open-consul/acl/acl_test.go

package acl

import (
	"testing"
)

func TestRootACL(t *testing.T) {
	if RootACL("allow") != AllowAll() {
		t.Fatalf("Bad root")
	}
	if RootACL("deny") != DenyAll() {
		t.Fatalf("Bad root")
	}
	if RootACL("manage") != ManageAll() {
		t.Fatalf("Bad root")
	}
	if RootACL("foo") != nil {
		t.Fatalf("bad root")
	}
}

func TestStaticACL(t *testing.T) {
	all := AllowAll()
	if _, ok := all.(*StaticACL); !ok {
		t.Fatalf("expected static")
	}

	none := DenyAll()
	if _, ok := none.(*StaticACL); !ok {
		t.Fatalf("expected static")
	}

	manage := ManageAll()
	if _, ok := manage.(*StaticACL); !ok {
		t.Fatalf("expected static")
	}

	if all.ACLList() {
		t.Fatalf("should not allow")
	}
	if all.ACLModify() {
		t.Fatalf("should not allow")
	}
	if !all.AgentRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.AgentWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !all.EventRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.EventWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !all.IntentionDefaultAllow() {
		t.Fatalf("should allow")
	}
	if !all.IntentionWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !all.KeyRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.KeyWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !all.KeyringRead() {
		t.Fatalf("should allow")
	}
	if !all.KeyringWrite() {
		t.Fatalf("should allow")
	}
	if !all.NodeRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.NodeWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !all.OperatorRead() {
		t.Fatalf("should allow")
	}
	if !all.OperatorWrite() {
		t.Fatalf("should allow")
	}
	if !all.PreparedQueryRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.PreparedQueryWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !all.ServiceRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.ServiceWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !all.SessionRead("foobar") {
		t.Fatalf("should allow")
	}
	if !all.SessionWrite("foobar") {
		t.Fatalf("should allow")
	}
	if all.Snapshot() {
		t.Fatalf("should not allow")
	}

	if none.ACLList() {
		t.Fatalf("should not allow")
	}
	if none.ACLModify() {
		t.Fatalf("should not allow")
	}
	if none.AgentRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.AgentWrite("foobar") {
		t.Fatalf("should not allow")
	}
	if none.EventRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.EventRead("") {
		t.Fatalf("should not allow")
	}
	if none.EventWrite("foobar") {
		t.Fatalf("should not allow")
	}
	if none.EventWrite("") {
		t.Fatalf("should not allow")
	}
	if none.IntentionDefaultAllow() {
		t.Fatalf("should not allow")
	}
	if none.IntentionWrite("foo") {
		t.Fatalf("should not allow")
	}
	if none.KeyRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.KeyWrite("foobar", nil) {
		t.Fatalf("should not allow")
	}
	if none.KeyringRead() {
		t.Fatalf("should now allow")
	}
	if none.KeyringWrite() {
		t.Fatalf("should not allow")
	}
	if none.NodeRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.NodeWrite("foobar", nil) {
		t.Fatalf("should not allow")
	}
	if none.OperatorRead() {
		t.Fatalf("should now allow")
	}
	if none.OperatorWrite() {
		t.Fatalf("should not allow")
	}
	if none.PreparedQueryRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.PreparedQueryWrite("foobar") {
		t.Fatalf("should not allow")
	}
	if none.ServiceRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.ServiceWrite("foobar", nil) {
		t.Fatalf("should not allow")
	}
	if none.SessionRead("foobar") {
		t.Fatalf("should not allow")
	}
	if none.SessionWrite("foobar") {
		t.Fatalf("should not allow")
	}
	if none.Snapshot() {
		t.Fatalf("should not allow")
	}

	if !manage.ACLList() {
		t.Fatalf("should allow")
	}
	if !manage.ACLModify() {
		t.Fatalf("should allow")
	}
	if !manage.AgentRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.AgentWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.EventRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.EventWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.IntentionDefaultAllow() {
		t.Fatalf("should allow")
	}
	if !manage.IntentionWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.KeyRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.KeyWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !manage.KeyringRead() {
		t.Fatalf("should allow")
	}
	if !manage.KeyringWrite() {
		t.Fatalf("should allow")
	}
	if !manage.NodeRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.NodeWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !manage.OperatorRead() {
		t.Fatalf("should allow")
	}
	if !manage.OperatorWrite() {
		t.Fatalf("should allow")
	}
	if !manage.PreparedQueryRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.PreparedQueryWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.ServiceRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.ServiceWrite("foobar", nil) {
		t.Fatalf("should allow")
	}
	if !manage.SessionRead("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.SessionWrite("foobar") {
		t.Fatalf("should allow")
	}
	if !manage.Snapshot() {
		t.Fatalf("should allow")
	}
}

