|
|
|
path "sys/leases/renew" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
|
|
|
# Allow looking up lease properties. This requires knowing the lease ID ahead
|
2017-05-04 03:25:55 +03:00
|
|
|
# of time and does not divulge any sensitive information.
|
2017-05-04 03:22:16 +03:00
|
|
|
path "sys/leases/lookup" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
2016-09-29 07:01:28 +03:00
|
|
|
|
|
|
|
# Allow a token to manage its own cubbyhole
|
2016-08-09 01:33:31 +03:00
|
|
|
path "cubbyhole/*" {
|
|
|
|
capabilities = ["create", "read", "update", "delete", "list"]
|
|
|
|
}
|
|
|
|
|
2017-07-14 01:47:29 +03:00
|
|
|
# Allow a token to wrap arbitrary values in a response-wrapping token
|
|
|
|
path "sys/wrapping/wrap" {
|
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow a token to look up the creation time and TTL of a given
|
|
|
|
# response-wrapping token
|
|
|
|
path "sys/wrapping/lookup" {
|
2016-08-09 01:33:31 +03:00
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
|
|
|
|
2016-09-29 07:01:28 +03:00
|
|
|
# Allow a token to unwrap a response-wrapping token. This is a convenience to
|
|
|
|
# avoid client token swapping since this is also part of the response wrapping
|
|
|
|
# policy.
|
|
|
|
path "sys/wrapping/unwrap" {
|
2016-08-09 01:33:31 +03:00
|
|
|
capabilities = ["update"]
|
|
|
|
}
|
2017-10-20 17:59:17 +03:00
|
|
|
|
|
|
|
# Allow general purpose tools
|
|
|
|
path "sys/tools/hash" {
|
2018-07-11 19:46:30 +03:00
|
|
|
capabilities = ["update"]
|
2017-10-20 17:59:17 +03:00
|
|
|
}
|
|
|
|
path "sys/tools/hash/*" {
|
2018-07-11 19:46:30 +03:00
|
|
|
capabilities = ["update"]
|
2017-10-20 17:59:17 +03:00
|
|
|
}
|
2018-07-11 19:46:30 +03:00
|
|
|
|
|
|
|
# Allow checking the status of a Control Group request if the user has the
|
|
|
|
# accessor
|
|
|
|
path "sys/control-group/request" {
|
|
|
|
capabilities = ["update"]
|
2017-10-20 17:59:17 +03:00
|
|
|
}
|
2021-09-27 20:55:29 +03:00
|
|
|
|
|
|
|
# Allow a token to make requests to the Authorization Endpoint for OIDC providers.
|
|
|
|
path "identity/oidc/provider/+/authorize" {
|
2023-02-09 23:18:14 +03:00
|
|
|
capabilities = ["read", "update"]
|
2021-09-27 20:55:29 +03:00
|
|
|
}
|
2016-05-02 07:08:07 +03:00
|
|
|
`
|
2015-03-19 00:00:42 +03:00
|
|
|
)
|
|
|
|
|
2016-05-16 23:11:33 +03:00
|
|
|
var (
|
|
|
|
immutablePolicies = []string{
|
|
|
|
"root",
|
2016-09-29 07:01:28 +03:00
|
|
|
responseWrappingPolicyName,
|
2017-11-13 23:31:32 +03:00
|
|
|
controlGroupPolicyName,
|
2016-05-16 23:11:33 +03:00
|
|
|
}
|
2016-07-25 05:27:41 +03:00
|
|
|
nonAssignablePolicies = []string{
|
2016-09-29 07:01:28 +03:00
|
|
|
responseWrappingPolicyName,
|
2017-11-13 23:31:32 +03:00
|
|
|
controlGroupPolicyName,
|
2016-07-25 05:27:41 +03:00
|
|
|
}
|
2016-05-16 23:11:33 +03:00
|
|
|
)
|
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
// PolicyStore is used to provide durable storage of policy, and to
|
|
|
|
// manage ACLs associated with them.
|
|
|
|
type PolicyStore struct {
|
2018-09-18 06:03:00 +03:00
|
|
|
entPolicyStore
|
|
|
|
|
|
|
|
core *Core
|
|
|
|
aclView *BarrierView
|
|
|
|
rgpView *BarrierView
|
|
|
|
egpView *BarrierView
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
tokenPoliciesLRU *lru.TwoQueueCache
|
2018-09-18 06:03:00 +03:00
|
|
|
egpLRU *lru.TwoQueueCache
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// This is used to ensure that writes to the store (acl/rgp) or to the egp
|
|
|
|
// path tree don't happen concurrently. We are okay reading stale data so
|
|
|
|
// long as there aren't concurrent writes.
