Back to godoc.org

Package acl

v1.8.5
Latest Go to latest

The latest major version is .

Published: today | License: MPL-2.0 | Module: github.com/hashicorp/consul

Index

Constants

const (
	PolicyDeny  = "deny"
	PolicyRead  = "read"
	PolicyList  = "list"
	PolicyWrite = "write"
)
const (
	WildcardName = "*"
)

Variables

var (
	// ErrNotFound indicates there is no matching ACL.
	ErrNotFound = errors.New(errNotFound)

	// ErrRootDenied is returned when attempting to resolve a root ACL.
	ErrRootDenied = errors.New(errRootDenied)

	// ErrDisabled is returned when ACL changes are not permitted since
	// they are disabled.
	ErrDisabled = errors.New(errDisabled)

	// ErrPermissionDenied is returned when an ACL based rejection
	// happens.
	ErrPermissionDenied = PermissionDeniedError{}

	// ErrInvalidParent is returned when a remotely resolve ACL
	// token claims to have a non-root parent
	ErrInvalidParent = errors.New(errInvalidParent)
)

func IsErrDisabled

func IsErrDisabled(err error) bool

IsErrDisabled checks if the given error message is comparable to ErrDisabled.

func IsErrNotFound

func IsErrNotFound(err error) bool

IsErrNotFound checks if the given error message is comparable to ErrNotFound.

func IsErrPermissionDenied

func IsErrPermissionDenied(err error) bool

IsErrPermissionDenied checks if the given error message is comparable to ErrPermissionDenied.

func IsErrRootDenied

func IsErrRootDenied(err error) bool

IsErrRootDenied checks if the given error message is comparable to ErrRootDenied.

func TranslateLegacyRules

func TranslateLegacyRules(policyBytes []byte) ([]byte, error)

type AccessLevel

type AccessLevel int
const (
	AccessUnknown AccessLevel = iota
	AccessDeny
	AccessRead
	AccessList
	AccessWrite
)

func AccessLevelFromString

func AccessLevelFromString(level string) (AccessLevel, error)

func (AccessLevel) String

func (l AccessLevel) String() string

type AgentRule

type AgentRule struct {
	Node   string `hcl:",key"`
	Policy string
}

AgentRule represents a rule for working with agent endpoints on nodes with specific name prefixes.

type Authorizer

type Authorizer interface {
	// ACLRead checks for permission to list all the ACLs
	ACLRead(*AuthorizerContext) EnforcementDecision

	// ACLWrite checks for permission to manipulate ACLs
	ACLWrite(*AuthorizerContext) EnforcementDecision

	// AgentRead checks for permission to read from agent endpoints for a
	// given node.
	AgentRead(string, *AuthorizerContext) EnforcementDecision

	// AgentWrite checks for permission to make changes via agent endpoints
	// for a given node.
	AgentWrite(string, *AuthorizerContext) EnforcementDecision

	// EventRead determines if a specific event can be queried.
	EventRead(string, *AuthorizerContext) EnforcementDecision

	// EventWrite determines if a specific event may be fired.
	EventWrite(string, *AuthorizerContext) EnforcementDecision

	// IntentionDefaultAllow determines the default authorized behavior
	// when no intentions match a Connect request.
	IntentionDefaultAllow(*AuthorizerContext) EnforcementDecision

	// IntentionRead determines if a specific intention can be read.
	IntentionRead(string, *AuthorizerContext) EnforcementDecision

	// IntentionWrite determines if a specific intention can be
	// created, modified, or deleted.
	IntentionWrite(string, *AuthorizerContext) EnforcementDecision

	// KeyList checks for permission to list keys under a prefix
	KeyList(string, *AuthorizerContext) EnforcementDecision

	// KeyRead checks for permission to read a given key
	KeyRead(string, *AuthorizerContext) EnforcementDecision

	// KeyWrite checks for permission to write a given key
	KeyWrite(string, *AuthorizerContext) EnforcementDecision

	// KeyWritePrefix checks for permission to write to an
	// entire key prefix. This means there must be no sub-policies
	// that deny a write.
	KeyWritePrefix(string, *AuthorizerContext) EnforcementDecision

	// KeyringRead determines if the encryption keyring used in
	// the gossip layer can be read.
	KeyringRead(*AuthorizerContext) EnforcementDecision

