2023-03-28 18:39:22 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2023-08-11 13:12:13 +00:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-28 18:39:22 +00:00
|
|
|
|
2017-08-03 00:05:18 +00:00
|
|
|
package structs
|
|
|
|
|
|
|
|
import (
|
2018-10-19 16:04:07 +00:00
|
|
|
"encoding/binary"
|
2020-05-04 22:02:57 +00:00
|
|
|
"encoding/json"
|
2017-08-03 00:05:18 +00:00
|
|
|
"errors"
|
2018-10-19 16:04:07 +00:00
|
|
|
"fmt"
|
2019-04-08 18:19:09 +00:00
|
|
|
"hash"
|
2018-10-19 16:04:07 +00:00
|
|
|
"hash/fnv"
|
|
|
|
"sort"
|
|
|
|
"strings"
|
2017-08-03 00:05:18 +00:00
|
|
|
"time"
|
|
|
|
|
2022-03-31 19:11:49 +00:00
|
|
|
"github.com/hashicorp/consul/lib/stringslice"
|
|
|
|
|
2021-08-25 18:43:11 +00:00
|
|
|
"golang.org/x/crypto/blake2b"
|
|
|
|
|
2017-08-03 00:05:18 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
2019-12-06 16:14:56 +00:00
|
|
|
"github.com/hashicorp/consul/lib"
|
2018-10-19 16:04:07 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type ACLMode string
|
|
|
|
|
|
|
|
const (
|
2021-09-29 19:45:11 +00:00
|
|
|
// ACLModeDisabled indicates the ACL system is disabled
|
2018-10-19 16:04:07 +00:00
|
|
|
ACLModeDisabled ACLMode = "0"
|
2021-09-29 19:45:11 +00:00
|
|
|
// ACLModeEnabled indicates the ACL system is enabled
|
2018-10-19 16:04:07 +00:00
|
|
|
ACLModeEnabled ACLMode = "1"
|
2017-08-03 00:05:18 +00:00
|
|
|
)
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLTokenIDType string
|
|
|
|
|
2017-08-03 00:05:18 +00:00
|
|
|
const (
|
2018-10-19 16:04:07 +00:00
|
|
|
ACLTokenSecret ACLTokenIDType = "secret"
|
|
|
|
ACLTokenAccessor ACLTokenIDType = "accessor"
|
|
|
|
)
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
const (
|
|
|
|
// All policy ids with the first 120 bits set to all zeroes are
|
|
|
|
// reserved for builtin policies. Policy creation will ensure we
|
|
|
|
// dont accidentally create them when autogenerating uuids.
|
|
|
|
|
|
|
|
// This policy gives unlimited access to everything. Users
|
2018-11-02 17:00:39 +00:00
|
|
|
// may rename if desired but cannot delete or modify the rules.
|
2023-08-01 17:12:14 +00:00
|
|
|
ACLPolicyGlobalManagementID = "00000000-0000-0000-0000-000000000001"
|
|
|
|
ACLPolicyGlobalManagementName = "global-management"
|
|
|
|
ACLPolicyGlobalManagementDesc = "Builtin Policy that grants unlimited access"
|
|
|
|
|
|
|
|
ACLPolicyGlobalReadOnlyID = "00000000-0000-0000-0000-000000000002"
|
|
|
|
ACLPolicyGlobalReadOnlyName = "builtin/global-read-only"
|
|
|
|
ACLPolicyGlobalReadOnlyDesc = "Builtin Policy that grants unlimited read-only access to all components"
|
|
|
|
|
|
|
|
ACLReservedIDPrefix = "00000000-0000-0000-0000-0000000000"
|
|
|
|
|
|
|
|
aclPolicyGlobalRulesTemplate = `
|
|
|
|
acl = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
agent_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
event_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
key_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
2023-08-01 17:12:14 +00:00
|
|
|
keyring = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
node_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
2023-08-01 17:12:14 +00:00
|
|
|
operator = "%[1]s"
|
|
|
|
mesh = "%[1]s"
|
|
|
|
peering = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
query_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
service_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
|
|
|
intentions = "%[1]s"
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
session_prefix "" {
|
2023-08-01 17:12:14 +00:00
|
|
|
policy = "%[1]s"
|
|
|
|
}`
|
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
ACLPolicyGlobalReadOnlyRules = fmt.Sprintf(aclPolicyGlobalRulesTemplate, "read") + EnterpriseACLPolicyGlobalReadOnly
|
|
|
|
ACLPolicyGlobalManagementRules = fmt.Sprintf(aclPolicyGlobalRulesTemplate, "write") + EnterpriseACLPolicyGlobalManagement
|
2018-10-19 16:04:07 +00:00
|
|
|
|
2023-08-01 17:12:14 +00:00
|
|
|
ACLBuiltinPolicies = map[string]ACLPolicy{
|
|
|
|
ACLPolicyGlobalManagementID: {
|
|
|
|
ID: ACLPolicyGlobalManagementID,
|
|
|
|
Name: ACLPolicyGlobalManagementName,
|
|
|
|
Description: ACLPolicyGlobalManagementDesc,
|
|
|
|
Rules: ACLPolicyGlobalManagementRules,
|
|
|
|
},
|
|
|
|
ACLPolicyGlobalReadOnlyID: {
|
|
|
|
ID: ACLPolicyGlobalReadOnlyID,
|
|
|
|
Name: ACLPolicyGlobalReadOnlyName,
|
|
|
|
Description: ACLPolicyGlobalReadOnlyDesc,
|
|
|
|
Rules: ACLPolicyGlobalReadOnlyRules,
|
|
|
|
},
|
|
|
|
}
|
2018-10-19 16:04:07 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func ACLIDReserved(id string) bool {
|
2023-08-01 17:12:14 +00:00
|
|
|
return strings.HasPrefix(id, ACLReservedIDPrefix)
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
2017-08-03 00:05:18 +00:00
|
|
|
// ACLBootstrapNotAllowedErr is returned once we know that a bootstrap can no
|
2018-10-19 16:04:07 +00:00
|
|
|
// longer be done since the cluster was bootstrapped
|
2017-08-03 00:05:18 +00:00
|
|
|
var ACLBootstrapNotAllowedErr = errors.New("ACL bootstrap no longer allowed")
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// ACLBootstrapInvalidResetIndexErr is returned when bootstrap is requested with a non-zero
|
|
|
|
// reset index but the index doesn't match the bootstrap index
|
|
|
|
var ACLBootstrapInvalidResetIndexErr = errors.New("Invalid ACL bootstrap reset index")
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLIdentity interface {
|
2022-01-22 19:33:09 +00:00
|
|
|
// ID returns the accessor ID, a string that can be used for logging and
|
|
|
|
// telemetry. It is not the secret ID used for authentication.
|
2018-10-19 16:04:07 +00:00
|
|
|
ID() string
|
|
|
|
SecretToken() string
|
|
|
|
PolicyIDs() []string
|
2019-04-15 20:43:19 +00:00
|
|
|
RoleIDs() []string
|
2019-04-08 18:19:09 +00:00
|
|
|
ServiceIdentityList() []*ACLServiceIdentity
|
2020-06-16 16:54:27 +00:00
|
|
|
NodeIdentityList() []*ACLNodeIdentity
|
2019-04-08 17:05:51 +00:00
|
|
|
IsExpired(asOf time.Time) bool
|
2020-03-10 16:15:22 +00:00
|
|
|
IsLocal() bool
|
2022-03-13 03:55:53 +00:00
|
|
|
EnterpriseMetadata() *acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
2022-09-09 19:05:38 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLTokenPolicyLink struct {
|
|
|
|
ID string
|
|
|
|
Name string `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
type ACLTokenRoleLink struct {
|
|
|
|
ID string
|
|
|
|
Name string `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
// ACLServiceIdentity represents a high-level grant of all necessary privileges
|
|
|
|
// to assume the identity of the named Service in the Catalog and within
|
|
|
|
// Connect.
|
|
|
|
type ACLServiceIdentity struct {
|
|
|
|
ServiceName string
|
|
|
|
|
|
|
|
// Datacenters that the synthetic policy will be valid within.
|
|
|
|
// - No wildcards allowed
|
|
|
|
// - If empty then the synthetic policy is valid within all datacenters
|
|
|
|
//
|
|
|
|
// Only valid for global tokens. It is an error to specify this for local tokens.
|
|
|
|
Datacenters []string `json:",omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ACLServiceIdentity) Clone() *ACLServiceIdentity {
|
|
|
|
s2 := *s
|
2022-03-31 19:11:49 +00:00
|
|
|
s2.Datacenters = stringslice.CloneStringSlice(s.Datacenters)
|
2019-04-08 18:19:09 +00:00
|
|
|
return &s2
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ACLServiceIdentity) AddToHash(h hash.Hash) {
|
|
|
|
h.Write([]byte(s.ServiceName))
|
|
|
|
for _, dc := range s.Datacenters {
|
|
|
|
h.Write([]byte(dc))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
func (s *ACLServiceIdentity) EstimateSize() int {
|
|
|
|
size := len(s.ServiceName)
|
|
|
|
for _, dc := range s.Datacenters {
|
|
|
|
size += len(dc)
|
|
|
|
}
|
|
|
|
return size
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
func (s *ACLServiceIdentity) SyntheticPolicy(entMeta *acl.EnterpriseMeta) *ACLPolicy {
|
2019-04-08 18:19:09 +00:00
|
|
|
// Given that we validate this string name before persisting, we do not
|
|
|
|
// have to escape it before doing the following interpolation.
|
2019-10-24 18:38:09 +00:00
|
|
|
rules := aclServiceIdentityRules(s.ServiceName, entMeta)
|
2019-04-08 18:19:09 +00:00
|
|
|
|
|
|
|
hasher := fnv.New128a()
|
2019-04-26 17:49:28 +00:00
|
|
|
hashID := fmt.Sprintf("%x", hasher.Sum([]byte(rules)))
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
policy := &ACLPolicy{}
|
2019-04-26 17:49:28 +00:00
|
|
|
policy.ID = hashID
|
|
|
|
policy.Name = fmt.Sprintf("synthetic-policy-%s", hashID)
|
2022-03-31 16:49:11 +00:00
|
|
|
sn := NewServiceName(s.ServiceName, entMeta)
|
|
|
|
policy.Description = fmt.Sprintf("synthetic policy for service identity %q", sn.String())
|
2019-04-08 18:19:09 +00:00
|
|
|
policy.Rules = rules
|
|
|
|
policy.Datacenters = s.Datacenters
|
2020-02-11 00:26:01 +00:00
|
|
|
policy.EnterpriseMeta.Merge(entMeta)
|
2019-04-08 18:19:09 +00:00
|
|
|
policy.SetHash(true)
|
|
|
|
return policy
|
|
|
|
}
|
|
|
|
|
2022-05-04 16:38:45 +00:00
|
|
|
type ACLServiceIdentities []*ACLServiceIdentity
|
|
|
|
|
|
|
|
// Deduplicate returns a new list of service identities without duplicates.
