09cd01a5f3
This PR adds e2e tests for Consul Namespaces for Nomad Enterprise with Consul ACLs enabled. Needed to add support for Consul ACL tokens with `namespace` and `namespace_prefix` blocks, which Nomad parses and validates before tossing the token. These bits will need to be picked back to OSS.
309 lines
8.6 KiB
Go
309 lines
8.6 KiB
Go
package nomad
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/hashicorp/consul/api"
|
|
"github.com/hashicorp/hcl"
|
|
"github.com/pkg/errors"
|
|
)
|
|
|
|
const (
|
|
// consulGlobalManagementPolicyID is the built-in policy ID used by Consul
|
|
// to denote global-management tokens.
|
|
//
|
|
// https://www.consul.io/docs/security/acl/acl-system#builtin-policies
|
|
consulGlobalManagementPolicyID = "00000000-0000-0000-0000-000000000001"
|
|
)
|
|
|
|
// ConsulServiceRule represents a policy for a service.
|
|
type ConsulServiceRule struct {
|
|
Name string `hcl:",key"`
|
|
Policy string
|
|
}
|
|
|
|
// ConsulKeyRule represents a policy for the keystore.
|
|
type ConsulKeyRule struct {
|
|
Name string `hcl:",key"`
|
|
Policy string
|
|
}
|
|
|
|
// ConsulPolicy represents the parts of a ConsulServiceRule Policy that are
|
|
// relevant to Service Identity authorizations.
|
|
type ConsulPolicy struct {
|
|
Services []*ConsulServiceRule `hcl:"service,expand"`
|
|
ServicePrefixes []*ConsulServiceRule `hcl:"service_prefix,expand"`
|
|
KeyPrefixes []*ConsulKeyRule `hcl:"key_prefix,expand"`
|
|
Namespaces map[string]*ConsulPolicy `hcl:"namespace,expand"`
|
|
NamespacePrefixes map[string]*ConsulPolicy `hcl:"namespace_prefix,expand"`
|
|
}
|
|
|
|
// parseConsulPolicy parses raw string s into a ConsulPolicy. An error is
|
|
// returned if decoding the policy fails, or if the decoded policy has no
|
|
// Services or ServicePrefixes defined.
|
|
func parseConsulPolicy(s string) (*ConsulPolicy, error) {
|
|
cp := new(ConsulPolicy)
|
|
if err := hcl.Decode(cp, s); err != nil {
|
|
return nil, errors.Wrap(err, "failed to parse ACL policy")
|
|
}
|
|
return cp, nil
|
|
}
|
|
|
|
// isManagementToken returns true if the Consul token is backed by the
|
|
// built-in global-management policy. Such a token has complete, unrestricted
|
|
// access to all of Consul.
|
|
//
|
|
// https://www.consul.io/docs/security/acl/acl-system#builtin-policies
|
|
func (c *consulACLsAPI) isManagementToken(token *api.ACLToken) bool {
|
|
if token == nil {
|
|
return false
|
|
}
|
|
|
|
for _, policy := range token.Policies {
|
|
if policy.ID == consulGlobalManagementPolicyID {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// namespaceCheck is used to verify the namespace of the object matches the
|
|
// namespace of the ACL token provided.
|
|
//
|
|
// exception: iff token is in the default namespace, it may contain policies
|
|
// that extend into other namespaces using namespace_prefix, which must bypass
|
|
// this early check and validate in the service/keystore helpers
|
|
func namespaceCheck(namespace string, token *api.ACLToken) error {
|
|
if token.Namespace != "default" && token.Namespace != namespace {
|
|
return errors.Errorf("consul ACL token cannot use namespace %q", namespace)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (c *consulACLsAPI) canReadKeystore(namespace string, token *api.ACLToken) (bool, error) {
|
|
// early check the token is compatible with desired namespace
|
|
if err := namespaceCheck(namespace, token); err != nil {
|
|
return false, nil
|
|
}
|
|
|
|
// determines whether a top-level ACL policy will be applicable
|
|
matches := namespace == token.Namespace
|
|
|
|
// check each policy directly attached to the token
|
|
for _, policyRef := range token.Policies {
|
|
if allowable, err := c.policyAllowsKeystoreRead(matches, namespace, policyRef.ID); err != nil {
|
|
return false, err
|
|
} else if allowable {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
// check each policy on each role attached to the token
|
|
for _, roleLink := range token.Roles {
|
|
role, _, err := c.aclClient.RoleRead(roleLink.ID, &api.QueryOptions{
|
|
AllowStale: false,
|
|
})
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
for _, policyLink := range role.Policies {
|
|
allowable, err := c.policyAllowsKeystoreRead(matches, namespace, policyLink.ID)
|
|
if err != nil {
|
|
return false, err
|
|
} else if allowable {
|
|
return true, nil
|
|
}
|
|
}
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
func (c *consulACLsAPI) canWriteService(namespace, service string, token *api.ACLToken) (bool, error) {
|
|
// early check the token is compatible with desired namespace
|
|
if err := namespaceCheck(namespace, token); err != nil {
|
|
return false, nil
|
|
}
|
|
|
|
// determines whether a top-level ACL policy will be applicable
|
|
matches := namespace == token.Namespace
|
|
|
|
// check each policy directly attached to the token
|
|
for _, policyRef := range token.Policies {
|
|