|
|
|
|
modifyLock *sync.RWMutex
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// Stores whether a token policy is ACL or RGP
|
|
|
|
policyTypeMap sync.Map
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2018-01-18 09:01:51 +03:00
|
|
|
// logger is the server logger copied over from core
|
|
|
|
logger log.Logger
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
|
|
|
|
2015-07-06 04:14:15 +03:00
|
|
|
// PolicyEntry is used to store a policy by name
|
|
|
|
type PolicyEntry struct {
|
2018-09-18 06:03:00 +03:00
|
|
|
sentinelPolicy
|
|
|
|
|
2018-08-15 21:42:56 +03:00
|
|
|
Version int
|
|
|
|
Raw string
|
|
|
|
Templated bool
|
|
|
|
Type PolicyType
|
2015-07-06 04:14:15 +03:00
|
|
|
}
|
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
// NewPolicyStore creates a new PolicyStore that is backed
|
|
|
|
// using a given view. It used used to durable store and manage named policy.
|
2018-09-18 06:03:00 +03:00
|
|
|
func NewPolicyStore(ctx context.Context, core *Core, baseView *BarrierView, system logical.SystemView, logger log.Logger) (*PolicyStore, error) {
|
2017-10-23 21:59:37 +03:00
|
|
|
ps := &PolicyStore{
|
2017-10-23 22:11:29 +03:00
|
|
|
aclView: baseView.SubView(policyACLSubPath),
|
2018-09-18 06:03:00 +03:00
|
|
|
rgpView: baseView.SubView(policyRGPSubPath),
|
|
|
|
egpView: baseView.SubView(policyEGPSubPath),
|
2017-10-23 22:11:29 +03:00
|
|
|
modifyLock: new(sync.RWMutex),
|
2018-01-18 09:01:51 +03:00
|
|
|
logger: logger,
|
2018-02-23 22:00:46 +03:00
|
|
|
core: core,
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
ps.extraInit()
|
|
|
|
|
2016-04-21 23:32:06 +03:00
|
|
|
if !system.CachingDisabled() {
|
2016-04-21 16:52:42 +03:00
|
|
|
cache, _ := lru.New2Q(policyCacheSize)
|
2017-10-23 21:59:37 +03:00
|
|
|
ps.tokenPoliciesLRU = cache
|
2018-09-18 06:03:00 +03:00
|
|
|
cache, _ = lru.New2Q(policyCacheSize)
|
|
|
|
ps.egpLRU = cache
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
aclView := ps.getACLView(namespace.RootNamespace)
|
|
|
|
keys, err := logical.CollectKeys(namespace.RootContext(ctx), aclView)
|
2017-10-23 21:59:37 +03:00
|
|
|
if err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
ps.logger.Error("error collecting acl policy keys", "error", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
return nil, err
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
for _, key := range keys {
|
2018-09-18 06:03:00 +03:00
|
|
|
index := ps.cacheKey(namespace.RootNamespace, ps.sanitizeName(key))
|
|
|
|
ps.policyTypeMap.Store(index, PolicyTypeACL)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
if err := ps.loadNamespacePolicies(ctx, core); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// Special-case root; doesn't exist on disk but does need to be found
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.policyTypeMap.Store(ps.cacheKey(namespace.RootNamespace, "root"), PolicyTypeACL)
|
|
|
|
return ps, nil
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
|
|
|
|
2015-03-19 00:00:42 +03:00
|
|
|
// setupPolicyStore is used to initialize the policy store
|
|
|
|
// when the vault is being unsealed.
|
2018-01-19 09:44:44 +03:00
|
|
|
func (c *Core) setupPolicyStore(ctx context.Context) error {
|
2015-03-19 00:00:42 +03:00
|
|
|
// Create the policy store
|
2018-09-18 06:03:00 +03:00
|
|
|
var err error
|
2022-10-05 15:56:36 +03:00
|
|
|
sysView := &dynamicSystemView{core: c, perfStandby: c.perfStandby}
|
2018-09-05 22:52:54 +03:00
|
|
|
psLogger := c.baseLogger.Named("policy")
|
2023-11-04 00:40:17 +03:00
|
|
|
c.AddLogger(psLogger)
|
2018-09-18 06:03:00 +03:00
|
|
|
c.policyStore, err = NewPolicyStore(ctx, c, c.systemBarrierView, sysView, psLogger)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2017-02-17 04:13:19 +03:00
|
|
|
|
2019-06-21 03:55:10 +03:00
|
|
|
if c.ReplicationState().HasState(consts.ReplicationPerformanceSecondary | consts.ReplicationDRSecondary) {
|
2017-02-17 04:13:19 +03:00
|
|
|
// Policies will sync from the primary
|
|
|
|
return nil
|
|
|
|
}
|
2015-11-06 19:52:26 +03:00
|
|
|
|
2022-11-03 20:01:39 +03:00
|
|
|
if c.perfStandby {
|
|
|
|
// Policies will sync from the active
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2015-11-07 01:27:15 +03:00
|
|
|
// Ensure that the default policy exists, and if not, create it
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := c.policyStore.loadACLPolicy(ctx, defaultPolicyName, defaultPolicy); err != nil {
|
2017-11-13 23:31:32 +03:00
|
|
|
return err
|
2015-11-07 01:27:15 +03:00
|
|
|
}
|
2017-11-13 23:31:32 +03:00
|
|
|
// Ensure that the response wrapping policy exists
|
2018-01-19 09:44:44 +03:00
|
|
|
if err := c.policyStore.loadACLPolicy(ctx, responseWrappingPolicyName, responseWrappingPolicy); err != nil {
|
2017-11-13 23:31:32 +03:00
|
|
|
return err
|
2016-05-02 07:08:07 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
// Ensure that the control group policy exists
|
|
|
|
if err := c.policyStore.loadACLPolicy(ctx, controlGroupPolicyName, controlGroupPolicy); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2016-05-02 07:08:07 +03:00
|
|
|
|
2015-03-19 00:00:42 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// teardownPolicyStore is used to reverse setupPolicyStore
|
|
|
|
// when the vault is being sealed.