	// KeyringWrite determines if the keyring can be manipulated
	KeyringWrite(*AuthorizerContext) EnforcementDecision

	// NodeRead checks for permission to read (discover) a given node.
	NodeRead(string, *AuthorizerContext) EnforcementDecision

	// NodeWrite checks for permission to create or update (register) a
	// given node.
	NodeWrite(string, *AuthorizerContext) EnforcementDecision

	// OperatorRead determines if the read-only Consul operator functions
	// can be used.
	OperatorRead(*AuthorizerContext) EnforcementDecision

	// OperatorWrite determines if the state-changing Consul operator
	// functions can be used.
	OperatorWrite(*AuthorizerContext) EnforcementDecision

	// PreparedQueryRead determines if a specific prepared query can be read
	// to show its contents (this is not used for execution).
	PreparedQueryRead(string, *AuthorizerContext) EnforcementDecision

	// PreparedQueryWrite determines if a specific prepared query can be
	// created, modified, or deleted.
	PreparedQueryWrite(string, *AuthorizerContext) EnforcementDecision

	// ServiceRead checks for permission to read a given service
	ServiceRead(string, *AuthorizerContext) EnforcementDecision

	// ServiceWrite checks for permission to create or update a given
	// service
	ServiceWrite(string, *AuthorizerContext) EnforcementDecision

	// SessionRead checks for permission to read sessions for a given node.
	SessionRead(string, *AuthorizerContext) EnforcementDecision

	// SessionWrite checks for permission to create sessions for a given
	// node.
	SessionWrite(string, *AuthorizerContext) EnforcementDecision

	// Snapshot checks for permission to take and restore snapshots.
	Snapshot(*AuthorizerContext) EnforcementDecision
	// contains filtered or unexported methods
}

Authorizer is the interface for policy enforcement.

func AllowAll

func AllowAll() Authorizer

AllowAll returns an Authorizer that allows all operations

func DenyAll

func DenyAll() Authorizer

DenyAll returns an Authorizer that denies all operations

func ManageAll

func ManageAll() Authorizer

ManageAll returns an Authorizer that can manage all resources

func NewAuthorizerFromRules

func NewAuthorizerFromRules(id string, revision uint64, rules string, syntax SyntaxVersion, conf *Config, meta *EnterprisePolicyMeta) (Authorizer, error)

NewAuthorizerFromRules is a convenience function to invoke NewPolicyFromSource followed by NewPolicyAuthorizer with the parse policy.

func NewPolicyAuthorizer

func NewPolicyAuthorizer(policies []*Policy, entConfig *Config) (Authorizer, error)

NewPolicyAuthorizer merges the policies and returns an Authorizer that will enforce them

func NewPolicyAuthorizerWithDefaults

func NewPolicyAuthorizerWithDefaults(defaultAuthz Authorizer, policies []*Policy, entConfig *Config) (Authorizer, error)

NewPolicyAuthorizerWithDefaults will actually created a ChainedAuthorizer with the policies compiled into one Authorizer and the backup policy of the defaultAuthz

func RootAuthorizer

func RootAuthorizer(id string) Authorizer

RootAuthorizer returns a possible Authorizer if the ID matches a root policy

type AuthorizerContext

type AuthorizerContext struct{}

AuthorizerContext stub

type ChainedAuthorizer

type ChainedAuthorizer struct {
	// contains filtered or unexported fields
}

ChainedAuthorizer can combine multiple Authorizers into one. Each Authorizer in the chain is asked (in order) for an enforcement decision. The first non-Default decision that is rendered by an Authorizer in the chain will be used as the overall decision of the ChainedAuthorizer

func NewChainedAuthorizer

func NewChainedAuthorizer(chain []Authorizer) *ChainedAuthorizer

NewChainedAuthorizer creates a ChainedAuthorizer with the provided chain of Authorizers. The slice provided should be in the order of most precedent Authorizer at the beginning and least precedent Authorizer at the end.

func (*ChainedAuthorizer) ACLRead

func (c *ChainedAuthorizer) ACLRead(entCtx *AuthorizerContext) EnforcementDecision

ACLRead checks for permission to list all the ACLs

func (*ChainedAuthorizer) ACLWrite

func (c *ChainedAuthorizer) ACLWrite(entCtx *AuthorizerContext) EnforcementDecision