func TestPolicyACL(t *testing.T) {
	all := AllowAll()
	policy := &Policy{
		Events: []*EventPolicy{
			&EventPolicy{
				Event:  "",
				Policy: PolicyRead,
			},
			&EventPolicy{
				Event:  "foo",
				Policy: PolicyWrite,
			},
			&EventPolicy{
				Event:  "bar",
				Policy: PolicyDeny,
			},
		},
		Keys: []*KeyPolicy{
			&KeyPolicy{
				Prefix: "foo/",
				Policy: PolicyWrite,
			},
			&KeyPolicy{
				Prefix: "foo/priv/",
				Policy: PolicyDeny,
			},
			&KeyPolicy{
				Prefix: "bar/",
				Policy: PolicyDeny,
			},
			&KeyPolicy{
				Prefix: "zip/",
				Policy: PolicyRead,
			},
			&KeyPolicy{
				Prefix: "zap/",
				Policy: PolicyList,
			},
		},
		PreparedQueries: []*PreparedQueryPolicy{
			&PreparedQueryPolicy{
				Prefix: "",
				Policy: PolicyRead,
			},
			&PreparedQueryPolicy{
				Prefix: "foo",
				Policy: PolicyWrite,
			},
			&PreparedQueryPolicy{
				Prefix: "bar",
				Policy: PolicyDeny,
			},
			&PreparedQueryPolicy{
				Prefix: "zoo",
				Policy: PolicyWrite,
			},
		},
		Services: []*ServicePolicy{
			&ServicePolicy{
				Name:   "",
				Policy: PolicyWrite,
			},
			&ServicePolicy{
				Name:   "foo",
				Policy: PolicyRead,
			},
			&ServicePolicy{
				Name:   "bar",
				Policy: PolicyDeny,
			},
			&ServicePolicy{
				Name:       "barfoo",
				Policy:     PolicyWrite,
				Intentions: PolicyWrite,
			},
			&ServicePolicy{
				Name:       "intbaz",
				Policy:     PolicyWrite,
				Intentions: PolicyDeny,
			},
		},
	}
	acl, err := New(all, policy, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	type keycase struct {
		inp         string
		read        bool
		write       bool
		writePrefix bool
		list        bool
	}
	cases := []keycase{
		{"other", true, true, true, true},
		{"foo/test", true, true, true, true},
		{"foo/priv/test", false, false, false, false},
		{"bar/any", false, false, false, false},
		{"zip/test", true, false, false, false},
		{"foo/", true, true, false, true},
		{"", true, true, false, true},
		{"zap/test", true, false, false, true},
	}
	for _, c := range cases {
		if c.read != acl.KeyRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.KeyWrite(c.inp, nil) {
			t.Fatalf("Write fail: %#v", c)
		}
		if c.writePrefix != acl.KeyWritePrefix(c.inp) {
			t.Fatalf("Write prefix fail: %#v", c)
		}
	}

	// Test the intentions
	type intentioncase struct {
		inp   string
		read  bool
		write bool
	}
	icases := []intentioncase{
		{"other", true, false},
		{"foo", true, false},
		{"bar", false, false},
		{"foobar", true, false},
		{"barfo", false, false},
		{"barfoo", true, true},
		{"barfoo2", true, true},
		{"intbaz", false, false},
	}
	for _, c := range icases {
		if c.read != acl.IntentionRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.IntentionWrite(c.inp) {
			t.Fatalf("Write fail: %#v", c)
		}
	}