|
|
|
|
// Identities with the same ServiceName but different datacenters will be
|
|
|
|
// merged into a single identity with all datacenters.
|
|
|
|
func (ids ACLServiceIdentities) Deduplicate() ACLServiceIdentities {
|
|
|
|
unique := make(map[string]*ACLServiceIdentity)
|
|
|
|
|
|
|
|
for _, id := range ids {
|
|
|
|
entry, ok := unique[id.ServiceName]
|
|
|
|
if ok {
|
|
|
|
dcs := stringslice.CloneStringSlice(id.Datacenters)
|
|
|
|
sort.Strings(dcs)
|
|
|
|
entry.Datacenters = stringslice.MergeSorted(dcs, entry.Datacenters)
|
|
|
|
} else {
|
|
|
|
entry = id.Clone()
|
|
|
|
sort.Strings(entry.Datacenters)
|
|
|
|
unique[id.ServiceName] = entry
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
results := make(ACLServiceIdentities, 0, len(unique))
|
|
|
|
for _, id := range unique {
|
|
|
|
results = append(results, id)
|
|
|
|
}
|
|
|
|
return results
|
|
|
|
}
|
|
|
|
|
2020-06-16 16:54:27 +00:00
|
|
|
// ACLNodeIdentity represents a high-level grant of all privileges
|
|
|
|
// necessary to assume the identity of that node and manage it.
|
|
|
|
type ACLNodeIdentity struct {
|
|
|
|
// NodeName identities the Node that this identity authorizes access to
|
|
|
|
NodeName string
|
|
|
|
|
|
|
|
// Datacenter is required and specifies the datacenter of the node.
|
|
|
|
Datacenter string
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ACLNodeIdentity) Clone() *ACLNodeIdentity {
|
|
|
|
s2 := *s
|
|
|
|
return &s2
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ACLNodeIdentity) AddToHash(h hash.Hash) {
|
|
|
|
h.Write([]byte(s.NodeName))
|
|
|
|
h.Write([]byte(s.Datacenter))
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ACLNodeIdentity) EstimateSize() int {
|
|
|
|
return len(s.NodeName) + len(s.Datacenter)
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
func (s *ACLNodeIdentity) SyntheticPolicy(entMeta *acl.EnterpriseMeta) *ACLPolicy {
|
2020-06-16 16:54:27 +00:00
|
|
|
// Given that we validate this string name before persisting, we do not
|
|
|
|
// have to escape it before doing the following interpolation.
|
2021-09-16 14:17:02 +00:00
|
|
|
rules := aclNodeIdentityRules(s.NodeName, entMeta)
|
2020-06-16 16:54:27 +00:00
|
|
|
|
|
|
|
hasher := fnv.New128a()
|
|
|
|
hashID := fmt.Sprintf("%x", hasher.Sum([]byte(rules)))
|
|
|
|
|
|
|
|
policy := &ACLPolicy{}
|
|
|
|
policy.ID = hashID
|
|
|
|
policy.Name = fmt.Sprintf("synthetic-policy-%s", hashID)
|
2022-03-31 16:49:11 +00:00
|
|
|
policy.Description = fmt.Sprintf("synthetic policy for node identity %q", s.NodeName)
|
2020-06-16 16:54:27 +00:00
|
|
|
policy.Rules = rules
|
|
|
|
policy.Datacenters = []string{s.Datacenter}
|
2021-09-16 14:17:02 +00:00
|
|
|
policy.EnterpriseMeta.Merge(entMeta)
|
2020-06-16 16:54:27 +00:00
|
|
|
policy.SetHash(true)
|
|
|
|
return policy
|
|
|
|
}
|
|
|
|
|
2022-05-04 16:38:45 +00:00
|
|
|
type ACLNodeIdentities []*ACLNodeIdentity
|
|
|
|
|
|
|
|
// Deduplicate returns a new list of node identities without duplicates.
|
|
|
|
func (ids ACLNodeIdentities) Deduplicate() ACLNodeIdentities {
|
|
|
|
type mapKey struct {
|
|
|
|
nodeName, datacenter string
|
|
|
|
}
|
|
|
|
seen := make(map[mapKey]struct{})
|
|
|
|
|
|
|
|
var results ACLNodeIdentities
|
|
|
|
for _, id := range ids {
|
|
|
|
key := mapKey{id.NodeName, id.Datacenter}
|
|
|
|
if _, ok := seen[key]; ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
results = append(results, id.Clone())
|
|
|
|
seen[key] = struct{}{}
|
|
|
|
}
|
|
|
|
return results
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLToken struct {
|
|
|
|
// This is the UUID used for tracking and management purposes
|
|
|
|
AccessorID string
|
|
|
|
|
|
|
|
// This is the UUID used as the api token by clients
|
|
|
|
SecretID string
|
|
|
|
|
|
|
|
// Human readable string to display for the token (Optional)
|
|
|
|
Description string
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
// List of policy links - nil/empty for legacy tokens or if service identities are in use.
|
2018-10-19 16:04:07 +00:00
|
|
|
// Note this is the list of IDs and not the names. Prior to token creation
|
|
|
|
// the list of policy names gets validated and the policy IDs get stored herein
|
2019-04-08 18:19:09 +00:00
|
|
|
Policies []ACLTokenPolicyLink `json:",omitempty"`
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
// List of role links. Note this is the list of IDs and not the names.
|
|
|
|
// Prior to token creation the list of role names gets validated and the
|
|
|
|
// role IDs get stored herein
|
|
|
|
Roles []ACLTokenRoleLink `json:",omitempty"`
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
// List of services to generate synthetic policies for.
|
2022-05-04 16:38:45 +00:00
|
|
|
ServiceIdentities ACLServiceIdentities `json:",omitempty"`
|
2018-10-19 16:04:07 +00:00
|
|
|
|
2020-06-16 16:54:27 +00:00
|
|
|
// The node identities that this token should be allowed to manage.
|
2022-05-04 16:38:45 +00:00
|
|
|
NodeIdentities ACLNodeIdentities `json:",omitempty"`
|
2020-06-16 16:54:27 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Whether this token is DC local. This means that it will not be synced
|
|
|
|
// to the ACL datacenter and replicated to others.
|
|
|
|
Local bool
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
// AuthMethod is the name of the auth method used to create this token.
|
|
|
|
AuthMethod string `json:",omitempty"`
|
|
|
|
|
2020-01-14 15:09:29 +00:00
|
|
|
// ACLAuthMethodEnterpriseMeta is the EnterpriseMeta for the AuthMethod that this token was created from
|
|
|
|
ACLAuthMethodEnterpriseMeta
|
|
|
|
|
2019-04-08 17:05:51 +00:00
|
|
|
// ExpirationTime represents the point after which a token should be
|
|
|
|
// considered revoked and is eligible for destruction. The zero value
|
|
|
|
// represents NO expiration.
|
2019-04-15 18:35:55 +00:00
|
|
|
//
|
|
|
|
// This is a pointer value so that the zero value is omitted properly
|
|
|
|
// during json serialization. time.Time does not respect json omitempty
|
|
|
|
// directives unfortunately.
|
|
|
|
ExpirationTime *time.Time `json:",omitempty"`
|
2019-04-08 17:05:51 +00:00
|
|
|
|
|
|
|
// ExpirationTTL is a convenience field for helping set ExpirationTime to a
|
|
|
|
// value of CreateTime+ExpirationTTL. This can only be set during
|
|
|
|
// TokenCreate and is cleared and used to initialize the ExpirationTime
|
|
|
|
// field before being persisted to the state store or raft log.
|
|
|
|
//
|
|
|
|
// This is a string version of a time.Duration like "2m".