ACLWrite checks for permission to manipulate ACLs

func (*ChainedAuthorizer) AgentRead

func (c *ChainedAuthorizer) AgentRead(node string, entCtx *AuthorizerContext) EnforcementDecision

AgentRead checks for permission to read from agent endpoints for a given node.

func (*ChainedAuthorizer) AgentWrite

func (c *ChainedAuthorizer) AgentWrite(node string, entCtx *AuthorizerContext) EnforcementDecision

AgentWrite checks for permission to make changes via agent endpoints for a given node.

func (*ChainedAuthorizer) AuthorizerChain

func (c *ChainedAuthorizer) AuthorizerChain() []Authorizer

func (*ChainedAuthorizer) EventRead

func (c *ChainedAuthorizer) EventRead(name string, entCtx *AuthorizerContext) EnforcementDecision

EventRead determines if a specific event can be queried.

func (*ChainedAuthorizer) EventWrite

func (c *ChainedAuthorizer) EventWrite(name string, entCtx *AuthorizerContext) EnforcementDecision

EventWrite determines if a specific event may be fired.

func (*ChainedAuthorizer) IntentionDefaultAllow

func (c *ChainedAuthorizer) IntentionDefaultAllow(entCtx *AuthorizerContext) EnforcementDecision

IntentionDefaultAllow determines the default authorized behavior when no intentions match a Connect request.

func (*ChainedAuthorizer) IntentionRead

func (c *ChainedAuthorizer) IntentionRead(prefix string, entCtx *AuthorizerContext) EnforcementDecision

IntentionRead determines if a specific intention can be read.

func (*ChainedAuthorizer) IntentionWrite

func (c *ChainedAuthorizer) IntentionWrite(prefix string, entCtx *AuthorizerContext) EnforcementDecision

IntentionWrite determines if a specific intention can be created, modified, or deleted.

func (*ChainedAuthorizer) KeyList

func (c *ChainedAuthorizer) KeyList(keyPrefix string, entCtx *AuthorizerContext) EnforcementDecision

KeyList checks for permission to list keys under a prefix

func (*ChainedAuthorizer) KeyRead

func (c *ChainedAuthorizer) KeyRead(key string, entCtx *AuthorizerContext) EnforcementDecision

KeyRead checks for permission to read a given key

func (*ChainedAuthorizer) KeyWrite

func (c *ChainedAuthorizer) KeyWrite(key string, entCtx *AuthorizerContext) EnforcementDecision

KeyWrite checks for permission to write a given key

func (*ChainedAuthorizer) KeyWritePrefix

func (c *ChainedAuthorizer) KeyWritePrefix(keyPrefix string, entCtx *AuthorizerContext) EnforcementDecision

KeyWritePrefix checks for permission to write to an entire key prefix. This means there must be no sub-policies that deny a write.

func (*ChainedAuthorizer) KeyringRead

func (c *ChainedAuthorizer) KeyringRead(entCtx *AuthorizerContext) EnforcementDecision

KeyringRead determines if the encryption keyring used in the gossip layer can be read.

func (*ChainedAuthorizer) KeyringWrite

func (c *ChainedAuthorizer) KeyringWrite(entCtx *AuthorizerContext) EnforcementDecision

KeyringWrite determines if the keyring can be manipulated

func (*ChainedAuthorizer) NodeRead

func (c *ChainedAuthorizer) NodeRead(node string, entCtx *AuthorizerContext) EnforcementDecision

NodeRead checks for permission to read (discover) a given node.

func (*ChainedAuthorizer) NodeWrite

func (c *ChainedAuthorizer) NodeWrite(node string, entCtx *AuthorizerContext) EnforcementDecision

NodeWrite checks for permission to create or update (register) a given node.

func (*ChainedAuthorizer) OperatorRead

func (c *ChainedAuthorizer) OperatorRead(entCtx *AuthorizerContext) EnforcementDecision

OperatorRead determines if the read-only Consul operator functions can be used.

func (*ChainedAuthorizer) OperatorWrite

func (c *ChainedAuthorizer) OperatorWrite(entCtx *AuthorizerContext) EnforcementDecision

OperatorWrite determines if the state-changing Consul operator functions can be used.