|
|
|
|
func (c *Core) teardownPolicyStore() error {
|
2015-11-06 19:52:26 +03:00
|
|
|
c.policyStore = nil
|
2015-03-19 00:00:42 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) invalidate(ctx context.Context, name string, policyType PolicyType) {
|
2018-09-18 06:03:00 +03:00
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
ps.logger.Error("unable to invalidate key, no namespace info passed", "key", name)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// This may come with a prefixed "/" due to joining the file path
|
|
|
|
saneName := strings.TrimPrefix(name, "/")
|
2018-09-18 06:03:00 +03:00
|
|
|
index := ps.cacheKey(ns, saneName)
|
|
|
|
|
|
|
|
ps.modifyLock.Lock()
|
|
|
|
defer ps.modifyLock.Unlock()
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
// We don't lock before removing from the LRU here because the worst that
|
|
|
|
// can happen is we load again if something since added it
|
|
|
|
switch policyType {
|
2018-09-18 06:03:00 +03:00
|
|
|
case PolicyTypeACL, PolicyTypeRGP:
|
2017-10-23 21:59:37 +03:00
|
|
|
if ps.tokenPoliciesLRU != nil {
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.tokenPoliciesLRU.Remove(index)
|
|
|
|
}
|
|
|
|
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
if ps.egpLRU != nil {
|
|
|
|
ps.egpLRU.Remove(index)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
default:
|
|
|
|
// Can't do anything
|
2017-02-17 04:13:19 +03:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// Force a reload
|
2018-09-18 06:03:00 +03:00
|
|
|
out, err := ps.switchedGetPolicy(ctx, name, policyType, false)
|
2017-10-23 21:59:37 +03:00
|
|
|
if err != nil {
|
2018-04-03 03:46:59 +03:00
|
|
|
ps.logger.Error("error fetching policy after invalidation", "name", saneName)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
// If true, the invalidation was actually a delete, so we may need to
|
|
|
|
// perform further deletion tasks. We skip the physical deletion just in
|
|
|
|
// case another process has re-written the policy; instead next time Get is
|
|
|
|
// called the values will be loaded back in.
|
|
|
|
if out == nil {
|
2019-06-18 17:25:26 +03:00
|
|
|
ps.switchedDeletePolicy(ctx, name, policyType, false, true)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return
|
2017-02-17 04:13:19 +03:00
|
|
|
}
|
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
// SetPolicy is used to create or update the given policy
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) SetPolicy(ctx context.Context, p *Policy) error {
|
2015-04-09 02:43:17 +03:00
|
|
|
defer metrics.MeasureSince([]string{"policy", "set_policy"}, time.Now())
|
2017-10-23 21:59:37 +03:00
|
|
|
if p == nil {
|
|
|
|
return fmt.Errorf("nil policy passed in for storage")
|
|
|
|
}
|
2015-03-18 22:17:03 +03:00
|
|
|
if p.Name == "" {
|
|
|
|
return fmt.Errorf("policy name missing")
|
|
|
|
}
|
2017-08-19 02:47:23 +03:00
|
|
|
// Policies are normalized to lower-case
|
2017-10-23 21:59:37 +03:00
|
|
|
p.Name = ps.sanitizeName(p.Name)
|
2016-07-25 16:46:10 +03:00
|
|
|
if strutil.StrListContains(immutablePolicies, p.Name) {
|
2018-04-05 18:49:21 +03:00
|
|
|
return fmt.Errorf("cannot update %q policy", p.Name)
|
2016-05-16 23:11:33 +03:00
|
|
|
}
|
2015-03-18 22:17:03 +03:00
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
return ps.setPolicyInternal(ctx, p)
|
2016-05-02 07:08:07 +03:00
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) setPolicyInternal(ctx context.Context, p *Policy) error {
|
2017-10-23 21:59:37 +03:00
|
|
|
ps.modifyLock.Lock()
|
|
|
|
defer ps.modifyLock.Unlock()
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
