consul/acl/policy_merger.go

package acl

import (
	"encoding/binary"
	"fmt"
	"hash"

	"golang.org/x/crypto/blake2b"
)

type policyRulesMergeContext struct {
	aclRule                  string
	agentRules               map[string]*AgentRule
	agentPrefixRules         map[string]*AgentRule
	eventRules               map[string]*EventRule
	eventPrefixRules         map[string]*EventRule
	keyringRule              string
	keyRules                 map[string]*KeyRule
	keyPrefixRules           map[string]*KeyRule
	meshRule                 string
	nodeRules                map[string]*NodeRule
	nodePrefixRules          map[string]*NodeRule
	operatorRule             string
	preparedQueryRules       map[string]*PreparedQueryRule
	preparedQueryPrefixRules map[string]*PreparedQueryRule
	serviceRules             map[string]*ServiceRule
	servicePrefixRules       map[string]*ServiceRule
	sessionRules             map[string]*SessionRule
	sessionPrefixRules       map[string]*SessionRule
}

func (p *policyRulesMergeContext) init() {
	p.aclRule = ""
	p.agentRules = make(map[string]*AgentRule)
	p.agentPrefixRules = make(map[string]*AgentRule)
	p.eventRules = make(map[string]*EventRule)
	p.eventPrefixRules = make(map[string]*EventRule)
	p.keyringRule = ""
	p.keyRules = make(map[string]*KeyRule)
	p.keyPrefixRules = make(map[string]*KeyRule)
	p.meshRule = ""
	p.nodeRules = make(map[string]*NodeRule)
	p.nodePrefixRules = make(map[string]*NodeRule)
	p.operatorRule = ""
	p.preparedQueryRules = make(map[string]*PreparedQueryRule)
	p.preparedQueryPrefixRules = make(map[string]*PreparedQueryRule)
	p.serviceRules = make(map[string]*ServiceRule)
	p.servicePrefixRules = make(map[string]*ServiceRule)
	p.sessionRules = make(map[string]*SessionRule)
	p.sessionPrefixRules = make(map[string]*SessionRule)
}

func (p *policyRulesMergeContext) merge(policy *PolicyRules) {
	if takesPrecedenceOver(policy.ACL, p.aclRule) {
		p.aclRule = policy.ACL
	}

	for _, ap := range policy.Agents {
		update := true
		if permission, found := p.agentRules[ap.Node]; found {
			update = takesPrecedenceOver(ap.Policy, permission.Policy)
		}

		if update {
			p.agentRules[ap.Node] = ap
		}
	}

	for _, ap := range policy.AgentPrefixes {
		update := true
		if permission, found := p.agentPrefixRules[ap.Node]; found {
			update = takesPrecedenceOver(ap.Policy, permission.Policy)
		}

		if update {
			p.agentPrefixRules[ap.Node] = ap
		}
	}

	for _, ep := range policy.Events {
		update := true
		if permission, found := p.eventRules[ep.Event]; found {
			update = takesPrecedenceOver(ep.Policy, permission.Policy)
		}

		if update {
			p.eventRules[ep.Event] = ep
		}
	}

	for _, ep := range policy.EventPrefixes {
		update := true
		if permission, found := p.eventPrefixRules[ep.Event]; found {
			update = takesPrecedenceOver(ep.Policy, permission.Policy)
		}

		if update {
			p.eventPrefixRules[ep.Event] = ep
		}
	}

	if takesPrecedenceOver(policy.Keyring, p.keyringRule) {
		p.keyringRule = policy.Keyring
	}

	for _, kp := range policy.Keys {
		update := true
		if permission, found := p.keyRules[kp.Prefix]; found {
			update = takesPrecedenceOver(kp.Policy, permission.Policy)
		}

		if update {
			p.keyRules[kp.Prefix] = kp
		}
	}

	for _, kp := range policy.KeyPrefixes {
		update := true
		if permission, found := p.keyPrefixRules[kp.Prefix]; found {
			update = takesPrecedenceOver(kp.Policy, permission.Policy)
		}

		if update {
			p.keyPrefixRules[kp.Prefix] = kp
		}
	}

	if takesPrecedenceOver(policy.Mesh, p.meshRule) {
		p.meshRule = policy.Mesh
	}

	for _, np := range policy.Nodes {
		update := true
		if permission, found := p.nodeRules[np.Name]; found {
			update = takesPrecedenceOver(np.Policy, permission.Policy)
		}

		if update {
			p.nodeRules[np.Name] = np
		}
	}

	for _, np := range policy.NodePrefixes {
		update := true
		if permission, found := p.nodePrefixRules[np.Name]; found {
			update = takesPrecedenceOver(np.Policy, permission.Policy)
		}

		if update {
			p.nodePrefixRules[np.Name] = np
		}
	}

	if takesPrecedenceOver(policy.Operator, p.operatorRule) {
		p.operatorRule = policy.Operator
	}

	for _, qp := range policy.PreparedQueries {
		update := true
		if permission, found := p.preparedQueryRules[qp.Prefix]; found {
			update = takesPrecedenceOver(qp.Policy, permission.Policy)
		}

		if update {
			p.preparedQueryRules[qp.Prefix] = qp
		}
	}

	for _, qp := range policy.PreparedQueryPrefixes {
		update := true
		if permission, found := p.preparedQueryPrefixRules[qp.Prefix]; found {
			update = takesPrecedenceOver(qp.Policy, permission.Policy)
		}

		if update {
			p.preparedQueryPrefixRules[qp.Prefix] = qp
		}
	}

	for _, sp := range policy.Services {
		existing, found := p.serviceRules[sp.Name]