|
|
|
|
ExpirationTTL time.Duration `json:",omitempty"`
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// The time when this token was created
|
|
|
|
CreateTime time.Time `json:",omitempty"`
|
|
|
|
|
|
|
|
// Hash of the contents of the token
|
|
|
|
//
|
|
|
|
// This is needed mainly for replication purposes. When replicating from
|
|
|
|
// one DC to another keeping the content Hash will allow us to avoid
|
|
|
|
// unnecessary calls to the authoritative DC
|
|
|
|
Hash []byte
|
|
|
|
|
2019-10-24 18:38:09 +00:00
|
|
|
// Embedded Enterprise Metadata
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta `mapstructure:",squash"`
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Embedded Raft Metadata
|
2017-08-03 00:05:18 +00:00
|
|
|
RaftIndex
|
|
|
|
}
|
|
|
|
|
2019-10-29 18:13:36 +00:00
|
|
|
func (t *ACLToken) UnmarshalJSON(data []byte) (err error) {
|
|
|
|
type Alias ACLToken
|
|
|
|
aux := &struct {
|
|
|
|
ExpirationTTL interface{}
|
|
|
|
Hash string
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
Alias: (*Alias)(t),
|
|
|
|
}
|
2019-12-06 16:14:56 +00:00
|
|
|
|
|
|
|
if err = lib.UnmarshalJSON(data, &aux); err != nil {
|
2019-10-29 18:13:36 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
if aux.ExpirationTTL != nil {
|
|
|
|
switch v := aux.ExpirationTTL.(type) {
|
|
|
|
case string:
|
|
|
|
if t.ExpirationTTL, err = time.ParseDuration(v); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
case float64:
|
|
|
|
t.ExpirationTTL = time.Duration(v)
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
if aux.Hash != "" {
|
|
|
|
t.Hash = []byte(aux.Hash)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-02-12 22:09:26 +00:00
|
|
|
func (t *ACLToken) Clone() *ACLToken {
|
|
|
|
t2 := *t
|
|
|
|
t2.Policies = nil
|
2019-04-15 20:43:19 +00:00
|
|
|
t2.Roles = nil
|
2019-04-08 18:19:09 +00:00
|
|
|
t2.ServiceIdentities = nil
|
2020-06-16 16:54:27 +00:00
|
|
|
t2.NodeIdentities = nil
|
2019-02-12 22:09:26 +00:00
|
|
|
|
|
|
|
if len(t.Policies) > 0 {
|
|
|
|
t2.Policies = make([]ACLTokenPolicyLink, len(t.Policies))
|
|
|
|
copy(t2.Policies, t.Policies)
|
|
|
|
}
|
2019-04-15 20:43:19 +00:00
|
|
|
if len(t.Roles) > 0 {
|
|
|
|
t2.Roles = make([]ACLTokenRoleLink, len(t.Roles))
|
|
|
|
copy(t2.Roles, t.Roles)
|
|
|
|
}
|
2019-04-08 18:19:09 +00:00
|
|
|
if len(t.ServiceIdentities) > 0 {
|
|
|
|
t2.ServiceIdentities = make([]*ACLServiceIdentity, len(t.ServiceIdentities))
|
|
|
|
for i, s := range t.ServiceIdentities {
|
|
|
|
t2.ServiceIdentities[i] = s.Clone()
|
|
|
|
}
|
|
|
|
}
|
2020-06-16 16:54:27 +00:00
|
|
|
if len(t.NodeIdentities) > 0 {
|
|
|
|
t2.NodeIdentities = make([]*ACLNodeIdentity, len(t.NodeIdentities))
|
|
|
|
for i, n := range t.NodeIdentities {
|
|
|
|
t2.NodeIdentities[i] = n.Clone()
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-02-12 22:09:26 +00:00
|
|
|
return &t2
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
func (t *ACLToken) ID() string {
|
|
|
|
return t.AccessorID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (t *ACLToken) SecretToken() string {
|
|
|
|
return t.SecretID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (t *ACLToken) PolicyIDs() []string {
|
2019-04-08 18:19:09 +00:00
|
|
|
if len(t.Policies) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
ids := make([]string, 0, len(t.Policies))
|
2018-10-19 16:04:07 +00:00
|
|
|
for _, link := range t.Policies {
|
|
|
|
ids = append(ids, link.ID)
|
|
|
|
}
|
|
|
|
return ids
|
|
|
|
}
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
func (t *ACLToken) RoleIDs() []string {
|
2019-04-26 17:49:28 +00:00
|
|
|
if len(t.Roles) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
ids := make([]string, 0, len(t.Roles))
|
2019-04-15 20:43:19 +00:00
|
|
|
for _, link := range t.Roles {
|
|
|
|
ids = append(ids, link.ID)
|
|
|
|
}
|
|
|
|
return ids
|
|
|
|
}
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
func (t *ACLToken) ServiceIdentityList() []*ACLServiceIdentity {
|
|
|
|
if len(t.ServiceIdentities) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
out := make([]*ACLServiceIdentity, 0, len(t.ServiceIdentities))
|
|
|
|
for _, s := range t.ServiceIdentities {
|
|
|
|
out = append(out, s.Clone())
|
|
|
|
}
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
2019-04-08 17:05:51 +00:00
|
|
|
func (t *ACLToken) IsExpired(asOf time.Time) bool {
|
2019-04-15 18:35:55 +00:00
|
|
|
if asOf.IsZero() || !t.HasExpirationTime() {
|
2019-04-08 17:05:51 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
return t.ExpirationTime.Before(asOf)
|
|
|
|
}
|
|
|
|
|
2020-03-10 16:15:22 +00:00
|
|
|
func (t *ACLToken) IsLocal() bool {
|
|
|
|
return t.Local
|
|
|
|
}
|
|
|
|
|
2019-04-15 18:35:55 +00:00
|
|
|
func (t *ACLToken) HasExpirationTime() bool {
|
|
|
|
return t.ExpirationTime != nil && !t.ExpirationTime.IsZero()
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
func (t *ACLToken) EnterpriseMetadata() *acl.EnterpriseMeta {
|
2019-10-24 18:38:09 +00:00
|
|
|
return &t.EnterpriseMeta
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
func (t *ACLToken) SetHash(force bool) []byte {
|
|
|
|
if force || t.Hash == nil {
|
|
|
|
// Initialize a 256bit Blake2 hash (32 bytes)
|
|
|
|
hash, err := blake2b.New256(nil)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2019-04-08 17:05:51 +00:00
|
|
|
// Any non-immutable "content" fields should be involved with the
|
|
|
|
// overall hash. The IDs are immutable which is why they aren't here.
|
|
|
|
// The raft indices are metadata similar to the hash which is why they
|
|
|
|
// aren't incorporated. CreateTime is similarly immutable
|
|
|
|
//
|
|
|
|
// The Hash is really only used for replication to determine if a token
|
|
|
|
// has changed and should be updated locally.
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Write all the user set fields
|
|
|
|
hash.Write([]byte(t.Description))
|
|
|
|
|
|
|
|
if t.Local {
|
|
|
|
hash.Write([]byte("local"))
|
|
|
|
} else {
|
|
|
|
hash.Write([]byte("global"))
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, link := range t.Policies {
|
|
|
|
hash.Write([]byte(link.ID))
|
|
|
|
}
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
for _, link := range t.Roles {
|
|
|
|
hash.Write([]byte(link.ID))
|
|
|
|
}
|
|
|
|
|
2019-04-08 18:19:09 +00:00
|
|
|
for _, srvid := range t.ServiceIdentities {
|
|
|
|
srvid.AddToHash(hash)
|
|
|
|
}
|
|
|
|
|
2020-06-16 16:54:27 +00:00
|
|
|
for _, nodeID := range t.NodeIdentities {
|
|
|
|
nodeID.AddToHash(hash)
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
t.EnterpriseMeta.AddToHash(hash, false)
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Finalize the hash
|
|
|
|
hashVal := hash.Sum(nil)
|
|
|
|
|
|
|
|
// Set and return the hash
|
|
|
|
t.Hash = hashVal
|
|
|
|
}
|
|
|
|
return t.Hash
|
|
|
|
}
|
|
|
|
|
|
|
|
func (t *ACLToken) EstimateSize() int {
|
2019-04-08 17:05:51 +00:00
|
|
|
// 41 = 16 (RaftIndex) + 8 (Hash) + 8 (ExpirationTime) + 8 (CreateTime) + 1 (Local)
|
2023-02-06 15:35:52 +00:00
|
|
|
size := 41 + len(t.AccessorID) + len(t.SecretID) + len(t.Description) + len(t.AuthMethod)
|
2018-10-19 16:04:07 +00:00
|
|
|
for _, link := range t.Policies {
|
|
|
|
size += len(link.ID) + len(link.Name)
|
|
|
|
}
|
2019-04-15 20:43:19 +00:00
|
|
|
for _, link := range t.Roles {
|
|
|
|
size += len(link.ID) + len(link.Name)
|
|
|
|
}
|
2019-04-08 18:19:09 +00:00
|
|
|
for _, srvid := range t.ServiceIdentities {
|
2019-04-15 20:43:19 +00:00
|
|
|
size += srvid.EstimateSize()
|
2019-04-08 18:19:09 +00:00
|
|
|
}
|
2020-06-16 16:54:27 +00:00
|
|
|
for _, nodeID := range t.NodeIdentities {
|
|
|
|
size += nodeID.EstimateSize()
|
|
|
|
}
|
2022-03-13 03:55:53 +00:00
|
|
|
return size + t.EnterpriseMeta.EstimateSize()
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokens is a slice of ACLTokens.
|
|
|
|
type ACLTokens []*ACLToken
|
|
|
|
|
|
|
|
type ACLTokenListStub struct {
|
2019-04-08 18:19:09 +00:00
|
|
|
AccessorID string
|
2021-07-08 22:13:08 +00:00
|
|
|
SecretID string
|
2019-04-08 18:19:09 +00:00
|
|
|
Description string
|
2022-05-04 16:38:45 +00:00
|
|
|
Policies []ACLTokenPolicyLink `json:",omitempty"`
|
|
|
|
Roles []ACLTokenRoleLink `json:",omitempty"`
|
|
|
|
ServiceIdentities ACLServiceIdentities `json:",omitempty"`
|
|
|
|
NodeIdentities ACLNodeIdentities `json:",omitempty"`
|
2019-04-08 18:19:09 +00:00
|
|
|
Local bool
|
2019-04-26 17:49:28 +00:00
|
|
|
AuthMethod string `json:",omitempty"`
|
2019-04-15 18:35:55 +00:00
|
|
|
ExpirationTime *time.Time `json:",omitempty"`
|
|
|
|
CreateTime time.Time `json:",omitempty"`
|
2019-04-08 18:19:09 +00:00
|
|
|
Hash []byte
|
|
|
|
CreateIndex uint64
|
|
|
|
ModifyIndex uint64
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2021-07-15 17:38:52 +00:00
|
|
|
ACLAuthMethodEnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ACLTokenListStubs []*ACLTokenListStub
|
|
|
|
|
|
|
|
func (token *ACLToken) Stub() *ACLTokenListStub {
|
|
|
|
return &ACLTokenListStub{
|
2021-07-15 17:38:52 +00:00
|
|
|
AccessorID: token.AccessorID,
|
|
|
|
SecretID: token.SecretID,
|
|
|
|
Description: token.Description,
|
|
|
|
Policies: token.Policies,
|
|
|
|
Roles: token.Roles,
|
|
|
|
ServiceIdentities: token.ServiceIdentities,
|
|
|
|
NodeIdentities: token.NodeIdentities,
|
|
|
|
Local: token.Local,
|
|
|
|
AuthMethod: token.AuthMethod,
|
|
|
|
ExpirationTime: token.ExpirationTime,
|
|
|
|
CreateTime: token.CreateTime,
|
|
|
|
Hash: token.Hash,
|
|
|
|
CreateIndex: token.CreateIndex,
|
|
|
|
ModifyIndex: token.ModifyIndex,
|
|
|
|
EnterpriseMeta: token.EnterpriseMeta,
|
|
|
|
ACLAuthMethodEnterpriseMeta: token.ACLAuthMethodEnterpriseMeta,
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (tokens ACLTokens) Sort() {
|
|
|
|
sort.Slice(tokens, func(i, j int) bool {
|
|
|
|
return tokens[i].AccessorID < tokens[j].AccessorID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func (tokens ACLTokenListStubs) Sort() {
|
|
|
|
sort.Slice(tokens, func(i, j int) bool {
|
|
|
|
return tokens[i].AccessorID < tokens[j].AccessorID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLPolicy struct {
|
|
|
|
// This is the internal UUID associated with the policy
|
|
|
|
ID string
|
|
|
|
|
|
|
|
// Unique name to reference the policy by.
|
|
|
|
// - Valid Characters: [a-zA-Z0-9-]
|
|
|
|
// - Valid Lengths: 1 - 128
|
|
|
|
Name string
|
|
|
|
|
|
|
|
// Human readable description (Optional)
|
|
|
|
Description string
|
|
|
|
|
|
|
|
// The rule set (using the updated rule syntax)
|
|
|
|
Rules string
|
|
|
|
|
|
|
|
// Datacenters that the policy is valid within.