// Get the appropriate view based on policy type and namespace
|
|
|
|
view := ps.getBarrierView(p.namespace, p.Type)
|
|
|
|
if view == nil {
|
|
|
|
return fmt.Errorf("unable to get the barrier subview for policy type %q", p.Type)
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := ps.parseEGPPaths(p); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2015-07-06 04:14:15 +03:00
|
|
|
// Create the entry
|
|
|
|
entry, err := logical.StorageEntryJSON(p.Name, &PolicyEntry{
|
2018-09-18 06:03:00 +03:00
|
|
|
Version: 2,
|
|
|
|
Raw: p.Raw,
|
|
|
|
Type: p.Type,
|
|
|
|
Templated: p.Templated,
|
|
|
|
sentinelPolicy: p.sentinelPolicy,
|
2015-07-06 04:14:15 +03:00
|
|
|
})
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to create entry: %w", err)
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
// Construct the cache key
|
|
|
|
index := ps.cacheKey(p.namespace, p.Name)
|
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
switch p.Type {
|
|
|
|
case PolicyTypeACL:
|
2018-09-18 06:03:00 +03:00
|
|
|
rgpView := ps.getRGPView(p.namespace)
|
|
|
|
rgp, err := rgpView.Get(ctx, entry.Key)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed looking up conflicting policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
if rgp != nil {
|
|
|
|
return fmt.Errorf("cannot reuse policy names between ACLs and RGPs")
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := view.Put(ctx, entry); err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to persist policy: %w", err)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
ps.policyTypeMap.Store(index, PolicyTypeACL)
|
2015-04-07 02:41:48 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
if ps.tokenPoliciesLRU != nil {
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.tokenPoliciesLRU.Add(index, p)
|
|
|
|
}
|
|
|
|
|
|
|
|
case PolicyTypeRGP:
|
|
|
|
aclView := ps.getACLView(p.namespace)
|
|
|
|
acl, err := aclView.Get(ctx, entry.Key)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed looking up conflicting policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
if acl != nil {
|
|
|
|
return fmt.Errorf("cannot reuse policy names between ACLs and RGPs")
|
|
|
|
}
|
|
|
|
|
|
|
|
if err := ps.handleSentinelPolicy(ctx, p, view, entry); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
ps.policyTypeMap.Store(index, PolicyTypeRGP)
|
|
|
|
|
|
|
|
// We load here after successfully loading into Sentinel so that on
|
|
|
|
// error we will try loading again on the next get
|
|
|
|
if ps.tokenPoliciesLRU != nil {
|
|
|
|
ps.tokenPoliciesLRU.Add(index, p)
|
|
|
|
}
|
|
|
|
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
if err := ps.handleSentinelPolicy(ctx, p, view, entry); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// We load here after successfully loading into Sentinel so that on
|
|
|
|
// error we will try loading again on the next get
|
|
|
|
if ps.egpLRU != nil {
|
|
|
|
ps.egpLRU.Add(index, p)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
default:
|
|
|
|
return fmt.Errorf("unknown policy type, cannot set")
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-09-14 22:27:30 +03:00
|
|
|
// GetNonEGPPolicyType returns a policy's type.
|
|
|
|
// It will return an error if the policy doesn't exist in the store or isn't
|
|
|
|
// an ACL or a Sentinel Role Governing Policy (RGP).
|
|
|
|
//
|
|
|
|
// Note: Sentinel Endpoint Governing Policies (EGPs) are not stored within the
|
|
|
|
// policyTypeMap. We sometimes need to distinguish between ACLs and RGPs due to
|
|
|
|
// them both being token policies, but the logic related to EGPs is separate
|
|
|
|
// enough that it is never necessary to look up their type.