func (*ChainedAuthorizer) PreparedQueryRead

func (c *ChainedAuthorizer) PreparedQueryRead(query string, entCtx *AuthorizerContext) EnforcementDecision

PreparedQueryRead determines if a specific prepared query can be read to show its contents (this is not used for execution).

func (*ChainedAuthorizer) PreparedQueryWrite

func (c *ChainedAuthorizer) PreparedQueryWrite(query string, entCtx *AuthorizerContext) EnforcementDecision

PreparedQueryWrite determines if a specific prepared query can be created, modified, or deleted.

func (*ChainedAuthorizer) ServiceRead

func (c *ChainedAuthorizer) ServiceRead(name string, entCtx *AuthorizerContext) EnforcementDecision

ServiceRead checks for permission to read a given service

func (*ChainedAuthorizer) ServiceWrite

func (c *ChainedAuthorizer) ServiceWrite(name string, entCtx *AuthorizerContext) EnforcementDecision

ServiceWrite checks for permission to create or update a given service

func (*ChainedAuthorizer) SessionRead

func (c *ChainedAuthorizer) SessionRead(node string, entCtx *AuthorizerContext) EnforcementDecision

SessionRead checks for permission to read sessions for a given node.

func (*ChainedAuthorizer) SessionWrite

func (c *ChainedAuthorizer) SessionWrite(node string, entCtx *AuthorizerContext) EnforcementDecision

SessionWrite checks for permission to create sessions for a given node.

func (*ChainedAuthorizer) Snapshot

func (c *ChainedAuthorizer) Snapshot(entCtx *AuthorizerContext) EnforcementDecision

Snapshot checks for permission to take and restore snapshots.

type Config

type Config struct {
	// WildcardName is the string that represents a request to authorize a wildcard permission
	WildcardName string

	// embedded enterprise configuration
	EnterpriseConfig
}

Config encapsualtes all of the generic configuration parameters used for policy parsing and enforcement

func (*Config) Close

func (c *Config) Close()

Close will relinquish any resources this Config might be holding on to or managing.

func (*Config) GetWildcardName

func (c *Config) GetWildcardName() string

GetWildcardName will retrieve the configured wildcard name or provide a default in the case that the config is Nil or the wildcard name is unset.

type EnforcementDecision

type EnforcementDecision int
const (
	// Deny returned from an Authorizer enforcement method indicates
	// that a corresponding rule was found and that access should be denied
	Deny EnforcementDecision = iota
	// Allow returned from an Authorizer enforcement method indicates
	// that a corresponding rule was found and that access should be allowed
	Allow
	// Default returned from an Authorizer enforcement method indicates
	// that a corresponding rule was not found and that whether access
	// should be granted or denied should be deferred to the default
	// access level
	Default
)

func Enforce

func Enforce(authz Authorizer, rsc Resource, segment string, access string, ctx *AuthorizerContext) (EnforcementDecision, error)

func (EnforcementDecision) String

func (d EnforcementDecision) String() string

type EnterpriseConfig

type EnterpriseConfig struct {
}

func (*EnterpriseConfig) Close

func (_ *EnterpriseConfig) Close()

type EnterprisePolicyMeta

type EnterprisePolicyMeta struct{}

EnterprisePolicyMeta stub

type EnterprisePolicyRules

type EnterprisePolicyRules struct{}

EnterprisePolicyRules stub

func (*EnterprisePolicyRules) Validate

func (r *EnterprisePolicyRules) Validate(*Config) error

type EnterpriseRule

type EnterpriseRule struct{}

EnterpriseRule stub

func (*EnterpriseRule) Validate

func (r *EnterpriseRule) Validate(string, *Config) error

type EventRule

type EventRule struct {
	Event  string `hcl:",key"`
	Policy string
}

EventRule represents a user event rule.

type KeyRule

type KeyRule struct {
	Prefix string `hcl:",key"`
	Policy string

	EnterpriseRule `hcl:",squash"`
}

KeyRule represents a rule for a key

type NodeRule

type NodeRule struct {
	Name   string `hcl:",key"`
	Policy string

	EnterpriseRule `hcl:",squash"`
}

NodeRule represents a rule for a node

type PermissionDeniedError

type PermissionDeniedError struct {
	Cause string
}

func PermissionDenied

func PermissionDenied(msg string, args ...interface{}) PermissionDeniedError

func (PermissionDeniedError) Error

func (e PermissionDeniedError) Error() string

type Policy

type Policy struct {
	ID                    string `hcl:"id"`
	Revision              uint64 `hcl:"revision"`
	PolicyRules           `hcl:",squash"`
	EnterprisePolicyRules `hcl:",squash"`
}