|
|
|
|
// - No wildcards allowed
|
|
|
|
// - If empty then the policy is valid within all datacenters
|
|
|
|
Datacenters []string `json:",omitempty"`
|
|
|
|
|
|
|
|
// Hash of the contents of the policy
|
|
|
|
// This does not take into account the ID (which is immutable)
|
|
|
|
// nor the raft metadata.
|
|
|
|
//
|
|
|
|
// This is needed mainly for replication purposes. When replicating from
|
|
|
|
// one DC to another keeping the content Hash will allow us to avoid
|
|
|
|
// unnecessary calls to the authoritative DC
|
|
|
|
Hash []byte
|
|
|
|
|
2019-10-24 18:38:09 +00:00
|
|
|
// Embedded Enterprise ACL Metadata
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta `mapstructure:",squash"`
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Embedded Raft Metadata
|
|
|
|
RaftIndex `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
2019-10-29 18:13:36 +00:00
|
|
|
func (t *ACLPolicy) UnmarshalJSON(data []byte) error {
|
|
|
|
type Alias ACLPolicy
|
|
|
|
aux := &struct {
|
|
|
|
Hash string
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
Alias: (*Alias)(t),
|
|
|
|
}
|
2019-12-06 16:14:56 +00:00
|
|
|
|
|
|
|
if err := lib.UnmarshalJSON(data, &aux); err != nil {
|
2019-10-29 18:13:36 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
if aux.Hash != "" {
|
|
|
|
t.Hash = []byte(aux.Hash)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-02-12 22:09:26 +00:00
|
|
|
func (p *ACLPolicy) Clone() *ACLPolicy {
|
|
|
|
p2 := *p
|
2022-03-31 19:11:49 +00:00
|
|
|
p2.Datacenters = stringslice.CloneStringSlice(p.Datacenters)
|
2019-02-12 22:09:26 +00:00
|
|
|
return &p2
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLPolicyListStub struct {
|
|
|
|
ID string
|
|
|
|
Name string
|
|
|
|
Description string
|
|
|
|
Datacenters []string
|
|
|
|
Hash []byte
|
|
|
|
CreateIndex uint64
|
|
|
|
ModifyIndex uint64
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (p *ACLPolicy) Stub() *ACLPolicyListStub {
|
|
|
|
return &ACLPolicyListStub{
|
2019-10-24 18:38:09 +00:00
|
|
|
ID: p.ID,
|
|
|
|
Name: p.Name,
|
|
|
|
Description: p.Description,
|
|
|
|
Datacenters: p.Datacenters,
|
|
|
|
Hash: p.Hash,
|
|
|
|
CreateIndex: p.CreateIndex,
|
|
|
|
ModifyIndex: p.ModifyIndex,
|
|
|
|
EnterpriseMeta: p.EnterpriseMeta,
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLPolicies []*ACLPolicy
|
|
|
|
type ACLPolicyListStubs []*ACLPolicyListStub
|
|
|
|
|
|
|
|
func (p *ACLPolicy) SetHash(force bool) []byte {
|
|
|
|
if force || p.Hash == nil {
|
|
|
|
// Initialize a 256bit Blake2 hash (32 bytes)
|
|
|
|
hash, err := blake2b.New256(nil)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
2019-04-08 17:05:51 +00:00
|
|
|
// Any non-immutable "content" fields should be involved with the
|
|
|
|
// overall hash. The ID is immutable which is why it isn't here. The
|
|
|
|
// raft indices are metadata similar to the hash which is why they
|
|
|
|
// aren't incorporated. CreateTime is similarly immutable
|
|
|
|
//
|
|
|
|
// The Hash is really only used for replication to determine if a policy
|
|
|
|
// has changed and should be updated locally.
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Write all the user set fields
|
|
|
|
hash.Write([]byte(p.Name))
|
|
|
|
hash.Write([]byte(p.Description))
|
|
|
|
hash.Write([]byte(p.Rules))
|
|
|
|
for _, dc := range p.Datacenters {
|
|
|
|
hash.Write([]byte(dc))
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
p.EnterpriseMeta.AddToHash(hash, false)
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// Finalize the hash
|
|
|
|
hashVal := hash.Sum(nil)
|
|
|
|
|
|
|
|
// Set and return the hash
|
|
|
|
p.Hash = hashVal
|
|
|
|
}
|
|
|
|
return p.Hash
|
|
|
|
}
|
|
|
|
|
|
|
|
func (p *ACLPolicy) EstimateSize() int {
|
|
|
|
// This is just an estimate. There is other data structure overhead
|
|
|
|
// pointers etc that this does not account for.
|
|
|
|
|
|
|
|
// 64 = 36 (uuid) + 16 (RaftIndex) + 8 (Hash) + 4 (Syntax)
|
|
|
|
size := 64 + len(p.Name) + len(p.Description) + len(p.Rules)
|
|
|
|
for _, dc := range p.Datacenters {
|
|
|
|
size += len(dc)
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
return size + p.EnterpriseMeta.EstimateSize()
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
2019-04-08 17:05:51 +00:00
|
|
|
// HashKey returns a consistent hash for a set of policies.
|
2018-10-19 16:04:07 +00:00
|
|
|
func (policies ACLPolicies) HashKey() string {
|
|
|
|
cacheKeyHash, err := blake2b.New256(nil)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
for _, policy := range policies {
|
|
|
|
cacheKeyHash.Write([]byte(policy.ID))
|
|
|
|
// including the modify index prevents a policy set from being
|
|
|
|
// cached if one of the policies has changed
|
|
|
|
binary.Write(cacheKeyHash, binary.BigEndian, policy.ModifyIndex)
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%x", cacheKeyHash.Sum(nil))
|
2017-08-03 00:05:18 +00:00
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
func (policies ACLPolicies) Sort() {
|
|
|
|
sort.Slice(policies, func(i, j int) bool {
|
|
|
|
return policies[i].ID < policies[j].ID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func (policies ACLPolicyListStubs) Sort() {
|
|
|
|
sort.Slice(policies, func(i, j int) bool {
|
|
|
|
return policies[i].ID < policies[j].ID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
2019-12-18 18:44:32 +00:00
|
|
|
func (policies ACLPolicies) resolveWithCache(cache *ACLCaches, entConf *acl.Config) ([]*acl.Policy, error) {
|
2018-10-19 16:04:07 +00:00
|
|
|
// Parse the policies
|
|
|
|
parsed := make([]*acl.Policy, 0, len(policies))
|
|
|
|
for _, policy := range policies {
|
|
|
|
policy.SetHash(false)
|
|
|
|
cacheKey := fmt.Sprintf("%x", policy.Hash)
|
|
|
|
cachedPolicy := cache.GetParsedPolicy(cacheKey)
|
|
|
|
if cachedPolicy != nil {
|
|
|
|
// policies are content hashed so no need to check the age
|
|
|
|
parsed = append(parsed, cachedPolicy.Policy)
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2023-02-06 15:35:52 +00:00
|
|
|
p, err := acl.NewPolicyFromSource(policy.Rules, entConf, policy.EnterprisePolicyMeta())
|
2018-10-19 16:04:07 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to parse %q: %v", policy.Name, err)
|
|
|
|
}
|
|
|
|
|
|
|
|
cache.PutParsedPolicy(cacheKey, p)
|
|
|
|
parsed = append(parsed, p)
|
|
|
|
}
|
|
|
|
|
|
|
|
return parsed, nil
|
|
|
|
}
|
|
|
|
|
2019-12-18 18:44:32 +00:00
|
|
|
func (policies ACLPolicies) Compile(cache *ACLCaches, entConf *acl.Config) (acl.Authorizer, error) {
|
2018-10-19 16:04:07 +00:00
|
|
|
// Determine the cache key
|
|
|
|
cacheKey := policies.HashKey()
|
|
|
|
entry := cache.GetAuthorizer(cacheKey)
|
|
|
|
if entry != nil {
|
|
|
|
// the hash key takes into account the policy contents. There is no reason to expire this cache or check its age.
|
|
|
|
return entry.Authorizer, nil
|
|
|
|
}
|
|
|
|
|
2019-10-15 20:58:50 +00:00
|
|
|
parsed, err := policies.resolveWithCache(cache, entConf)
|
2018-10-19 16:04:07 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to parse the ACL policies: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Create the ACL object
|
2019-10-25 15:06:16 +00:00
|
|
|
authorizer, err := acl.NewPolicyAuthorizer(parsed, entConf)
|
2018-10-19 16:04:07 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to construct ACL Authorizer: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Update the cache
|
|
|
|
cache.PutAuthorizer(cacheKey, authorizer)
|
|
|
|
return authorizer, nil
|
|
|
|
}
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
type ACLRoles []*ACLRole
|
|
|
|
|
|
|
|
// HashKey returns a consistent hash for a set of roles.
|
|
|
|
func (roles ACLRoles) HashKey() string {
|
|
|
|
cacheKeyHash, err := blake2b.New256(nil)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
for _, role := range roles {
|
|
|
|
cacheKeyHash.Write([]byte(role.ID))
|
|
|
|
// including the modify index prevents a role set from being
|
|
|
|
// cached if one of the roles has changed
|
|
|
|
binary.Write(cacheKeyHash, binary.BigEndian, role.ModifyIndex)
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%x", cacheKeyHash.Sum(nil))
|
|
|
|
}
|
|
|
|
|
|
|
|
func (roles ACLRoles) Sort() {
|
|
|
|
sort.Slice(roles, func(i, j int) bool {
|
|
|
|
return roles[i].ID < roles[j].ID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLRolePolicyLink struct {
|
|
|
|
ID string
|
|
|
|
Name string `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLRole struct {
|
|
|
|
// ID is the internal UUID associated with the role
|
|
|
|
ID string
|
|
|
|
|
|
|
|
// Name is the unique name to reference the role by.
|
|
|
|
Name string
|
|
|
|
|
|
|
|
// Description is a human readable description (Optional)
|
|
|
|
Description string
|
|
|
|
|
|
|
|
// List of policy links.
|
|
|
|
// Note this is the list of IDs and not the names. Prior to role creation
|
|
|
|
// the list of policy names gets validated and the policy IDs get stored herein
|
|
|
|
Policies []ACLRolePolicyLink `json:",omitempty"`
|
|
|
|
|
|
|
|
// List of services to generate synthetic policies for.
|
2022-05-04 16:38:45 +00:00
|
|
|
ServiceIdentities ACLServiceIdentities `json:",omitempty"`
|
2019-04-15 20:43:19 +00:00
|
|
|
|
2020-06-16 16:54:27 +00:00
|
|
|
// List of nodes to generate synthetic policies for.