|
|
|
|
func (ps *PolicyStore) GetNonEGPPolicyType(nsID string, name string) (*PolicyType, error) {
|
|
|
|
sanitizedName := ps.sanitizeName(name)
|
|
|
|
index := path.Join(nsID, sanitizedName)
|
|
|
|
|
|
|
|
pt, ok := ps.policyTypeMap.Load(index)
|
|
|
|
if !ok {
|
|
|
|
// Doesn't exist
|
2023-11-06 16:51:52 +03:00
|
|
|
return nil, ErrPolicyNotExistInTypeMap
|
2023-09-14 22:27:30 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
policyType, ok := pt.(PolicyType)
|
|
|
|
if !ok {
|
|
|
|
return nil, fmt.Errorf("unknown policy type for: %v", index)
|
|
|
|
}
|
|
|
|
|
|
|
|
return &policyType, nil
|
|
|
|
}
|
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
// GetPolicy is used to fetch the named policy
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) GetPolicy(ctx context.Context, name string, policyType PolicyType) (*Policy, error) {
|
2018-09-18 06:03:00 +03:00
|
|
|
return ps.switchedGetPolicy(ctx, name, policyType, true)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ps *PolicyStore) switchedGetPolicy(ctx context.Context, name string, policyType PolicyType, grabLock bool) (*Policy, error) {
|
2015-04-09 02:43:17 +03:00
|
|
|
defer metrics.MeasureSince([]string{"policy", "get_policy"}, time.Now())
|
2017-08-19 02:47:23 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
// Policies are normalized to lower-case
|
|
|
|
name = ps.sanitizeName(name)
|
2018-09-18 06:03:00 +03:00
|
|
|
index := ps.cacheKey(ns, name)
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
var cache *lru.TwoQueueCache
|
|
|
|
var view *BarrierView
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
switch policyType {
|
|
|
|
case PolicyTypeACL:
|
|
|
|
cache = ps.tokenPoliciesLRU
|
2018-09-18 06:03:00 +03:00
|
|
|
view = ps.getACLView(ns)
|
|
|
|
case PolicyTypeRGP:
|
|
|
|
cache = ps.tokenPoliciesLRU
|
|
|
|
view = ps.getRGPView(ns)
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
cache = ps.egpLRU
|
|
|
|
view = ps.getEGPView(ns)
|
2017-10-23 21:59:37 +03:00
|
|
|
case PolicyTypeToken:
|
|
|
|
cache = ps.tokenPoliciesLRU
|
2018-09-18 06:03:00 +03:00
|
|
|
val, ok := ps.policyTypeMap.Load(index)
|
2017-10-23 21:59:37 +03:00
|
|
|
if !ok {
|
|
|
|
// Doesn't exist
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
policyType = val.(PolicyType)
|
|
|
|
switch policyType {
|
|
|
|
case PolicyTypeACL:
|
2018-09-18 06:03:00 +03:00
|
|
|
view = ps.getACLView(ns)
|
|
|
|
case PolicyTypeRGP:
|
|
|
|
view = ps.getRGPView(ns)
|
2017-10-23 21:59:37 +03:00
|
|
|
default:
|
2018-04-05 18:49:21 +03:00
|
|
|
return nil, fmt.Errorf("invalid type of policy in type map: %q", policyType)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if cache != nil {
|
2016-04-21 16:52:42 +03:00
|
|
|
// Check for cached policy
|
2018-09-18 06:03:00 +03:00
|
|
|
if raw, ok := cache.Get(index); ok {
|
2016-04-21 16:52:42 +03:00
|
|
|
return raw.(*Policy), nil
|
|
|
|
}
|
2015-04-07 02:41:48 +03:00
|
|
|
}
|
2015-03-24 21:27:21 +03:00
|
|
|
|
|
|
|
// Special case the root policy
|
2018-09-18 06:03:00 +03:00
|
|
|
if policyType == PolicyTypeACL && name == "root" && ns.ID == namespace.RootNamespaceID {
|
|
|
|
p := &Policy{
|
|
|
|
Name: "root",
|
|
|
|
namespace: namespace.RootNamespace,
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
if cache != nil {
|
2018-09-18 06:03:00 +03:00
|
|
|
cache.Add(index, p)
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
2015-03-24 21:27:21 +03:00
|
|
|
return p, nil
|
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
if grabLock {
|
|
|
|
ps.modifyLock.Lock()
|
|
|
|
defer ps.modifyLock.Unlock()
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
// See if anything has added it since we got the lock
|
|
|
|
if cache != nil {
|
2018-09-18 06:03:00 +03:00
|
|
|
if raw, ok := cache.Get(index); ok {
|
2017-10-23 21:59:37 +03:00
|
|
|
return raw.(*Policy), nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-07-19 04:10:15 +03:00
|
|
|
// Nil-check on the view before proceeding to retrieve from storage
|
2018-09-18 06:03:00 +03:00
|
|
|
if view == nil {
|
|
|
|
return nil, fmt.Errorf("unable to get the barrier subview for policy type %q", policyType)
|
|
|
|
}
|
|
|
|
|
2018-01-19 09:44:44 +03:00
|
|
|
out, err := view.Get(ctx, name)
|
2015-03-18 22:17:03 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to read policy: %w", err)
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
if out == nil {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2015-07-06 04:14:15 +03:00
|
|
|
policyEntry := new(PolicyEntry)
|
2017-10-23 21:59:37 +03:00
|
|
|
policy := new(Policy)
|
|
|
|
err = out.DecodeJSON(policyEntry)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to parse policy: %w", err)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Set these up here so that they're available for loading into