if allowable, err := c.policyAllowsServiceWrite(matches, namespace, service, policyRef.ID); err != nil {
|
|
return false, err
|
|
} else if allowable {
|
|
return true, nil
|
|
}
|
|
}
|
|
|
|
// check each policy on each role attached to the token
|
|
for _, roleLink := range token.Roles {
|
|
role, _, err := c.aclClient.RoleRead(roleLink.ID, &api.QueryOptions{
|
|
AllowStale: false,
|
|
})
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
for _, policyLink := range role.Policies {
|
|
allowable, wErr := c.policyAllowsServiceWrite(matches, namespace, service, policyLink.ID)
|
|
if wErr != nil {
|
|
return false, wErr
|
|
} else if allowable {
|
|
return true, nil
|
|
}
|
|
}
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
func (c *consulACLsAPI) policyAllowsServiceWrite(matches bool, namespace, service string, policyID string) (bool, error) {
|
|
policy, _, err := c.aclClient.PolicyRead(policyID, &api.QueryOptions{
|
|
AllowStale: false,
|
|
})
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
// compare policy to the necessary permission for service write
|
|
// e.g. service "db" { policy = "write" }
|
|
// e.g. service_prefix "" { policy == "write" }
|
|
cp, err := parseConsulPolicy(policy.Rules)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if cp.allowsServiceWrite(matches, namespace, service) {
|
|
return true, nil
|
|
}
|
|
return false, nil
|
|
}
|
|
|
|
const (
|
|
serviceNameWildcard = "*"
|
|
)
|
|
|
|
func (cp *ConsulPolicy) allowsServiceWrite(matches bool, namespace, task string) bool {
|
|
canWriteService := func(services []*ConsulServiceRule) bool {
|
|
for _, service := range services {
|
|
name := strings.ToLower(service.Name)
|
|
policy := strings.ToLower(service.Policy)
|
|
if policy == ConsulPolicyWrite {
|
|
if name == task || name == serviceNameWildcard {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
canWriteServicePrefix := func(services []*ConsulServiceRule) bool {
|
|
for _, servicePrefix := range services {
|
|
prefix := strings.ToLower(servicePrefix.Name)
|
|
policy := strings.ToLower(servicePrefix.Policy)
|
|
if policy == ConsulPolicyWrite {
|
|
if strings.HasPrefix(task, prefix) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
if matches {
|
|
// check the top-level service/service_prefix rules
|
|
if canWriteService(cp.Services) || canWriteServicePrefix(cp.ServicePrefixes) {
|
|
return true
|
|
}
|
|
}
|
|
|
|
// for each namespace rule, if that namespace and the desired namespace
|
|
// are a match, we can then check the service/service_prefix policy rules
|
|
for ns, policy := range cp.Namespaces {
|
|
if ns == namespace {
|
|
if canWriteService(policy.Services) || canWriteServicePrefix(policy.ServicePrefixes) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
|
|
// for each namespace_prefix rule, see if that namespace_prefix applies
|
|
// to this namespace, and if yes, also check those service/service_prefix
|
|
// policy rules
|
|
for prefix, policy := range cp.NamespacePrefixes {
|
|
if strings.HasPrefix(namespace, prefix) {
|
|
if canWriteService(policy.Services) || canWriteServicePrefix(policy.ServicePrefixes) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|
|
|
|
func (c *consulACLsAPI) policyAllowsKeystoreRead(matches bool, namespace, policyID string) (bool, error) {
|
|
policy, _, err := c.aclClient.PolicyRead(policyID, &api.QueryOptions{
|
|
AllowStale: false,
|
|
})
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
cp, err := parseConsulPolicy(policy.Rules)
|
|
if err != nil {
|
|
return false, err
|
|
}
|
|
|
|
if cp.allowsKeystoreRead(matches, namespace) {
|
|
return true, nil
|
|
}
|
|
|
|
return false, nil
|
|
}
|
|
|
|
func (cp *ConsulPolicy) allowsKeystoreRead(matches bool, namespace string) bool {
|
|
canReadKeystore := func(prefixes []*ConsulKeyRule) bool {
|
|
for _, keyPrefix := range prefixes {
|
|
name := strings.ToLower(keyPrefix.Name)
|
|
policy := strings.ToLower(keyPrefix.Policy)
|
|
if name == "" {
|
|
if policy == ConsulPolicyWrite || policy == ConsulPolicyRead {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// check the top-level key_prefix rules, but only if the desired namespace
|
|
// matches the namespace of the consul acl token
|
|
if matches && canReadKeystore(cp.KeyPrefixes) {
|
|
return true
|
|
}
|
|
|
|
// for each namespace rule, if that namespace matches the desired namespace
|
|
// we chan then check the keystore policy
|
|
for ns, policy := range cp.Namespaces {
|
|
if ns == namespace {
|
|
if canReadKeystore(policy.KeyPrefixes) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
|
|
// for each namespace_prefix rule, see if that namespace_prefix applies to
|
|
// this namespace, and if yes, also check those key_prefix policy rules
|
|
for prefix, policy := range cp.NamespacePrefixes {
|
|
if strings.HasPrefix(namespace, prefix) {
|
|
if canReadKeystore(policy.KeyPrefixes) {
|
|
return true
|
|
}
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|