|
2022-05-04 16:38:45 +00:00
|
|
|
NodeIdentities ACLNodeIdentities `json:",omitempty"`
|
2020-06-16 16:54:27 +00:00
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
// Hash of the contents of the role
|
|
|
|
// This does not take into account the ID (which is immutable)
|
|
|
|
// nor the raft metadata.
|
|
|
|
//
|
|
|
|
// This is needed mainly for replication purposes. When replicating from
|
|
|
|
// one DC to another keeping the content Hash will allow us to avoid
|
|
|
|
// unnecessary calls to the authoritative DC
|
|
|
|
Hash []byte
|
|
|
|
|
2019-10-24 18:38:09 +00:00
|
|
|
// Embedded Enterprise ACL metadata
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta `mapstructure:",squash"`
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
// Embedded Raft Metadata
|
|
|
|
RaftIndex `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
2019-10-29 18:13:36 +00:00
|
|
|
func (t *ACLRole) UnmarshalJSON(data []byte) error {
|
|
|
|
type Alias ACLRole
|
|
|
|
aux := &struct {
|
|
|
|
Hash string
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
Alias: (*Alias)(t),
|
|
|
|
}
|
2019-12-06 16:14:56 +00:00
|
|
|
|
|
|
|
if err := lib.UnmarshalJSON(data, &aux); err != nil {
|
2019-10-29 18:13:36 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
if aux.Hash != "" {
|
|
|
|
t.Hash = []byte(aux.Hash)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
func (r *ACLRole) Clone() *ACLRole {
|
|
|
|
r2 := *r
|
|
|
|
r2.Policies = nil
|
|
|
|
r2.ServiceIdentities = nil
|
2020-06-16 16:54:27 +00:00
|
|
|
r2.NodeIdentities = nil
|
2019-04-15 20:43:19 +00:00
|
|
|
|
|
|
|
if len(r.Policies) > 0 {
|
|
|
|
r2.Policies = make([]ACLRolePolicyLink, len(r.Policies))
|
|
|
|
copy(r2.Policies, r.Policies)
|
|
|
|
}
|
|
|
|
if len(r.ServiceIdentities) > 0 {
|
|
|
|
r2.ServiceIdentities = make([]*ACLServiceIdentity, len(r.ServiceIdentities))
|
|
|
|
for i, s := range r.ServiceIdentities {
|
|
|
|
r2.ServiceIdentities[i] = s.Clone()
|
|
|
|
}
|
|
|
|
}
|
2020-06-16 16:54:27 +00:00
|
|
|
if len(r.NodeIdentities) > 0 {
|
|
|
|
r2.NodeIdentities = make([]*ACLNodeIdentity, len(r.NodeIdentities))
|
|
|
|
for i, n := range r.NodeIdentities {
|
|
|
|
r2.NodeIdentities[i] = n.Clone()
|
|
|
|
}
|
|
|
|
}
|
2019-04-15 20:43:19 +00:00
|
|
|
return &r2
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRole) SetHash(force bool) []byte {
|
|
|
|
if force || r.Hash == nil {
|
|
|
|
// Initialize a 256bit Blake2 hash (32 bytes)
|
|
|
|
hash, err := blake2b.New256(nil)
|
|
|
|
if err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Any non-immutable "content" fields should be involved with the
|
|
|
|
// overall hash. The ID is immutable which is why it isn't here. The
|
|
|
|
// raft indices are metadata similar to the hash which is why they
|
|
|
|
// aren't incorporated. CreateTime is similarly immutable
|
|
|
|
//
|
|
|
|
// The Hash is really only used for replication to determine if a role
|
|
|
|
// has changed and should be updated locally.
|
|
|
|
|
|
|
|
// Write all the user set fields
|
|
|
|
hash.Write([]byte(r.Name))
|
|
|
|
hash.Write([]byte(r.Description))
|
|
|
|
for _, link := range r.Policies {
|
|
|
|
hash.Write([]byte(link.ID))
|
|
|
|
}
|
|
|
|
for _, srvid := range r.ServiceIdentities {
|
|
|
|
srvid.AddToHash(hash)
|
|
|
|
}
|
2020-06-16 16:54:27 +00:00
|
|
|
for _, nodeID := range r.NodeIdentities {
|
|
|
|
nodeID.AddToHash(hash)
|
|
|
|
}
|
2019-04-15 20:43:19 +00:00
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
r.EnterpriseMeta.AddToHash(hash, false)
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
// Finalize the hash
|
|
|
|
hashVal := hash.Sum(nil)
|
|
|
|
|
|
|
|
// Set and return the hash
|
|
|
|
r.Hash = hashVal
|
|
|
|
}
|
|
|
|
return r.Hash
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRole) EstimateSize() int {
|
|
|
|
// This is just an estimate. There is other data structure overhead
|
|
|
|
// pointers etc that this does not account for.
|
|
|
|
|
|
|
|
// 60 = 36 (uuid) + 16 (RaftIndex) + 8 (Hash)
|
|
|
|
size := 60 + len(r.Name) + len(r.Description)
|
|
|
|
for _, link := range r.Policies {
|
|
|
|
size += len(link.ID) + len(link.Name)
|
|
|
|
}
|
|
|
|
for _, srvid := range r.ServiceIdentities {
|
|
|
|
size += srvid.EstimateSize()
|
|
|
|
}
|
2020-06-16 16:54:27 +00:00
|
|
|
for _, nodeID := range r.NodeIdentities {
|
|
|
|
size += nodeID.EstimateSize()
|
|
|
|
}
|
2019-04-15 20:43:19 +00:00
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
return size + r.EnterpriseMeta.EstimateSize()
|
2019-04-15 20:43:19 +00:00
|
|
|
}
|
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
const (
|
|
|
|
// BindingRuleBindTypeService is the binding rule bind type that
|
|
|
|
// assigns a Service Identity to the token that is created using the value
|
|
|
|
// of the computed BindName as the ServiceName like:
|
|
|
|
//
|
|
|
|
// &ACLToken{
|
|
|
|
// ...other fields...
|
|
|
|
// ServiceIdentities: []*ACLServiceIdentity{
|
|
|
|
// &ACLServiceIdentity{
|
|
|
|
// ServiceName: "<computed BindName>",
|
|
|
|
// },
|
|
|
|
// },
|
|
|
|
// }
|
|
|
|
BindingRuleBindTypeService = "service"
|
|
|
|
|
|
|
|
// BindingRuleBindTypeRole is the binding rule bind type that only allows
|
|
|
|
// the binding rule to function if a role with the given name (BindName)
|
|
|
|
// exists at login-time. If it does the token that is created is directly
|
|
|
|
// linked to that role like:
|
|
|
|
//
|
|
|
|
// &ACLToken{
|
|
|
|
// ...other fields...
|
|
|
|
// Roles: []ACLTokenRoleLink{
|
|
|
|
// { Name: "<computed BindName>" }
|
|
|
|
// }
|
|
|
|
// }
|
|
|
|
//
|
|
|
|
// If it does not exist at login-time the rule is ignored.
|
|
|
|
BindingRuleBindTypeRole = "role"
|
2020-06-16 16:54:27 +00:00
|
|
|
|
|
|
|
// BindingRuleBindTypeNode is the binding rule bind type that assigns
|
|
|
|
// a Node Identity to the token that is created using the value of
|
|
|
|
// the computed BindName as the NodeName like:
|
|
|
|
//
|
|
|
|
// &ACLToken{
|
|
|
|
// ...other fields...
|
|
|
|
// NodeIdentities: []*ACLNodeIdentity{
|
|
|
|
// &ACLNodeIdentity{
|
|
|
|
// NodeName: "<computed BindName>",
|
|
|
|
// Datacenter: "<local datacenter of the binding rule>"
|
|
|
|
// }
|
|
|
|
// }
|
|
|
|
// }
|
|
|
|
BindingRuleBindTypeNode = "node"
|
2019-04-26 17:49:28 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type ACLBindingRule struct {
|
|
|
|
// ID is the internal UUID associated with the binding rule
|
|
|
|
ID string
|
|
|
|
|
|
|
|
// Description is a human readable description (Optional)
|
|
|
|
Description string
|
|
|
|
|
|
|
|
// AuthMethod is the name of the auth method for which this rule applies.
|
|
|
|
AuthMethod string
|
|
|
|
|
|
|
|
// Selector is an expression that matches against verified identity
|
|
|
|
// attributes returned from the auth method during login.
|
|
|
|
Selector string
|
|
|
|
|
|
|
|
// BindType adjusts how this binding rule is applied at login time. The
|
|
|
|
// valid values are:
|
|
|
|
//
|
|
|
|
// - BindingRuleBindTypeService = "service"
|
|
|
|
// - BindingRuleBindTypeRole = "role"
|
|
|
|
BindType string
|
|
|
|
|
|
|
|
// BindName is the target of the binding. Can be lightly templated using
|
|
|
|
// HIL ${foo} syntax from available field names. How it is used depends
|
|
|
|
// upon the BindType.
|
|
|
|
BindName string
|
|
|
|
|
2019-10-24 18:38:09 +00:00
|
|
|
// Embedded Enterprise ACL metadata
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta `mapstructure:",squash"`
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
// Embedded Raft Metadata
|
|
|
|
RaftIndex `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLBindingRule) Clone() *ACLBindingRule {
|
|
|
|
r2 := *r
|
|
|
|
return &r2
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLBindingRules []*ACLBindingRule
|
|
|
|
|
|
|
|
func (rules ACLBindingRules) Sort() {
|
|
|
|
sort.Slice(rules, func(i, j int) bool {
|
|
|
|
return rules[i].ID < rules[j].ID
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
Add fields to the /acl/auth-methods endpoint. (#9741)
* A GET of the /acl/auth-method/:name endpoint returns the fields
MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does
not.
The list command returns a filtered subset of the full set. This is
somewhat deliberate, so that secrets aren't shown, but the TTL and
Locality fields aren't (IMO) security critical, and it is useful for
the front end to be able to show them.
For consistency these changes mirror the 'omit empty' and string
representation choices made for the GET call.
This includes changes to the gRPC and API code in the client.
The new output looks similar to this
curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.'
{
"MaxTokenTTL": "8m20s",
"Name": "minikube-ttl-local2",
"Type": "kubernetes",
"Description": "minikube auth method",
"TokenLocality": "local",
"CreateIndex": 530,
"ModifyIndex": 530,
"Namespace": "default"
}
]
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
* Add changelog
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
2021-02-17 16:16:57 +00:00
|
|
|
// Note: this is a subset of ACLAuthMethod's fields
|
2019-04-26 17:49:28 +00:00
|
|
|
type ACLAuthMethodListStub struct {
|
Add fields to the /acl/auth-methods endpoint. (#9741)
* A GET of the /acl/auth-method/:name endpoint returns the fields
MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does
not.