|
|
|
|
// Sentinel
|
|
|
|
policy.Name = name
|
|
|
|
policy.Raw = policyEntry.Raw
|
|
|
|
policy.Type = policyEntry.Type
|
2018-08-15 21:42:56 +03:00
|
|
|
policy.Templated = policyEntry.Templated
|
2018-09-18 06:03:00 +03:00
|
|
|
policy.sentinelPolicy = policyEntry.sentinelPolicy
|
|
|
|
policy.namespace = ns
|
2017-10-23 21:59:37 +03:00
|
|
|
switch policyEntry.Type {
|
|
|
|
case PolicyTypeACL:
|
2015-07-06 04:14:15 +03:00
|
|
|
// Parse normally
|
2018-09-18 06:03:00 +03:00
|
|
|
p, err := ParseACLPolicy(ns, policyEntry.Raw)
|
2015-07-06 04:14:15 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to parse policy: %w", err)
|
2015-07-06 04:14:15 +03:00
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
policy.Paths = p.Paths
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// Reset this in case they set the name in the policy itself
|
|
|
|
policy.Name = name
|
2015-07-06 04:14:15 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.policyTypeMap.Store(index, PolicyTypeACL)
|
|
|
|
|
|
|
|
case PolicyTypeRGP:
|
|
|
|
if err := ps.handleSentinelPolicy(ctx, policy, nil, nil); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
ps.policyTypeMap.Store(index, PolicyTypeRGP)
|
|
|
|
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
if err := ps.handleSentinelPolicy(ctx, policy, nil, nil); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
default:
|
|
|
|
return nil, fmt.Errorf("unknown policy type %q", policyEntry.Type.String())
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2015-04-07 02:43:05 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
if cache != nil {
|
2016-04-21 16:52:42 +03:00
|
|
|
// Update the LRU cache
|
2018-09-18 06:03:00 +03:00
|
|
|
cache.Add(index, policy)
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
|
|
|
|
2015-07-06 04:14:15 +03:00
|
|
|
return policy, nil
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// ListPolicies is used to list the available policies
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) ListPolicies(ctx context.Context, policyType PolicyType) ([]string, error) {
|
2015-04-09 02:43:17 +03:00
|
|
|
defer metrics.MeasureSince([]string{"policy", "list_policies"}, time.Now())
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if ns == nil {
|
|
|
|
return nil, namespace.ErrNoNamespace
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get the appropriate view based on policy type and namespace
|
|
|
|
view := ps.getBarrierView(ns, policyType)
|
|
|
|
if view == nil {
|
|
|
|
return []string{}, fmt.Errorf("unable to get the barrier subview for policy type %q", policyType)
|
|
|
|
}
|
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
// Scan the view, since the policy names are the same as the
|
|
|
|
// key names.
|
2017-10-23 21:59:37 +03:00
|
|
|
var keys []string
|
|
|
|
switch policyType {
|
|
|
|
case PolicyTypeACL:
|
2018-09-18 06:03:00 +03:00
|
|
|
keys, err = logical.CollectKeys(ctx, view)
|
|
|
|
case PolicyTypeRGP:
|
|
|
|
return logical.CollectKeys(ctx, view)
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
return logical.CollectKeys(ctx, view)
|
2017-10-23 21:59:37 +03:00
|
|
|
default:
|
2018-04-05 18:49:21 +03:00
|
|
|
return nil, fmt.Errorf("unknown policy type %q", policyType)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
2016-07-25 05:27:41 +03:00
|
|
|
|
2017-10-23 21:59:37 +03:00
|
|
|
// We only have non-assignable ACL policies at the moment
|
2016-07-25 05:27:41 +03:00
|
|
|
for _, nonAssignable := range nonAssignablePolicies {
|
|
|
|
deleteIndex := -1
|
2018-09-18 06:03:00 +03:00
|
|
|
// Find indices of non-assignable policies in keys
|
2016-07-25 05:27:41 +03:00
|
|
|
for index, key := range keys {
|
|
|
|
if key == nonAssignable {
|
|
|
|
// Delete collection outside the loop
|
|
|
|
deleteIndex = index
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// Remove non-assignable policies when found
|
|
|
|
if deleteIndex != -1 {
|
|
|
|
keys = append(keys[:deleteIndex], keys[deleteIndex+1:]...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return keys, err
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// DeletePolicy is used to delete the named policy
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) DeletePolicy(ctx context.Context, name string, policyType PolicyType) error {
|
2019-06-18 17:25:26 +03:00
|
|
|
return ps.switchedDeletePolicy(ctx, name, policyType, true, false)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
|
2019-06-18 17:25:26 +03:00
|
|
|
// deletePolicyForce is used to delete the named policy and force it even if
|
|
|
|
// default or a singleton. It's used for invalidations or namespace deletion
|
|
|
|
// where we internally need to actually remove a policy that the user normally
|
|
|
|
// isn't allowed to remove.