Policy is used to represent the policy specified by an ACL configuration.

func MergePolicies

func MergePolicies(policies []*Policy) *Policy

func NewPolicyFromSource

func NewPolicyFromSource(id string, revision uint64, rules string, syntax SyntaxVersion, conf *Config, meta *EnterprisePolicyMeta) (*Policy, error)

NewPolicyFromSource is used to parse the specified ACL rules into an intermediary set of policies, before being compiled into the ACL

func (*Policy) ConvertFromLegacy

func (policy *Policy) ConvertFromLegacy() *Policy

func (*Policy) ConvertToLegacy

func (policy *Policy) ConvertToLegacy() *Policy

type PolicyMerger

type PolicyMerger struct {
	// contains filtered or unexported fields
}

func NewPolicyMerger

func NewPolicyMerger() *PolicyMerger

func (*PolicyMerger) Merge

func (m *PolicyMerger) Merge(policy *Policy)

func (*PolicyMerger) Policy

func (m *PolicyMerger) Policy() *Policy

Policy outputs the merged policy

type PolicyRules

type PolicyRules struct {
	ACL                   string               `hcl:"acl,expand"`
	Agents                []*AgentRule         `hcl:"agent,expand"`
	AgentPrefixes         []*AgentRule         `hcl:"agent_prefix,expand"`
	Keys                  []*KeyRule           `hcl:"key,expand"`
	KeyPrefixes           []*KeyRule           `hcl:"key_prefix,expand"`
	Nodes                 []*NodeRule          `hcl:"node,expand"`
	NodePrefixes          []*NodeRule          `hcl:"node_prefix,expand"`
	Services              []*ServiceRule       `hcl:"service,expand"`
	ServicePrefixes       []*ServiceRule       `hcl:"service_prefix,expand"`
	Sessions              []*SessionRule       `hcl:"session,expand"`
	SessionPrefixes       []*SessionRule       `hcl:"session_prefix,expand"`
	Events                []*EventRule         `hcl:"event,expand"`
	EventPrefixes         []*EventRule         `hcl:"event_prefix,expand"`
	PreparedQueries       []*PreparedQueryRule `hcl:"query,expand"`
	PreparedQueryPrefixes []*PreparedQueryRule `hcl:"query_prefix,expand"`
	Keyring               string               `hcl:"keyring"`
	Operator              string               `hcl:"operator"`
}

func (*PolicyRules) Validate

func (pr *PolicyRules) Validate(conf *Config) error

type PreparedQueryRule

type PreparedQueryRule struct {
	Prefix string `hcl:",key"`
	Policy string
}

PreparedQueryRule represents a prepared query rule.

type Resource

type Resource string
const (
	ResourceACL       Resource = "acl"
	ResourceAgent     Resource = "agent"
	ResourceEvent     Resource = "event"
	ResourceIntention Resource = "intention"
	ResourceKey       Resource = "key"
	ResourceKeyring   Resource = "keyring"
	ResourceNode      Resource = "node"
	ResourceOperator  Resource = "operator"
	ResourceQuery     Resource = "query"
	ResourceService   Resource = "service"
	ResourceSession   Resource = "session"
)

type ServiceRule

type ServiceRule struct {
	Name   string `hcl:",key"`
	Policy string

	// Intentions is the policy for intentions where this service is the
	// destination. This may be empty, in which case the Policy determines
	// the intentions policy.
	Intentions string

	EnterpriseRule `hcl:",squash"`
}

ServiceRule represents a policy for a service

type SessionRule

type SessionRule struct {
	Node   string `hcl:",key"`
	Policy string
}

SessionRule represents a rule for making sessions tied to specific node name prefixes.

type SyntaxVersion

type SyntaxVersion int
const (
	SyntaxCurrent SyntaxVersion = iota
	SyntaxLegacy
)

Package Files

Documentation was rendered with GOOS=linux and GOARCH=amd64.

Jump to identifier

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to identifier