The list command returns a filtered subset of the full set. This is
somewhat deliberate, so that secrets aren't shown, but the TTL and
Locality fields aren't (IMO) security critical, and it is useful for
the front end to be able to show them.
For consistency these changes mirror the 'omit empty' and string
representation choices made for the GET call.
This includes changes to the gRPC and API code in the client.
The new output looks similar to this
curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.'
{
"MaxTokenTTL": "8m20s",
"Name": "minikube-ttl-local2",
"Type": "kubernetes",
"Description": "minikube auth method",
"TokenLocality": "local",
"CreateIndex": 530,
"ModifyIndex": 530,
"Namespace": "default"
}
]
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
* Add changelog
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
2021-02-17 16:16:57 +00:00
|
|
|
Name string
|
|
|
|
Type string
|
|
|
|
DisplayName string `json:",omitempty"`
|
|
|
|
Description string `json:",omitempty"`
|
|
|
|
MaxTokenTTL time.Duration `json:",omitempty"`
|
|
|
|
TokenLocality string `json:",omitempty"`
|
|
|
|
CreateIndex uint64
|
|
|
|
ModifyIndex uint64
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (p *ACLAuthMethod) Stub() *ACLAuthMethodListStub {
|
|
|
|
return &ACLAuthMethodListStub{
|
2019-10-24 18:38:09 +00:00
|
|
|
Name: p.Name,
|
|
|
|
Type: p.Type,
|
2020-05-04 20:18:25 +00:00
|
|
|
DisplayName: p.DisplayName,
|
|
|
|
Description: p.Description,
|
Add fields to the /acl/auth-methods endpoint. (#9741)
* A GET of the /acl/auth-method/:name endpoint returns the fields
MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does
not.
The list command returns a filtered subset of the full set. This is
somewhat deliberate, so that secrets aren't shown, but the TTL and
Locality fields aren't (IMO) security critical, and it is useful for
the front end to be able to show them.
For consistency these changes mirror the 'omit empty' and string
representation choices made for the GET call.
This includes changes to the gRPC and API code in the client.
The new output looks similar to this
curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.'
{
"MaxTokenTTL": "8m20s",
"Name": "minikube-ttl-local2",
"Type": "kubernetes",
"Description": "minikube auth method",
"TokenLocality": "local",
"CreateIndex": 530,
"ModifyIndex": 530,
"Namespace": "default"
}
]
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
* Add changelog
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
2021-02-17 16:16:57 +00:00
|
|
|
MaxTokenTTL: p.MaxTokenTTL,
|
|
|
|
TokenLocality: p.TokenLocality,
|
2019-10-24 18:38:09 +00:00
|
|
|
CreateIndex: p.CreateIndex,
|
|
|
|
ModifyIndex: p.ModifyIndex,
|
|
|
|
EnterpriseMeta: p.EnterpriseMeta,
|
2019-04-26 17:49:28 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
Add fields to the /acl/auth-methods endpoint. (#9741)
* A GET of the /acl/auth-method/:name endpoint returns the fields
MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does
not.
The list command returns a filtered subset of the full set. This is
somewhat deliberate, so that secrets aren't shown, but the TTL and
Locality fields aren't (IMO) security critical, and it is useful for
the front end to be able to show them.
For consistency these changes mirror the 'omit empty' and string
representation choices made for the GET call.
This includes changes to the gRPC and API code in the client.
The new output looks similar to this
curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.'
{
"MaxTokenTTL": "8m20s",
"Name": "minikube-ttl-local2",
"Type": "kubernetes",
"Description": "minikube auth method",
"TokenLocality": "local",
"CreateIndex": 530,
"ModifyIndex": 530,
"Namespace": "default"
}
]
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
* Add changelog
Signed-off-by: Mark Anderson <manderson@hashicorp.com>
2021-02-17 16:16:57 +00:00
|
|
|
// This is nearly identical to the ACLAuthMethod MarshalJSON
|
|
|
|
// Unmarshaling is not implemented because the API is read only
|
|
|
|
func (m *ACLAuthMethodListStub) MarshalJSON() ([]byte, error) {
|
|
|
|
type Alias ACLAuthMethodListStub
|
|
|
|
exported := &struct {
|
|
|
|
MaxTokenTTL string `json:",omitempty"`
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
MaxTokenTTL: m.MaxTokenTTL.String(),
|
|
|
|
Alias: (*Alias)(m),
|
|
|
|
}
|
|
|
|
if m.MaxTokenTTL == 0 {
|
|
|
|
exported.MaxTokenTTL = ""
|
|
|
|
}
|
|
|
|
|
|
|
|
data, err := json.Marshal(exported)
|
|
|
|
|
|
|
|
return data, err
|
|
|
|
}
|
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
type ACLAuthMethods []*ACLAuthMethod
|
|
|
|
type ACLAuthMethodListStubs []*ACLAuthMethodListStub
|
|
|
|
|
|
|
|
func (methods ACLAuthMethods) Sort() {
|
|
|
|
sort.Slice(methods, func(i, j int) bool {
|
|
|
|
return methods[i].Name < methods[j].Name
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func (methods ACLAuthMethodListStubs) Sort() {
|
|
|
|
sort.Slice(methods, func(i, j int) bool {
|
|
|
|
return methods[i].Name < methods[j].Name
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLAuthMethod struct {
|
|
|
|
// Name is a unique identifier for this specific auth method.
|
|
|
|
//
|
|
|
|
// Immutable once set and only settable during create.
|
|
|
|
Name string
|
|
|
|
|
|
|
|
// Type is the type of the auth method this is.
|
|
|
|
//
|
|
|
|
// Immutable once set and only settable during create.
|
|
|
|
Type string
|
|
|
|
|
2020-05-04 20:18:25 +00:00
|
|
|
// DisplayName is an optional name to use instead of the Name field when
|
|
|
|
// displaying information about this auth method in any kind of user
|
|
|
|
// interface.
|
|
|
|
DisplayName string `json:",omitempty"`
|
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
// Description is just an optional bunch of explanatory text.
|
2020-05-04 20:18:25 +00:00
|
|
|
Description string `json:",omitempty"`
|
2019-04-26 17:49:28 +00:00
|
|
|
|
2020-05-04 22:02:57 +00:00
|
|
|
// MaxTokenTTL this is the maximum life of a token created by this method.
|
|
|
|
MaxTokenTTL time.Duration `json:",omitempty"`
|
|
|
|
|
2020-06-01 16:44:47 +00:00
|
|
|
// TokenLocality defines the kind of token that this auth method produces.
|
|
|
|
// This can be either 'local' or 'global'. If empty 'local' is assumed.
|
|
|
|
TokenLocality string `json:",omitempty"`
|
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
// Configuration is arbitrary configuration for the auth method. This
|
|
|
|
// should only contain primitive values and containers (such as lists and
|
|
|
|
// maps).
|
|
|
|
Config map[string]interface{}
|
|
|
|
|
2019-10-24 18:38:09 +00:00
|
|
|
// Embedded Enterprise ACL Meta
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta `mapstructure:",squash"`
|
2019-10-24 18:38:09 +00:00
|
|
|
|
2020-05-06 18:48:04 +00:00
|
|
|
ACLAuthMethodEnterpriseFields `mapstructure:",squash"`
|
|
|
|
|
2019-04-26 17:49:28 +00:00
|
|
|
// Embedded Raft Metadata
|
|
|
|
RaftIndex `hash:"ignore"`
|
|
|
|
}
|
|
|
|
|
2020-05-04 22:02:57 +00:00
|
|
|
func (m *ACLAuthMethod) MarshalJSON() ([]byte, error) {
|
|
|
|
type Alias ACLAuthMethod
|
|
|
|
exported := &struct {
|
|
|
|
MaxTokenTTL string `json:",omitempty"`
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
MaxTokenTTL: m.MaxTokenTTL.String(),
|
|
|
|
Alias: (*Alias)(m),
|
|
|
|
}
|
|
|
|
if m.MaxTokenTTL == 0 {
|
|
|
|
exported.MaxTokenTTL = ""
|
|
|
|
}
|
|
|
|
|
|
|
|
return json.Marshal(exported)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (m *ACLAuthMethod) UnmarshalJSON(data []byte) (err error) {
|
|
|
|
type Alias ACLAuthMethod
|
|
|
|
aux := &struct {
|
|
|
|
MaxTokenTTL interface{}
|
|
|
|
*Alias
|
|
|
|
}{
|
|
|
|
Alias: (*Alias)(m),
|
|
|
|
}
|
|
|
|
if err = lib.UnmarshalJSON(data, &aux); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if aux.MaxTokenTTL != nil {
|
|
|
|
switch v := aux.MaxTokenTTL.(type) {
|
|
|
|
case string:
|
|
|
|
if m.MaxTokenTTL, err = time.ParseDuration(v); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
case float64:
|
|
|
|
m.MaxTokenTTL = time.Duration(v)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLReplicationType string
|
|
|
|
|
|
|
|
const (
|
|
|
|
ACLReplicatePolicies ACLReplicationType = "policies"
|
2019-04-15 20:43:19 +00:00
|
|
|
ACLReplicateRoles ACLReplicationType = "roles"
|
2018-10-19 16:04:07 +00:00
|
|
|
ACLReplicateTokens ACLReplicationType = "tokens"
|
|
|
|
)
|
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
func (t ACLReplicationType) SingularNoun() string {
|
|
|
|
switch t {
|
|
|
|
case ACLReplicatePolicies:
|
|
|
|
return "policy"
|
|
|
|
case ACLReplicateRoles:
|
|
|
|
return "role"
|
|
|
|
case ACLReplicateTokens:
|
|
|
|
return "token"
|
|
|
|
default:
|
|
|
|
return "<UNKNOWN>"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// ACLReplicationStatus provides information about the health of the ACL
|
|
|
|
// replication system.
