evaluator

Documentation

Overview

Package evaluator contains rego evaluators for evaluating authorize policy.

Index

• Variables
• type ClientCertConstraints
  • func ClientCertConstraintsFromConfig(cfg *config.DownstreamMTLSSettings) (*ClientCertConstraints, error)
• type ClientCertificateInfo
• type Evaluator
  • func New(ctx context.Context, store *store.Store, previous *Evaluator, ...) (*Evaluator, error)
  • func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)
• type HeadersEvaluator
  • func NewHeadersEvaluator(ctx context.Context, store *store.Store) (*HeadersEvaluator, error)
  • func (e *HeadersEvaluator) Evaluate(ctx context.Context, req *HeadersRequest) (*HeadersResponse, error)
• type HeadersRequest
  • func NewHeadersRequestFromPolicy(policy *config.Policy, http RequestHTTP) *HeadersRequest
• type HeadersResponse
• type Option
  • func WithAddDefaultClientCertificateRule(addDefaultClientCertificateRule bool) Option
  • func WithAuthenticateURL(authenticateURL string) Option
  • func WithClientCA(clientCA []byte) Option
  • func WithClientCRL(clientCRL []byte) Option
  • func WithClientCertConstraints(constraints *ClientCertConstraints) Option
  • func WithGoogleCloudServerlessAuthenticationServiceAccount(serviceAccount string) Option
  • func WithJWTClaimsHeaders(headers config.JWTClaimHeaders) Option
  • func WithPolicies(policies []config.Policy) Option
  • func WithSigningKey(signingKey []byte) Option
• type PolicyEvaluator
  • func NewPolicyEvaluator(ctx context.Context, store *store.Store, configPolicy *config.Policy, ...) (*PolicyEvaluator, error)
  • func (e *PolicyEvaluator) Evaluate(ctx context.Context, req *PolicyRequest) (*PolicyResponse, error)
• type PolicyRequest
• type PolicyResponse
  • func NewPolicyResponse() *PolicyResponse
• type Request
• type RequestHTTP
  • func NewRequestHTTP(method string, requestURL url.URL, headers map[string]string, ...) RequestHTTP
• type RequestSession
• type Result
• type RuleResult
  • func MergeRuleResultsWithOr(results ...RuleResult) RuleResult
  • func NewRuleResult(value bool, reasons ...criteria.Reason) RuleResult
• type SANMatchers

Variables

var (
	GCPIdentityTokenExpiration       = time.Minute * 45 // tokens expire after one hour according to the GCP docs
	GCPIdentityDocURL                = "http://metadata/computeMetadata/v1/instance/service-accounts/default/identity"
	GCPIdentityNow                   = time.Now
	GCPIdentityMaxBodySize     int64 = 1024 * 1024 * 10
)

GCP pre-defined values.

Types

type ClientCertConstraints

type ClientCertConstraints struct {
	// MaxVerifyDepth is the maximum allowed certificate chain depth (not
	// counting the leaf certificate). A value of 0 indicates no maximum.
	MaxVerifyDepth uint32

	// SANMatchers is a map of SAN type to regex match expression. When
	// non-empty, a client certificate must contain at least one Subject
	// Alternative Name that matches one of the expessions.
	SANMatchers SANMatchers
}

ClientCertConstraints contains additional constraints to validate when verifying a client certificate.

func ClientCertConstraintsFromConfig

func ClientCertConstraintsFromConfig(
	cfg *config.DownstreamMTLSSettings,
) (*ClientCertConstraints, error)

ClientCertConstraintsFromConfig populates a new ClientCertConstraints struct based on the provided configuration.

type ClientCertificateInfo

type ClientCertificateInfo struct {
	// Presented is true if the client presented a certificate.
	Presented bool `json:"presented"`

	// Leaf contains the leaf client certificate (unvalidated).
	Leaf string `json:"leaf,omitempty"`

	// Intermediates contains the remainder of the client certificate chain as
	// it was originally presented by the client (unvalidated).
	Intermediates string `json:"intermediates,omitempty"`
}

ClientCertificateInfo contains information about the certificate presented by the client (if any).

type Evaluator

type Evaluator struct {
	// contains filtered or unexported fields
}

An Evaluator evaluates policies.

func New

func New(
	ctx context.Context, store *store.Store, previous *Evaluator, options ...Option,
) (*Evaluator, error)

New creates a new Evaluator.

func (*Evaluator) Evaluate

func (e *Evaluator) Evaluate(ctx context.Context, req *Request) (*Result, error)

Evaluate evaluates the rego for the given policy and generates the identity headers.

type HeadersEvaluator

type HeadersEvaluator struct {
	// contains filtered or unexported fields
}

A HeadersEvaluator evaluates the headers.rego script.

func NewHeadersEvaluator

func NewHeadersEvaluator(ctx context.Context, store *store.Store) (*HeadersEvaluator, error)

NewHeadersEvaluator creates a new HeadersEvaluator.

func (*HeadersEvaluator) Evaluate

func (e *HeadersEvaluator) Evaluate(ctx context.Context, req *HeadersRequest) (*HeadersResponse, error)

Evaluate evaluates the headers.rego script.

