From c7ee82c67fe9c0d5fd0d5a6c1c2d4e2bfff07004 Mon Sep 17 00:00:00 2001 From: James Phillips Date: Wed, 2 Mar 2016 23:59:35 -0800 Subject: [PATCH] Applies prefix ACL to a catch-all template as a special case. --- consul/prepared_query_endpoint_test.go | 157 +++++++++++++++++++++++++ consul/structs/prepared_query.go | 2 +- consul/structs/prepared_query_test.go | 16 ++- 3 files changed, 172 insertions(+), 3 deletions(-) diff --git a/consul/prepared_query_endpoint_test.go b/consul/prepared_query_endpoint_test.go index 5f18c6d96b..d95680902f 100644 --- a/consul/prepared_query_endpoint_test.go +++ b/consul/prepared_query_endpoint_test.go @@ -579,6 +579,163 @@ func TestPreparedQuery_parseQuery(t *testing.T) { } } +func TestPreparedQuery_ACLDeny_Template(t *testing.T) { + dir1, s1 := testServerWithConfig(t, func(c *Config) { + c.ACLDatacenter = "dc1" + c.ACLMasterToken = "root" + c.ACLDefaultPolicy = "deny" + }) + defer os.RemoveAll(dir1) + defer s1.Shutdown() + codec := rpcClient(t, s1) + defer codec.Close() + + testutil.WaitForLeader(t, s1.RPC, "dc1") + + // Create an ACL with write permissions for any prefix. + var token string + { + var rules = ` + query "" { + policy = "write" + } + ` + + req := structs.ACLRequest{ + Datacenter: "dc1", + Op: structs.ACLSet, + ACL: structs.ACL{ + Name: "User token", + Type: structs.ACLTypeClient, + Rules: rules, + }, + WriteRequest: structs.WriteRequest{Token: "root"}, + } + if err := msgpackrpc.CallWithCodec(codec, "ACL.Apply", &req, &token); err != nil { + t.Fatalf("err: %v", err) + } + } + + // Set up a catch-all template. + query := structs.PreparedQueryRequest{ + Datacenter: "dc1", + Op: structs.PreparedQueryCreate, + Query: &structs.PreparedQuery{ + Name: "", + Token: "5e1e24e5-1329-f86f-18c6-3d3734edb2cd", + Template: structs.QueryTemplateOptions{ + Type: structs.QueryTemplateTypeNamePrefixMatch, + }, + Service: structs.ServiceQuery{ + Service: "${name.full}", + }, + }, + } + var reply string + + // Creating without a token should fail since the default policy is to + // deny. + err := msgpackrpc.CallWithCodec(codec, "PreparedQuery.Apply", &query, &reply) + if err == nil || !strings.Contains(err.Error(), permissionDenied) { + t.Fatalf("bad: %v", err) + } + + // Now add the token and try again. + query.WriteRequest.Token = token + if err = msgpackrpc.CallWithCodec(codec, "PreparedQuery.Apply", &query, &reply); err != nil { + t.Fatalf("err: %v", err) + } + + // Capture the ID and read back the query to verify. Note that the token + // will be redacted since this isn't a management token. + query.Query.ID = reply + query.Query.Token = redactedToken + { + req := &structs.PreparedQuerySpecificRequest{ + Datacenter: "dc1", + QueryID: query.Query.ID, + QueryOptions: structs.QueryOptions{Token: token}, + } + var resp structs.IndexedPreparedQueries + if err = msgpackrpc.CallWithCodec(codec, "PreparedQuery.Get", req, &resp); err != nil { + t.Fatalf("err: %v", err) + } + + if len(resp.Queries) != 1 { + t.Fatalf("bad: %v", resp) + } + actual := resp.Queries[0] + if resp.Index != actual.ModifyIndex { + t.Fatalf("bad index: %d", resp.Index) + } + actual.CreateIndex, actual.ModifyIndex = 0, 0 + if !reflect.DeepEqual(actual, query.Query) { + t.Fatalf("bad: %v", actual) + } + } + + // Try to query by ID without a token and make sure it gets denied, even + // though this has an empty name and would normally be shown. + { + req := &structs.PreparedQuerySpecificRequest{ + Datacenter: "dc1", + QueryID: query.Query.ID, + } + + var resp structs.IndexedPreparedQueries + err := msgpackrpc.CallWithCodec(codec, "PreparedQuery.Get", req, &resp) + if err == nil || !strings.Contains(err.Error(), permissionDenied) { + t.Fatalf("bad: %v", err) + } + + if len(resp.Queries) != 0 { + t.Fatalf("bad: %v", resp) + } + } + + // We should get the same result listing all the queries without a + // token. + { + req := &structs.DCSpecificRequest{ + Datacenter: "dc1", + } + var resp structs.IndexedPreparedQueries + if err = msgpackrpc.CallWithCodec(codec, "PreparedQuery.List", req, &resp); err != nil { + t.Fatalf("err: %v", err) + } + + if len(resp.Queries) != 0 { + t.Fatalf("bad: %v", resp) + } + } + + // But a management token should be able to see it, and the real token. + query.Query.Token = "5e1e24e5-1329-f86f-18c6-3d3734edb2cd" + { + req := &structs.PreparedQuerySpecificRequest{ + Datacenter: "dc1", + QueryID: query.Query.ID, + QueryOptions: structs.QueryOptions{Token: "root"}, + } + var resp structs.IndexedPreparedQueries + if err = msgpackrpc.CallWithCodec(codec, "PreparedQuery.Get", req, &resp); err != nil { + t.Fatalf("err: %v", err) + } + + if len(resp.Queries) != 1 { + t.Fatalf("bad: %v", resp) + } + actual := resp.Queries[0] + if resp.Index != actual.ModifyIndex { + t.Fatalf("bad index: %d", resp.Index) + } + actual.CreateIndex, actual.ModifyIndex = 0, 0 + if !reflect.DeepEqual(actual, query.Query) { + t.Fatalf("bad: %v", actual) + } + } +} + func TestPreparedQuery_Get(t *testing.T) { dir1, s1 := testServerWithConfig(t, func(c *Config) { c.ACLDatacenter = "dc1" diff --git a/consul/structs/prepared_query.go b/consul/structs/prepared_query.go index f83c04fcfe..0e95fc429e 100644 --- a/consul/structs/prepared_query.go +++ b/consul/structs/prepared_query.go @@ -100,7 +100,7 @@ type PreparedQuery struct { // this query, and whether the prefix applies to this query. You always need to // check the ok value before using the prefix. func (pq *PreparedQuery) GetACLPrefix() (string, bool) { - if pq.Name != "" { + if pq.Name != "" || pq.Template.Type != "" { return pq.Name, true } diff --git a/consul/structs/prepared_query_test.go b/consul/structs/prepared_query_test.go index b80fff8976..6a629874b4 100644 --- a/consul/structs/prepared_query_test.go +++ b/consul/structs/prepared_query_test.go @@ -10,8 +10,20 @@ func TestStructs_PreparedQuery_GetACLPrefix(t *testing.T) { t.Fatalf("bad: %s", prefix) } - named := &PreparedQuery{Name: "hello"} + named := &PreparedQuery{ + Name: "hello", + } if prefix, ok := named.GetACLPrefix(); !ok || prefix != "hello" { - t.Fatalf("bad: %#v", prefix) + t.Fatalf("bad: ok=%v, prefix=%#v", ok, prefix) + } + + tmpl := &PreparedQuery{ + Name: "", + Template: QueryTemplateOptions{ + Type: QueryTemplateTypeNamePrefixMatch, + }, + } + if prefix, ok := tmpl.GetACLPrefix(); !ok || prefix != "" { + t.Fatalf("bad: ok=%v prefix=%#v", ok, prefix) } }