	// Test the services
	type servicecase struct {
		inp   string
		read  bool
		write bool
	}
	scases := []servicecase{
		{"other", true, true},
		{"foo", true, false},
		{"bar", false, false},
		{"foobar", true, false},
		{"barfo", false, false},
		{"barfoo", true, true},
		{"barfoo2", true, true},
	}
	for _, c := range scases {
		if c.read != acl.ServiceRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.ServiceWrite(c.inp, nil) {
			t.Fatalf("Write fail: %#v", c)
		}
	}

	// Test the events
	type eventcase struct {
		inp   string
		read  bool
		write bool
	}
	eventcases := []eventcase{
		{"foo", true, true},
		{"foobar", true, true},
		{"bar", false, false},
		{"barbaz", false, false},
		{"baz", true, false},
	}
	for _, c := range eventcases {
		if c.read != acl.EventRead(c.inp) {
			t.Fatalf("Event fail: %#v", c)
		}
		if c.write != acl.EventWrite(c.inp) {
			t.Fatalf("Event fail: %#v", c)
		}
	}

	// Test prepared queries
	type querycase struct {
		inp   string
		read  bool
		write bool
	}
	querycases := []querycase{
		{"foo", true, true},
		{"foobar", true, true},
		{"bar", false, false},
		{"barbaz", false, false},
		{"baz", true, false},
		{"nope", true, false},
		{"zoo", true, true},
		{"zookeeper", true, true},
	}
	for _, c := range querycases {
		if c.read != acl.PreparedQueryRead(c.inp) {
			t.Fatalf("Prepared query fail: %#v", c)
		}
		if c.write != acl.PreparedQueryWrite(c.inp) {
			t.Fatalf("Prepared query fail: %#v", c)
		}
	}

	// Check default intentions bubble up
	if !acl.IntentionDefaultAllow() {
		t.Fatal("should allow")
	}
}

func TestPolicyACL_Parent(t *testing.T) {
	deny := DenyAll()
	policyRoot := &Policy{
		Keys: []*KeyPolicy{
			&KeyPolicy{
				Prefix: "foo/",
				Policy: PolicyWrite,
			},
			&KeyPolicy{
				Prefix: "bar/",
				Policy: PolicyRead,
			},
		},
		PreparedQueries: []*PreparedQueryPolicy{
			&PreparedQueryPolicy{
				Prefix: "other",
				Policy: PolicyWrite,
			},
			&PreparedQueryPolicy{
				Prefix: "foo",
				Policy: PolicyRead,
			},
		},
		Services: []*ServicePolicy{
			&ServicePolicy{
				Name:   "other",
				Policy: PolicyWrite,
			},
			&ServicePolicy{
				Name:   "foo",
				Policy: PolicyRead,
			},
		},
	}
	root, err := New(deny, policyRoot, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	policy := &Policy{
		Keys: []*KeyPolicy{
			&KeyPolicy{
				Prefix: "foo/priv/",
				Policy: PolicyRead,
			},
			&KeyPolicy{
				Prefix: "bar/",
				Policy: PolicyDeny,
			},
			&KeyPolicy{
				Prefix: "zip/",
				Policy: PolicyRead,
			},
		},
		PreparedQueries: []*PreparedQueryPolicy{
			&PreparedQueryPolicy{
				Prefix: "bar",
				Policy: PolicyDeny,
			},
		},
		Services: []*ServicePolicy{
			&ServicePolicy{
				Name:   "bar",
				Policy: PolicyDeny,
			},
		},
	}
	acl, err := New(root, policy, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	type keycase struct {
		inp         string
		read        bool
		write       bool
		writePrefix bool
	}
	cases := []keycase{
		{"other", false, false, false},
		{"foo/test", true, true, true},
		{"foo/priv/test", true, false, false},
		{"bar/any", false, false, false},
		{"zip/test", true, false, false},
	}
	for _, c := range cases {
		if c.read != acl.KeyRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.KeyWrite(c.inp, nil) {
			t.Fatalf("Write fail: %#v", c)
		}
		if c.writePrefix != acl.KeyWritePrefix(c.inp) {
			t.Fatalf("Write prefix fail: %#v", c)
		}
	}

	// Test the services
	type servicecase struct {
		inp   string
		read  bool
		write bool
	}
	scases := []servicecase{
		{"fail", false, false},
		{"other", true, true},
		{"foo", true, false},
		{"bar", false, false},
	}
	for _, c := range scases {
		if c.read != acl.ServiceRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.ServiceWrite(c.inp, nil) {
			t.Fatalf("Write fail: %#v", c)
		}
	}