|
|
|
|
type ACLReplicationStatus struct {
|
|
|
|
Enabled bool
|
|
|
|
Running bool
|
|
|
|
SourceDatacenter string
|
|
|
|
ReplicationType ACLReplicationType
|
|
|
|
ReplicatedIndex uint64
|
2019-04-15 20:43:19 +00:00
|
|
|
ReplicatedRoleIndex uint64
|
2018-10-19 16:04:07 +00:00
|
|
|
ReplicatedTokenIndex uint64
|
|
|
|
LastSuccess time.Time
|
|
|
|
LastError time.Time
|
2021-07-15 09:31:44 +00:00
|
|
|
LastErrorMessage string
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLTokenSetRequest is used for token creation and update operations
|
2018-10-19 16:04:07 +00:00
|
|
|
// at the RPC layer
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLTokenSetRequest struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
ACLToken ACLToken // Token to manipulate - I really dislike this name but "Token" is taken in the WriteRequest
|
2019-04-30 15:45:36 +00:00
|
|
|
Create bool // Used to explicitly mark this request as a creation
|
2018-10-19 16:04:07 +00:00
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLTokenSetRequest) RequestDatacenter() string {
|
2018-10-19 16:04:07 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLTokenGetRequest is used for token read operations at the RPC layer
|
|
|
|
type ACLTokenGetRequest struct {
|
2023-02-07 18:26:30 +00:00
|
|
|
TokenID string // Accessor ID used for the token lookup
|
2018-10-19 16:04:07 +00:00
|
|
|
TokenIDType ACLTokenIDType // The Type of ID used to lookup the token
|
2022-03-31 16:49:11 +00:00
|
|
|
Expanded bool
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLTokenGetRequest) RequestDatacenter() string {
|
2018-10-19 16:04:07 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokenDeleteRequest is used for token deletion operations at the RPC layer
|
|
|
|
type ACLTokenDeleteRequest struct {
|
2023-02-07 18:26:30 +00:00
|
|
|
TokenID string // Accessor ID of the token to delete
|
2018-10-19 16:04:07 +00:00
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLTokenDeleteRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokenListRequest is used for token listing operations at the RPC layer
|
|
|
|
type ACLTokenListRequest struct {
|
|
|
|
IncludeLocal bool // Whether local tokens should be included
|
|
|
|
IncludeGlobal bool // Whether global tokens should be included
|
|
|
|
Policy string // Policy filter
|
2019-04-15 20:43:19 +00:00
|
|
|
Role string // Role filter
|
2019-04-26 17:49:28 +00:00
|
|
|
AuthMethod string // Auth Method filter
|
2018-10-19 16:04:07 +00:00
|
|
|
Datacenter string // The datacenter to perform the request within
|
2020-01-14 15:09:29 +00:00
|
|
|
ACLAuthMethodEnterpriseMeta
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLTokenListRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokenListResponse is used to return the secret data free stubs
|
|
|
|
// of the tokens
|
|
|
|
type ACLTokenListResponse struct {
|
|
|
|
Tokens ACLTokenListStubs
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLTokenBatchGetRequest is used for reading multiple tokens, this is
|
2023-07-31 17:56:09 +00:00
|
|
|
// different from the token list request in that only tokens with the
|
2018-10-19 16:04:07 +00:00
|
|
|
// the requested ids are returned
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLTokenBatchGetRequest struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
AccessorIDs []string // List of accessor ids to fetch
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLTokenBatchGetRequest) RequestDatacenter() string {
|
2018-10-19 16:04:07 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLTokenBatchSetRequest is used only at the Raft layer
|
2018-10-19 16:04:07 +00:00
|
|
|
// for batching multiple token creation/update operations
|
|
|
|
//
|
|
|
|
// This is particularly useful during token replication and during
|
|
|
|
// automatic legacy token upgrades.
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLTokenBatchSetRequest struct {
|
2019-05-03 19:22:44 +00:00
|
|
|
Tokens ACLTokens
|
|
|
|
CAS bool
|
|
|
|
AllowMissingLinks bool
|
|
|
|
ProhibitUnprivileged bool
|
2020-12-09 21:22:29 +00:00
|
|
|
FromReplication bool
|
2018-10-19 16:04:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokenBatchDeleteRequest is used only at the Raft layer
|
|
|
|
// for batching multiple token deletions.
|
|
|
|
//
|
|
|
|
// This is particularly useful during token replication when
|
|
|
|
// multiple tokens need to be removed from the local DCs state.
|
|
|
|
type ACLTokenBatchDeleteRequest struct {
|
|
|
|
TokenIDs []string // Tokens to delete
|
|
|
|
}
|
|
|
|
|
2023-01-04 20:19:33 +00:00
|
|
|
type ACLInitialTokenBootstrapRequest struct {
|
|
|
|
BootstrapSecret string
|
|
|
|
Datacenter string
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLInitialTokenBootstrapRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// ACLTokenBootstrapRequest is used only at the Raft layer
|
|
|
|
// for ACL bootstrapping
|
|
|
|
//
|
2023-01-04 20:19:33 +00:00
|
|
|
// The RPC layer will use ACLInitialTokenBootstrapRequest to indicate
|
2018-10-19 16:04:07 +00:00
|
|
|
// that bootstrapping must be performed but the actual token
|
|
|
|
// and the resetIndex will be generated by that RPC endpoint
|
|
|
|
type ACLTokenBootstrapRequest struct {
|
|
|
|
Token ACLToken // Token to use for bootstrapping
|
|
|
|
ResetIndex uint64 // Reset index
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLTokenResponse returns a single Token + metadata
|
|
|
|
type ACLTokenResponse struct {
|
2020-06-09 19:13:09 +00:00
|
|
|
Token *ACLToken
|
|
|
|
Redacted bool // whether the token's secret was redacted
|
|
|
|
SourceDatacenter string
|
2022-03-31 16:49:11 +00:00
|
|
|
|
|
|
|
ExpandedTokenInfo
|
2018-10-19 16:04:07 +00:00
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2022-03-31 16:49:11 +00:00
|
|
|
type ExpandedTokenInfo struct {
|
|
|
|
ExpandedPolicies []*ACLPolicy
|
|
|
|
ExpandedRoles []*ACLRole
|
|
|
|
|
|
|
|
NamespaceDefaultPolicyIDs []string
|
|
|
|
NamespaceDefaultRoleIDs []string
|
|
|
|
|
|
|
|
AgentACLDefaultPolicy string
|
|
|
|
AgentACLDownPolicy string
|
|
|
|
ResolvedByAgent string
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLTokenExpanded struct {
|
|
|
|
*ACLToken
|
|
|
|
ExpandedTokenInfo
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLTokenBatchResponse returns multiple Tokens associated with the same metadata
|
|
|
|
type ACLTokenBatchResponse struct {
|
2019-03-04 14:52:45 +00:00
|
|
|
Tokens []*ACLToken
|
|
|
|
Redacted bool // whether the token secrets were redacted.
|
2019-10-24 18:38:09 +00:00
|
|
|
Removed bool // whether any tokens were completely removed
|
2018-10-19 16:04:07 +00:00
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLPolicySetRequest is used at the RPC layer for creation and update requests
|
|
|
|
type ACLPolicySetRequest struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
Policy ACLPolicy // The policy to upsert
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2017-08-03 00:05:18 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLPolicySetRequest) RequestDatacenter() string {
|
2017-08-03 00:05:18 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// ACLPolicyDeleteRequest is used at the RPC layer deletion requests
|
|
|
|
type ACLPolicyDeleteRequest struct {
|
|
|
|
PolicyID string // The id of the policy to delete
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2018-10-19 16:04:07 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLPolicyDeleteRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
2017-08-03 00:05:18 +00:00
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLPolicyGetRequest is used at the RPC layer to perform policy read operations
|
|
|
|
type ACLPolicyGetRequest struct {
|
2020-03-25 14:34:24 +00:00
|
|
|
PolicyID string // id used for the policy lookup (one of PolicyID or PolicyName is allowed)
|
|
|
|
PolicyName string // name used for the policy lookup (one of PolicyID or PolicyName is allowed)
|
2018-10-19 16:04:07 +00:00
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2017-08-03 00:05:18 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLPolicyGetRequest) RequestDatacenter() string {
|
2017-08-03 00:05:18 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
// ACLPolicyListRequest is used at the RPC layer to request a listing of policies
|
|
|
|
type ACLPolicyListRequest struct {
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2017-08-03 00:05:18 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
func (r *ACLPolicyListRequest) RequestDatacenter() string {
|
2017-08-03 00:05:18 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
2018-10-19 16:04:07 +00:00
|
|
|
type ACLPolicyListResponse struct {
|
|
|
|
Policies ACLPolicyListStubs
|
2017-08-03 00:05:18 +00:00
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLPolicyBatchGetRequest is used at the RPC layer to request a subset of
|
2018-10-19 16:04:07 +00:00
|
|
|
// the policies associated with the token used for retrieval
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLPolicyBatchGetRequest struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
PolicyIDs []string // List of policy ids to fetch
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
func (r *ACLPolicyBatchGetRequest) RequestDatacenter() string {
|
2018-10-19 16:04:07 +00:00
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLPolicyResponse returns a single policy + metadata
|
|
|
|
type ACLPolicyResponse struct {
|
|
|
|
Policy *ACLPolicy
|
2017-08-03 00:05:18 +00:00
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLPolicyBatchResponse struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
Policies []*ACLPolicy
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
2018-10-31 20:00:46 +00:00
|
|
|
// ACLPolicyBatchSetRequest is used at the Raft layer for batching
|
2018-10-19 16:04:07 +00:00
|
|
|
// multiple policy creations and updates
|
|
|
|
//
|
|
|
|
// This is particularly useful during replication
|
2018-10-31 20:00:46 +00:00
|
|
|
type ACLPolicyBatchSetRequest struct {
|
2018-10-19 16:04:07 +00:00
|
|
|
Policies ACLPolicies
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLPolicyBatchDeleteRequest is used at the Raft layer for batching
|
|
|
|
// multiple policy deletions
|
|
|
|
//
|
|
|
|
// This is particularly useful during replication
|
|
|
|
type ACLPolicyBatchDeleteRequest struct {
|
|
|
|
PolicyIDs []string
|
2017-08-03 00:05:18 +00:00
|
|
|
}
|
2019-04-08 18:19:09 +00:00
|
|
|
|
2019-04-15 20:43:19 +00:00
|
|
|
// ACLRoleSetRequest is used at the RPC layer for creation and update requests
|
|
|
|
type ACLRoleSetRequest struct {
|
2019-04-26 17:49:28 +00:00
|
|
|
Role ACLRole // The role to upsert
|
2019-04-15 20:43:19 +00:00
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRoleSetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleDeleteRequest is used at the RPC layer deletion requests
|
|
|
|
type ACLRoleDeleteRequest struct {
|
|
|
|
RoleID string // id of the role to delete
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-15 20:43:19 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRoleDeleteRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleGetRequest is used at the RPC layer to perform role read operations
|
|
|
|
type ACLRoleGetRequest struct {
|
|
|
|
RoleID string // id used for the role lookup (one of RoleID or RoleName is allowed)
|
|
|
|
