open-nomad/acl/policy.go

package acl

import (
	"fmt"

	"github.com/hashicorp/hcl"
)

const (
	PolicyDeny  = "deny"
	PolicyRead  = "read"
	PolicyWrite = "write"
)

const (
	NamespaceCapabilityDeny      = "deny"
	NamespaceCapabilityListJobs  = "list-jobs"
	NamespaceCapabilityReadJob   = "read-job"
	NamespaceCapabilitySubmitJob = "submit-job"
	NamespaceCapabilityReadLogs  = "read-logs"
	NamespaceCapabilityReadFS    = "read-fs"
)

// Policy represents a parsed HCL or JSON policy.
type Policy struct {
	Namespaces []*NamespacePolicy `hcl:"namespace,expand"`
	Agent      *AgentPolicy       `hcl:"agent"`
	Node       *NodePolicy        `hcl:"node"`
	Operator   *OperatorPolicy    `hcl:"operator"`
	Raw        string             `hcl:"-"`
}

// NamespacePolicy is the policy for a specific namespace
type NamespacePolicy struct {
	Name         string `hcl:",key"`
	Policy       string
	Capabilities []string
}

type AgentPolicy struct {
	Policy string
}

type NodePolicy struct {
	Policy string
}

type OperatorPolicy struct {
	Policy string
}

// isPolicyValid makes sure the given string matches one of the valid policies.
func isPolicyValid(policy string) bool {
	switch policy {
	case PolicyDeny:
		return true
	case PolicyRead:
		return true
	case PolicyWrite:
		return true
	default:
		return false
	}
}

// isNamespaceCapabilityValid ensures the given capability is valid for a namespace policy
func isNamespaceCapabilityValid(cap string) bool {
	switch cap {
	case NamespaceCapabilityDeny:
		return true
	case NamespaceCapabilityListJobs:
		return true
	case NamespaceCapabilityReadJob:
		return true
	case NamespaceCapabilitySubmitJob:
		return true
	case NamespaceCapabilityReadLogs:
		return true
	case NamespaceCapabilityReadFS:
		return true
	default:
		return false
	}
}

// expandNamespacePolicy provides the equivalent set of capabilities for
// a namespace policy
func expandNamespacePolicy(policy string) []string {
	switch policy {
	case PolicyDeny:
		return []string{NamespaceCapabilityDeny}
	case PolicyRead:
		return []string{
			NamespaceCapabilityListJobs,
			NamespaceCapabilityReadJob,
		}
	case PolicyWrite:
		return []string{
			NamespaceCapabilityListJobs,
			NamespaceCapabilityReadJob,
			NamespaceCapabilitySubmitJob,
			NamespaceCapabilityReadLogs,
			NamespaceCapabilityReadFS,
		}
	default:
		return nil
	}
}

// Parse is used to parse the specified ACL rules into an
// intermediary set of policies, before being compiled into
// the ACL
func Parse(rules string) (*Policy, error) {
	// Decode the rules
	p := &Policy{Raw: rules}
	if rules == "" {
		// Hot path for empty rules
		return p, nil
	}

	// Attempt to parse
	if err := hcl.Decode(p, rules); err != nil {
		return nil, fmt.Errorf("Failed to parse ACL Policy: %v", err)
	}

	// Validate the policy
	for _, ns := range p.Namespaces {
		if ns.Policy != "" && !isPolicyValid(ns.Policy) {
			return nil, fmt.Errorf("Invalid namespace policy: %#v", ns)
		}
		for _, cap := range ns.Capabilities {
			if !isNamespaceCapabilityValid(cap) {
				return nil, fmt.Errorf("Invalid namespace capability: %#v", ns)
			}
		}

		// Expand the short hand policy to the capabilities and
		// add to any existing capabilities
		if ns.Policy != "" {
			extraCap := expandNamespacePolicy(ns.Policy)
			ns.Capabilities = append(ns.Capabilities, extraCap...)
		}
	}

	if p.Agent != nil && !isPolicyValid(p.Agent.Policy) {
		return nil, fmt.Errorf("Invalid agent policy: %#v", p.Agent)
	}

	if p.Node != nil && !isPolicyValid(p.Node.Policy) {
		return nil, fmt.Errorf("Invalid node policy: %#v", p.Node)
	}

	if p.Operator != nil && !isPolicyValid(p.Operator.Policy) {
		return nil, fmt.Errorf("Invalid operator policy: %#v", p.Operator)
	}
	return p, nil
}