	// Test prepared queries
	type querycase struct {
		inp   string
		read  bool
		write bool
	}
	querycases := []querycase{
		{"foo", true, false},
		{"foobar", true, false},
		{"bar", false, false},
		{"barbaz", false, false},
		{"baz", false, false},
		{"nope", false, false},
	}
	for _, c := range querycases {
		if c.read != acl.PreparedQueryRead(c.inp) {
			t.Fatalf("Prepared query fail: %#v", c)
		}
		if c.write != acl.PreparedQueryWrite(c.inp) {
			t.Fatalf("Prepared query fail: %#v", c)
		}
	}

	// Check some management functions that chain up
	if acl.ACLList() {
		t.Fatalf("should not allow")
	}
	if acl.ACLModify() {
		t.Fatalf("should not allow")
	}
	if acl.Snapshot() {
		t.Fatalf("should not allow")
	}

	// Check default intentions
	if acl.IntentionDefaultAllow() {
		t.Fatal("should not allow")
	}
}

func TestPolicyACL_Agent(t *testing.T) {
	deny := DenyAll()
	policyRoot := &Policy{
		Agents: []*AgentPolicy{
			&AgentPolicy{
				Node:   "root-nope",
				Policy: PolicyDeny,
			},
			&AgentPolicy{
				Node:   "root-ro",
				Policy: PolicyRead,
			},
			&AgentPolicy{
				Node:   "root-rw",
				Policy: PolicyWrite,
			},
			&AgentPolicy{
				Node:   "override",
				Policy: PolicyDeny,
			},
		},
	}
	root, err := New(deny, policyRoot, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	policy := &Policy{
		Agents: []*AgentPolicy{
			&AgentPolicy{
				Node:   "child-nope",
				Policy: PolicyDeny,
			},
			&AgentPolicy{
				Node:   "child-ro",
				Policy: PolicyRead,
			},
			&AgentPolicy{
				Node:   "child-rw",
				Policy: PolicyWrite,
			},
			&AgentPolicy{
				Node:   "override",
				Policy: PolicyWrite,
			},
		},
	}
	acl, err := New(root, policy, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	type agentcase struct {
		inp   string
		read  bool
		write bool
	}
	cases := []agentcase{
		{"nope", false, false},
		{"root-nope", false, false},
		{"root-ro", true, false},
		{"root-rw", true, true},
		{"root-nope-prefix", false, false},
		{"root-ro-prefix", true, false},
		{"root-rw-prefix", true, true},
		{"child-nope", false, false},
		{"child-ro", true, false},
		{"child-rw", true, true},
		{"child-nope-prefix", false, false},
		{"child-ro-prefix", true, false},
		{"child-rw-prefix", true, true},
		{"override", true, true},
	}
	for _, c := range cases {
		if c.read != acl.AgentRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.AgentWrite(c.inp) {
			t.Fatalf("Write fail: %#v", c)
		}
	}
}

func TestPolicyACL_Keyring(t *testing.T) {
	type keyringcase struct {
		inp   string
		read  bool
		write bool
	}
	cases := []keyringcase{
		{"", false, false},
		{PolicyRead, true, false},
		{PolicyWrite, true, true},
		{PolicyDeny, false, false},
	}
	for _, c := range cases {
		acl, err := New(DenyAll(), &Policy{Keyring: c.inp}, nil)
		if err != nil {
			t.Fatalf("bad: %s", err)
		}
		if acl.KeyringRead() != c.read {
			t.Fatalf("bad: %#v", c)
		}
		if acl.KeyringWrite() != c.write {
			t.Fatalf("bad: %#v", c)
		}
	}
}

func TestPolicyACL_Operator(t *testing.T) {
	type operatorcase struct {
		inp   string
		read  bool
		write bool
	}
	cases := []operatorcase{
		{"", false, false},
		{PolicyRead, true, false},
		{PolicyWrite, true, true},
		{PolicyDeny, false, false},
	}
	for _, c := range cases {
		acl, err := New(DenyAll(), &Policy{Operator: c.inp}, nil)
		if err != nil {
			t.Fatalf("bad: %s", err)
		}
		if acl.OperatorRead() != c.read {
			t.Fatalf("bad: %#v", c)
		}
		if acl.OperatorWrite() != c.write {
			t.Fatalf("bad: %#v", c)
		}
	}
}