		if !found {
			p.serviceRules[sp.Name] = sp
			continue
		}

		if takesPrecedenceOver(sp.Policy, existing.Policy) {
			existing.Policy = sp.Policy
			existing.EnterpriseRule = sp.EnterpriseRule
		}

		if takesPrecedenceOver(sp.Intentions, existing.Intentions) {
			existing.Intentions = sp.Intentions
		}
	}

	for _, sp := range policy.ServicePrefixes {
		existing, found := p.servicePrefixRules[sp.Name]

		if !found {
			p.servicePrefixRules[sp.Name] = sp
			continue
		}

		if takesPrecedenceOver(sp.Policy, existing.Policy) {
			existing.Policy = sp.Policy
			existing.EnterpriseRule = sp.EnterpriseRule
		}

		if takesPrecedenceOver(sp.Intentions, existing.Intentions) {
			existing.Intentions = sp.Intentions
		}
	}

	for _, sp := range policy.Sessions {
		update := true
		if permission, found := p.sessionRules[sp.Node]; found {
			update = takesPrecedenceOver(sp.Policy, permission.Policy)
		}

		if update {
			p.sessionRules[sp.Node] = sp
		}
	}

	for _, sp := range policy.SessionPrefixes {
		update := true
		if permission, found := p.sessionPrefixRules[sp.Node]; found {
			update = takesPrecedenceOver(sp.Policy, permission.Policy)
		}

		if update {
			p.sessionPrefixRules[sp.Node] = sp
		}
	}
}

func (p *policyRulesMergeContext) fill(merged *PolicyRules) {
	merged.ACL = p.aclRule
	merged.Keyring = p.keyringRule
	merged.Operator = p.operatorRule
	merged.Mesh = p.meshRule

	// All the for loop appends are ugly but Go doesn't have a way to get
	// a slice of all values within a map so this is necessary

	merged.Agents = []*AgentRule{}
	for _, policy := range p.agentRules {
		merged.Agents = append(merged.Agents, policy)
	}

	merged.AgentPrefixes = []*AgentRule{}
	for _, policy := range p.agentPrefixRules {
		merged.AgentPrefixes = append(merged.AgentPrefixes, policy)
	}

	merged.Events = []*EventRule{}
	for _, policy := range p.eventRules {
		merged.Events = append(merged.Events, policy)
	}

	merged.EventPrefixes = []*EventRule{}
	for _, policy := range p.eventPrefixRules {
		merged.EventPrefixes = append(merged.EventPrefixes, policy)
	}

	merged.Keys = []*KeyRule{}
	for _, policy := range p.keyRules {
		merged.Keys = append(merged.Keys, policy)
	}

	merged.KeyPrefixes = []*KeyRule{}
	for _, policy := range p.keyPrefixRules {
		merged.KeyPrefixes = append(merged.KeyPrefixes, policy)
	}

	merged.Nodes = []*NodeRule{}
	for _, policy := range p.nodeRules {
		merged.Nodes = append(merged.Nodes, policy)
	}

	merged.NodePrefixes = []*NodeRule{}
	for _, policy := range p.nodePrefixRules {
		merged.NodePrefixes = append(merged.NodePrefixes, policy)
	}

	merged.PreparedQueries = []*PreparedQueryRule{}
	for _, policy := range p.preparedQueryRules {
		merged.PreparedQueries = append(merged.PreparedQueries, policy)
	}

	merged.PreparedQueryPrefixes = []*PreparedQueryRule{}
	for _, policy := range p.preparedQueryPrefixRules {
		merged.PreparedQueryPrefixes = append(merged.PreparedQueryPrefixes, policy)
	}

	merged.Services = []*ServiceRule{}
	for _, policy := range p.serviceRules {
		merged.Services = append(merged.Services, policy)
	}

	merged.ServicePrefixes = []*ServiceRule{}
	for _, policy := range p.servicePrefixRules {
		merged.ServicePrefixes = append(merged.ServicePrefixes, policy)
	}

	merged.Sessions = []*SessionRule{}
	for _, policy := range p.sessionRules {
		merged.Sessions = append(merged.Sessions, policy)
	}

	merged.SessionPrefixes = []*SessionRule{}
	for _, policy := range p.sessionPrefixRules {
		merged.SessionPrefixes = append(merged.SessionPrefixes, policy)
	}
}

type PolicyMerger struct {
	idHasher hash.Hash
	policyRulesMergeContext
	enterprisePolicyRulesMergeContext
}

func NewPolicyMerger() *PolicyMerger {
	merger := &PolicyMerger{}
	merger.init()
	return merger
}

func (m *PolicyMerger) init() {
	var err error
	m.idHasher, err = blake2b.New256(nil)
	if err != nil {
		panic(err)
	}

	m.policyRulesMergeContext.init()
	m.enterprisePolicyRulesMergeContext.init()
}

func (m *PolicyMerger) Merge(policy *Policy) {
	// This is part of calculating the merged policies ID
	m.idHasher.Write([]byte(policy.ID))
	binary.Write(m.idHasher, binary.BigEndian, policy.Revision)

	m.policyRulesMergeContext.merge(&policy.PolicyRules)
	m.enterprisePolicyRulesMergeContext.merge(&policy.EnterprisePolicyRules)
}

// Policy outputs the merged policy
func (m *PolicyMerger) Policy() *Policy {
	merged := &Policy{
		ID: fmt.Sprintf("%x", m.idHasher.Sum(nil)),
	}

	m.policyRulesMergeContext.fill(&merged.PolicyRules)
	m.enterprisePolicyRulesMergeContext.fill(&merged.EnterprisePolicyRules)

	return merged
}

func MergePolicies(policies []*Policy) *Policy {
	var merger PolicyMerger
	merger.init()
	for _, p := range policies {
		merger.Merge(p)
	}

	return merger.Policy()
}