|
|
|
|
func (ps *PolicyStore) deletePolicyForce(ctx context.Context, name string, policyType PolicyType) error {
|
|
|
|
return ps.switchedDeletePolicy(ctx, name, policyType, true, true)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (ps *PolicyStore) switchedDeletePolicy(ctx context.Context, name string, policyType PolicyType, physicalDeletion, force bool) error {
|
2015-04-09 02:43:17 +03:00
|
|
|
defer metrics.MeasureSince([]string{"policy", "delete_policy"}, time.Now())
|
2017-08-19 02:47:23 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
// If not set, the call comes from invalidation, where we'll already have
|
|
|
|
// grabbed the lock
|
|
|
|
if physicalDeletion {
|
|
|
|
ps.modifyLock.Lock()
|
|
|
|
defer ps.modifyLock.Unlock()
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
2017-08-19 02:47:23 +03:00
|
|
|
// Policies are normalized to lower-case
|
2017-10-23 21:59:37 +03:00
|
|
|
name = ps.sanitizeName(name)
|
2018-09-18 06:03:00 +03:00
|
|
|
index := ps.cacheKey(ns, name)
|
|
|
|
|
|
|
|
view := ps.getBarrierView(ns, policyType)
|
|
|
|
if view == nil {
|
|
|
|
return fmt.Errorf("unable to get the barrier subview for policy type %q", policyType)
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
switch policyType {
|
|
|
|
case PolicyTypeACL:
|
2019-06-18 17:25:26 +03:00
|
|
|
if !force {
|
|
|
|
if strutil.StrListContains(immutablePolicies, name) {
|
|
|
|
return fmt.Errorf("cannot delete %q policy", name)
|
|
|
|
}
|
|
|
|
if name == "default" {
|
|
|
|
return fmt.Errorf("cannot delete default policy")
|
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
if physicalDeletion {
|
|
|
|
err := view.Delete(ctx, name)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to delete policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if ps.tokenPoliciesLRU != nil {
|
|
|
|
// Clear the cache
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.tokenPoliciesLRU.Remove(index)
|
2017-10-23 21:59:37 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
ps.policyTypeMap.Delete(index)
|
2015-04-07 02:41:48 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
case PolicyTypeRGP:
|
|
|
|
if physicalDeletion {
|
|
|
|
err := view.Delete(ctx, name)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to delete policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if ps.tokenPoliciesLRU != nil {
|
|
|
|
// Clear the cache
|
|
|
|
ps.tokenPoliciesLRU.Remove(index)
|
|
|
|
}
|
|
|
|
|
|
|
|
ps.policyTypeMap.Delete(index)
|
|
|
|
|
|
|
|
defer ps.core.invalidateSentinelPolicy(policyType, index)
|
|
|
|
|
|
|
|
case PolicyTypeEGP:
|
|
|
|
if physicalDeletion {
|
|
|
|
err := view.Delete(ctx, name)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("failed to delete policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if ps.egpLRU != nil {
|
|
|
|
// Clear the cache
|
|
|
|
ps.egpLRU.Remove(index)
|
|
|
|
}
|
|
|
|
|
|
|
|
defer ps.core.invalidateSentinelPolicy(policyType, index)
|
|
|
|
|
|
|
|
ps.invalidateEGPTreePath(index)
|
2016-04-21 16:52:42 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACL is used to return an ACL which is built using the
|
2021-10-07 20:36:22 +03:00
|
|
|
// named policies and pre-fetched policies if given.
|
|
|
|
func (ps *PolicyStore) ACL(ctx context.Context, entity *identity.Entity, policyNames map[string][]string, additionalPolicies ...*Policy) (*ACL, error) {
|
|
|
|
var allPolicies []*Policy
|
|
|
|
|
|
|
|
// Fetch the named policies
|
2018-09-18 06:03:00 +03:00
|
|
|
for nsID, nsPolicyNames := range policyNames {
|
|
|
|
policyNS, err := NamespaceByID(ctx, nsID, ps.core)
|
2015-03-18 22:17:03 +03:00
|
|
|
if err != nil {
|
2018-09-18 06:03:00 +03:00
|
|
|
return nil, err
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
if policyNS == nil {
|
|
|
|
return nil, namespace.ErrNoNamespace
|
|
|
|
}
|
|
|
|
policyCtx := namespace.ContextWithNamespace(ctx, policyNS)
|
|
|
|
for _, nsPolicyName := range nsPolicyNames {
|
|
|
|
p, err := ps.GetPolicy(policyCtx, nsPolicyName, PolicyTypeToken)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to get policy: %w", err)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
|
|
|
if p != nil {
|
2021-10-07 20:36:22 +03:00
|
|
|
allPolicies = append(allPolicies, p)
|
2018-09-18 06:03:00 +03:00
|
|
|
}
|
2018-08-15 21:42:56 +03:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-10-07 20:36:22 +03:00
|
|
|
// Append any pre-fetched policies that were given
|
|
|
|
allPolicies = append(allPolicies, additionalPolicies...)