RoleName string // name used for the role lookup (one of RoleID or RoleName is allowed)
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-15 20:43:19 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRoleGetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleListRequest is used at the RPC layer to request a listing of roles
|
|
|
|
type ACLRoleListRequest struct {
|
|
|
|
Policy string // Policy filter
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-15 20:43:19 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRoleListRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLRoleListResponse struct {
|
|
|
|
Roles ACLRoles
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleBatchGetRequest is used at the RPC layer to request a subset of
|
|
|
|
// the roles associated with the token used for retrieval
|
|
|
|
type ACLRoleBatchGetRequest struct {
|
|
|
|
RoleIDs []string // List of role ids to fetch
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLRoleBatchGetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleResponse returns a single role + metadata
|
|
|
|
type ACLRoleResponse struct {
|
|
|
|
Role *ACLRole
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLRoleBatchResponse struct {
|
|
|
|
Roles []*ACLRole
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleBatchSetRequest is used at the Raft layer for batching
|
|
|
|
// multiple role creations and updates
|
|
|
|
//
|
|
|
|
// This is particularly useful during replication
|
|
|
|
type ACLRoleBatchSetRequest struct {
|
2019-05-02 20:02:21 +00:00
|
|
|
Roles ACLRoles
|
|
|
|
AllowMissingLinks bool
|
2019-04-15 20:43:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ACLRoleBatchDeleteRequest is used at the Raft layer for batching
|
|
|
|
// multiple role deletions
|
|
|
|
//
|
|
|
|
// This is particularly useful during replication
|
|
|
|
type ACLRoleBatchDeleteRequest struct {
|
|
|
|
RoleIDs []string
|
|
|
|
}
|
2019-04-26 17:49:28 +00:00
|
|
|
|
|
|
|
// ACLBindingRuleSetRequest is used at the RPC layer for creation and update requests
|
|
|
|
type ACLBindingRuleSetRequest struct {
|
|
|
|
BindingRule ACLBindingRule // The rule to upsert
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLBindingRuleSetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleDeleteRequest is used at the RPC layer deletion requests
|
|
|
|
type ACLBindingRuleDeleteRequest struct {
|
|
|
|
BindingRuleID string // id of the rule to delete
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLBindingRuleDeleteRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleGetRequest is used at the RPC layer to perform rule read operations
|
|
|
|
type ACLBindingRuleGetRequest struct {
|
|
|
|
BindingRuleID string // id used for the rule lookup
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLBindingRuleGetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleListRequest is used at the RPC layer to request a listing of rules
|
|
|
|
type ACLBindingRuleListRequest struct {
|
|
|
|
AuthMethod string // optional filter
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLBindingRuleListRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLBindingRuleListResponse struct {
|
|
|
|
BindingRules ACLBindingRules
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleResponse returns a single binding + metadata
|
|
|
|
type ACLBindingRuleResponse struct {
|
|
|
|
BindingRule *ACLBindingRule
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleBatchSetRequest is used at the Raft layer for batching
|
|
|
|
// multiple rule creations and updates
|
|
|
|
type ACLBindingRuleBatchSetRequest struct {
|
|
|
|
BindingRules ACLBindingRules
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLBindingRuleBatchDeleteRequest is used at the Raft layer for batching
|
|
|
|
// multiple rule deletions
|
|
|
|
type ACLBindingRuleBatchDeleteRequest struct {
|
|
|
|
BindingRuleIDs []string
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodSetRequest is used at the RPC layer for creation and update requests
|
|
|
|
type ACLAuthMethodSetRequest struct {
|
|
|
|
AuthMethod ACLAuthMethod // The auth method to upsert
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLAuthMethodSetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodDeleteRequest is used at the RPC layer deletion requests
|
|
|
|
type ACLAuthMethodDeleteRequest struct {
|
|
|
|
AuthMethodName string // name of the auth method to delete
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLAuthMethodDeleteRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodGetRequest is used at the RPC layer to perform rule read operations
|
|
|
|
type ACLAuthMethodGetRequest struct {
|
|
|
|
AuthMethodName string // name used for the auth method lookup
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLAuthMethodGetRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodListRequest is used at the RPC layer to request a listing of auth methods
|
|
|
|
type ACLAuthMethodListRequest struct {
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLAuthMethodListRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLAuthMethodListResponse struct {
|
|
|
|
AuthMethods ACLAuthMethodListStubs
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodResponse returns a single auth method + metadata
|
|
|
|
type ACLAuthMethodResponse struct {
|
|
|
|
AuthMethod *ACLAuthMethod
|
|
|
|
QueryMeta
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodBatchSetRequest is used at the Raft layer for batching
|
|
|
|
// multiple auth method creations and updates
|
|
|
|
type ACLAuthMethodBatchSetRequest struct {
|
|
|
|
AuthMethods ACLAuthMethods
|
|
|
|
}
|
|
|
|
|
|
|
|
// ACLAuthMethodBatchDeleteRequest is used at the Raft layer for batching
|
|
|
|
// multiple auth method deletions
|
|
|
|
type ACLAuthMethodBatchDeleteRequest struct {
|
|
|
|
AuthMethodNames []string
|
2019-10-24 18:38:09 +00:00
|
|
|
// While it may seem odd that AuthMethodNames is associated with a single
|
|
|
|
// EnterpriseMeta, it is okay as this struct is only ever used to
|
|
|
|
// delete a single entry. This is because AuthMethods unlike tokens, policies
|
|
|
|
// and roles are not replicated between datacenters and therefore never
|
|
|
|
// batch applied.
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ACLLoginParams struct {
|
|
|
|
AuthMethod string
|
|
|
|
BearerToken string
|
|
|
|
Meta map[string]string `json:",omitempty"`
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-04-26 17:49:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ACLLoginRequest struct {
|
|
|
|
Auth *ACLLoginParams
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLLoginRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLLogoutRequest struct {
|
|
|
|
Datacenter string // The datacenter to perform the request within
|
|
|
|
WriteRequest
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *ACLLogoutRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
2019-12-06 14:25:26 +00:00
|
|
|
|
|
|
|
type RemoteACLAuthorizationRequest struct {
|
|
|
|
Datacenter string
|
|
|
|
Requests []ACLAuthorizationRequest
|
|
|
|
QueryOptions
|
|
|
|
}
|
|
|
|
|
|
|
|
type ACLAuthorizationRequest struct {
|
|
|
|
Resource acl.Resource
|
|
|
|
Segment string `json:",omitempty"`
|
|
|
|
Access string
|
2022-03-13 03:55:53 +00:00
|
|
|
acl.EnterpriseMeta
|
2019-12-06 14:25:26 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
type ACLAuthorizationResponse struct {
|
|
|
|
ACLAuthorizationRequest
|
|
|
|
Allow bool
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r *RemoteACLAuthorizationRequest) RequestDatacenter() string {
|
|
|
|
return r.Datacenter
|
|
|
|
}
|
|
|
|
|
|
|
|
func CreateACLAuthorizationResponses(authz acl.Authorizer, requests []ACLAuthorizationRequest) ([]ACLAuthorizationResponse, error) {
|
|
|
|
responses := make([]ACLAuthorizationResponse, len(requests))
|
2019-12-18 18:43:24 +00:00
|
|
|
var ctx acl.AuthorizerContext
|
2019-12-06 14:25:26 +00:00
|
|
|
|
|
|
|
for idx, req := range requests {
|
|
|
|
req.FillAuthzContext(&ctx)
|
|
|
|
decision, err := acl.Enforce(authz, req.Resource, req.Segment, req.Access, &ctx)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
responses[idx].ACLAuthorizationRequest = req
|
|
|
|
responses[idx].Allow = decision == acl.Allow
|
|
|
|
}
|
|
|
|
|
|
|
|
return responses, nil
|
|
|
|
}
|
2021-04-14 16:39:35 +00:00
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
type AgentRecoveryTokenIdentity struct {
|
2021-04-14 16:39:35 +00:00
|
|
|
agent string
|
|
|
|
secretID string
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func NewAgentRecoveryTokenIdentity(agent string, secretID string) *AgentRecoveryTokenIdentity {
|
|
|
|
return &AgentRecoveryTokenIdentity{
|
2021-04-14 16:39:35 +00:00
|
|
|
agent: agent,
|
|
|
|
secretID: secretID,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) ID() string {
|
|
|
|
return fmt.Sprintf("agent-recovery:%s", id.agent)
|
2021-04-14 16:39:35 +00:00
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) SecretToken() string {
|
2021-04-14 16:39:35 +00:00
|
|
|
return id.secretID
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) PolicyIDs() []string {
|
2021-04-14 16:39:35 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) RoleIDs() []string {
|
2021-04-14 16:39:35 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) ServiceIdentityList() []*ACLServiceIdentity {
|
2021-04-14 16:39:35 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) NodeIdentityList() []*ACLNodeIdentity {
|
2021-04-14 16:39:35 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) IsExpired(asOf time.Time) bool {
|
2021-04-14 16:39:35 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2022-01-20 12:47:50 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) IsLocal() bool {
|
2021-04-14 16:39:35 +00:00
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2022-03-13 03:55:53 +00:00
|
|
|
func (id *AgentRecoveryTokenIdentity) EnterpriseMetadata() *acl.EnterpriseMeta {
|
2021-04-14 16:39:35 +00:00
|
|
|
return nil
|
|
|
|
}
|
2022-09-09 19:05:38 +00:00
|
|
|
|
2022-09-09 19:06:48 +00:00
|
|
|
const ServerManagementTokenAccessorID = "server-management-token"
|
2022-09-09 19:05:38 +00:00
|
|
|
|
|
|
|
type ACLServerIdentity struct {
|
|
|
|
secretID string
|
|
|
|
}
|
|
|
|
|
|
|
|
func NewACLServerIdentity(secretID string) *ACLServerIdentity {
|
|
|
|
return &ACLServerIdentity{
|
|
|
|
secretID: secretID,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) ID() string {
|
2022-09-09 19:06:48 +00:00
|
|
|
return ServerManagementTokenAccessorID
|
2022-09-09 19:05:38 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) SecretToken() string {
|
|
|
|
return i.secretID
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) PolicyIDs() []string {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) RoleIDs() []string {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) ServiceIdentityList() []*ACLServiceIdentity {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) NodeIdentityList() []*ACLNodeIdentity {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) IsExpired(asOf time.Time) bool {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) IsLocal() bool {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
func (i *ACLServerIdentity) EnterpriseMetadata() *acl.EnterpriseMeta {
|
|
|
|
return acl.DefaultEnterpriseMeta()
|
|
|
|
}
|