func TestPolicyACL_Node(t *testing.T) {
	deny := DenyAll()
	policyRoot := &Policy{
		Nodes: []*NodePolicy{
			&NodePolicy{
				Name:   "root-nope",
				Policy: PolicyDeny,
			},
			&NodePolicy{
				Name:   "root-ro",
				Policy: PolicyRead,
			},
			&NodePolicy{
				Name:   "root-rw",
				Policy: PolicyWrite,
			},
			&NodePolicy{
				Name:   "override",
				Policy: PolicyDeny,
			},
		},
	}
	root, err := New(deny, policyRoot, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	policy := &Policy{
		Nodes: []*NodePolicy{
			&NodePolicy{
				Name:   "child-nope",
				Policy: PolicyDeny,
			},
			&NodePolicy{
				Name:   "child-ro",
				Policy: PolicyRead,
			},
			&NodePolicy{
				Name:   "child-rw",
				Policy: PolicyWrite,
			},
			&NodePolicy{
				Name:   "override",
				Policy: PolicyWrite,
			},
		},
	}
	acl, err := New(root, policy, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	type nodecase struct {
		inp   string
		read  bool
		write bool
	}
	cases := []nodecase{
		{"nope", false, false},
		{"root-nope", false, false},
		{"root-ro", true, false},
		{"root-rw", true, true},
		{"root-nope-prefix", false, false},
		{"root-ro-prefix", true, false},
		{"root-rw-prefix", true, true},
		{"child-nope", false, false},
		{"child-ro", true, false},
		{"child-rw", true, true},
		{"child-nope-prefix", false, false},
		{"child-ro-prefix", true, false},
		{"child-rw-prefix", true, true},
		{"override", true, true},
	}
	for _, c := range cases {
		if c.read != acl.NodeRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.NodeWrite(c.inp, nil) {
			t.Fatalf("Write fail: %#v", c)
		}
	}
}

func TestPolicyACL_Session(t *testing.T) {
	deny := DenyAll()
	policyRoot := &Policy{
		Sessions: []*SessionPolicy{
			&SessionPolicy{
				Node:   "root-nope",
				Policy: PolicyDeny,
			},
			&SessionPolicy{
				Node:   "root-ro",
				Policy: PolicyRead,
			},
			&SessionPolicy{
				Node:   "root-rw",
				Policy: PolicyWrite,
			},
			&SessionPolicy{
				Node:   "override",
				Policy: PolicyDeny,
			},
		},
	}
	root, err := New(deny, policyRoot, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	policy := &Policy{
		Sessions: []*SessionPolicy{
			&SessionPolicy{
				Node:   "child-nope",
				Policy: PolicyDeny,
			},
			&SessionPolicy{
				Node:   "child-ro",
				Policy: PolicyRead,
			},
			&SessionPolicy{
				Node:   "child-rw",
				Policy: PolicyWrite,
			},
			&SessionPolicy{
				Node:   "override",
				Policy: PolicyWrite,
			},
		},
	}
	acl, err := New(root, policy, nil)
	if err != nil {
		t.Fatalf("err: %v", err)
	}

	type sessioncase struct {
		inp   string
		read  bool
		write bool
	}
	cases := []sessioncase{
		{"nope", false, false},
		{"root-nope", false, false},
		{"root-ro", true, false},
		{"root-rw", true, true},
		{"root-nope-prefix", false, false},
		{"root-ro-prefix", true, false},
		{"root-rw-prefix", true, true},
		{"child-nope", false, false},
		{"child-ro", true, false},
		{"child-rw", true, true},
		{"child-nope-prefix", false, false},
		{"child-ro-prefix", true, false},
		{"child-rw-prefix", true, true},
		{"override", true, true},
	}
	for _, c := range cases {
		if c.read != acl.SessionRead(c.inp) {
			t.Fatalf("Read fail: %#v", c)
		}
		if c.write != acl.SessionWrite(c.inp) {
			t.Fatalf("Write fail: %#v", c)
		}
	}
}