|
|
|
|
|
2018-08-15 21:42:56 +03:00
|
|
|
var fetchedGroups bool
|
|
|
|
var groups []*identity.Group
|
2021-10-07 20:36:22 +03:00
|
|
|
for i, policy := range allPolicies {
|
2018-08-15 21:42:56 +03:00
|
|
|
if policy.Type == PolicyTypeACL && policy.Templated {
|
|
|
|
if !fetchedGroups {
|
|
|
|
fetchedGroups = true
|
|
|
|
if entity != nil {
|
|
|
|
directGroups, inheritedGroups, err := ps.core.identityStore.groupsByEntityID(entity.ID)
|
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to fetch group memberships: %w", err)
|
2018-08-15 21:42:56 +03:00
|
|
|
}
|
|
|
|
groups = append(directGroups, inheritedGroups...)
|
|
|
|
}
|
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
p, err := parseACLPolicyWithTemplating(policy.namespace, policy.Raw, true, entity, groups)
|
2018-08-15 21:42:56 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("error parsing templated policy %q: %w", policy.Name, err)
|
2018-08-15 21:42:56 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
p.Name = policy.Name
|
2021-10-07 20:36:22 +03:00
|
|
|
allPolicies[i] = p
|
2018-08-15 21:42:56 +03:00
|
|
|
}
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
// Construct the ACL
|
2021-10-07 20:36:22 +03:00
|
|
|
acl, err := NewACL(ctx, allPolicies)
|
2015-03-18 22:17:03 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return nil, fmt.Errorf("failed to construct ACL: %w", err)
|
2015-03-18 22:17:03 +03:00
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
2015-03-18 22:17:03 +03:00
|
|
|
return acl, nil
|
|
|
|
}
|
2015-11-06 19:52:26 +03:00
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
// loadACLPolicy is used to load default ACL policies. The default policies will
|
|
|
|
// be loaded to all namespaces.
|
2018-01-19 09:44:44 +03:00
|
|
|
func (ps *PolicyStore) loadACLPolicy(ctx context.Context, policyName, policyText string) error {
|
2018-09-18 06:03:00 +03:00
|
|
|
return ps.loadACLPolicyNamespaces(ctx, policyName, policyText)
|
|
|
|
}
|
|
|
|
|
|
|
|
// loadACLPolicyInternal is used to load default ACL policies in a specific
|
|
|
|
// namespace.
|
|
|
|
func (ps *PolicyStore) loadACLPolicyInternal(ctx context.Context, policyName, policyText string) error {
|
|
|
|
ns, err := namespace.FromContext(ctx)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2017-11-13 23:31:32 +03:00
|
|
|
// Check if the policy already exists
|
2018-01-19 09:44:44 +03:00
|
|
|
policy, err := ps.GetPolicy(ctx, policyName, PolicyTypeACL)
|
2015-11-07 01:27:15 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("error fetching %s policy from store: %w", policyName, err)
|
2015-11-07 01:27:15 +03:00
|
|
|
}
|
2017-11-13 23:31:32 +03:00
|
|
|
if policy != nil {
|
|
|
|
if !strutil.StrListContains(immutablePolicies, policyName) || policyText == policy.Raw {
|
|
|
|
return nil
|
|
|
|
}
|
2015-11-07 01:27:15 +03:00
|
|
|
}
|
|
|
|
|
2018-09-18 06:03:00 +03:00
|
|
|
policy, err = ParseACLPolicy(ns, policyText)
|
2016-05-02 07:08:07 +03:00
|
|
|
if err != nil {
|
2021-05-11 20:12:54 +03:00
|
|
|
return fmt.Errorf("error parsing %s policy: %w", policyName, err)
|
2016-05-02 07:08:07 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
if policy == nil {
|
2018-04-05 18:49:21 +03:00
|
|
|
return fmt.Errorf("parsing %q policy resulted in nil policy", policyName)
|
2016-05-02 07:08:07 +03:00
|
|
|
}
|
|
|
|
|
2017-11-13 23:31:32 +03:00
|
|
|
policy.Name = policyName
|
2017-10-23 21:59:37 +03:00
|
|
|
policy.Type = PolicyTypeACL
|
2018-01-19 09:44:44 +03:00
|
|
|
return ps.setPolicyInternal(ctx, policy)
|
2015-11-06 19:52:26 +03:00
|
|
|
}
|
2017-10-23 21:59:37 +03:00
|
|
|
|
|
|
|
func (ps *PolicyStore) sanitizeName(name string) string {
|
|
|
|
return strings.ToLower(strings.TrimSpace(name))
|
|
|
|
}
|
2018-09-18 06:03:00 +03:00
|
|
|
|
|
|
|
func (ps *PolicyStore) cacheKey(ns *namespace.Namespace, name string) string {
|
|
|
|
return path.Join(ns.ID, name)
|
|
|
|
}
|