type HeadersRequest

type HeadersRequest struct {
	EnableGoogleCloudServerlessAuthentication bool                  `json:"enable_google_cloud_serverless_authentication"`
	EnableRoutingKey                          bool                  `json:"enable_routing_key"`
	Issuer                                    string                `json:"issuer"`
	KubernetesServiceAccountToken             string                `json:"kubernetes_service_account_token"`
	ToAudience                                string                `json:"to_audience"`
	Session                                   RequestSession        `json:"session"`
	ClientCertificate                         ClientCertificateInfo `json:"client_certificate"`
	SetRequestHeaders                         map[string]string     `json:"set_request_headers"`
}

HeadersRequest is the input to the headers.rego script.

func NewHeadersRequestFromPolicy

func NewHeadersRequestFromPolicy(policy *config.Policy, http RequestHTTP) *HeadersRequest

NewHeadersRequestFromPolicy creates a new HeadersRequest from a policy.

type HeadersResponse

type HeadersResponse struct {
	Headers http.Header
}

HeadersResponse is the output from the headers.rego script.

type Option

type Option func(*evaluatorConfig)

An Option customizes the evaluator config.

func WithAddDefaultClientCertificateRule

func WithAddDefaultClientCertificateRule(addDefaultClientCertificateRule bool) Option

WithAddDefaultClientCertificateRule sets whether to add a default invalid_client_certificate deny rule to all policies.

func WithAuthenticateURL

func WithAuthenticateURL(authenticateURL string) Option

WithAuthenticateURL sets the authenticate URL in the config.

func WithClientCA

func WithClientCA(clientCA []byte) Option

WithClientCA sets the client CA in the config.

func WithClientCRL

func WithClientCRL(clientCRL []byte) Option

WithClientCRL sets the client CRL in the config.

func WithClientCertConstraints

func WithClientCertConstraints(constraints *ClientCertConstraints) Option

WithClientCertConstraints sets addition client certificate constraints.

func WithGoogleCloudServerlessAuthenticationServiceAccount

func WithGoogleCloudServerlessAuthenticationServiceAccount(serviceAccount string) Option

WithGoogleCloudServerlessAuthenticationServiceAccount sets the google cloud serverless authentication service account in the config.

func WithJWTClaimsHeaders

func WithJWTClaimsHeaders(headers config.JWTClaimHeaders) Option

WithJWTClaimsHeaders sets the JWT claims headers in the config.

func WithPolicies

func WithPolicies(policies []config.Policy) Option

WithPolicies sets the policies in the config.

func WithSigningKey

func WithSigningKey(signingKey []byte) Option

WithSigningKey sets the signing key and algorithm in the config.

type PolicyEvaluator

type PolicyEvaluator struct {
	// contains filtered or unexported fields
}

A PolicyEvaluator evaluates policies.

func NewPolicyEvaluator

func NewPolicyEvaluator(
	ctx context.Context, store *store.Store, configPolicy *config.Policy,
	addDefaultClientCertificateRule bool,
) (*PolicyEvaluator, error)

NewPolicyEvaluator creates a new PolicyEvaluator.

func (*PolicyEvaluator) Evaluate

func (e *PolicyEvaluator) Evaluate(ctx context.Context, req *PolicyRequest) (*PolicyResponse, error)

Evaluate evaluates the policy rego scripts.

type PolicyRequest

type PolicyRequest struct {
	HTTP                     RequestHTTP    `json:"http"`
	Session                  RequestSession `json:"session"`
	IsValidClientCertificate bool           `json:"is_valid_client_certificate"`
}

PolicyRequest is the input to policy evaluation.

type PolicyResponse

type PolicyResponse struct {
	Allow, Deny RuleResult
	Traces      []contextutil.PolicyEvaluationTrace
}

PolicyResponse is the result of evaluating a policy.

func NewPolicyResponse

func NewPolicyResponse() *PolicyResponse

NewPolicyResponse creates a new PolicyResponse.

type Request

type Request struct {
	IsInternal bool
	Policy     *config.Policy
	HTTP       RequestHTTP
	Session    RequestSession
}

Request contains the inputs needed for evaluation.

type RequestHTTP

type RequestHTTP struct {
	Method            string                `json:"method"`
	Hostname          string                `json:"hostname"`
	Path              string                `json:"path"`
	URL               string                `json:"url"`
	Headers           map[string]string     `json:"headers"`
	ClientCertificate ClientCertificateInfo `json:"client_certificate"`
	IP                string                `json:"ip"`
}

RequestHTTP is the HTTP field in the request.

func NewRequestHTTP

func NewRequestHTTP(
	method string,
	requestURL url.URL,
	headers map[string]string,
	clientCertificate ClientCertificateInfo,
	ip string,
) RequestHTTP

NewRequestHTTP creates a new RequestHTTP.

type RequestSession

type RequestSession struct {
	ID string `json:"id"`
}

RequestSession is the session field in the request.

type Result

type Result struct {
	Allow   RuleResult
	Deny    RuleResult
	Headers http.Header
	Traces  []contextutil.PolicyEvaluationTrace
}

Result is the result of evaluation.

type RuleResult

type RuleResult struct {
	Value          bool
	Reasons        criteria.Reasons
	AdditionalData map[string]interface{}
}

A RuleResult is the result of evaluating a rule.

func MergeRuleResultsWithOr

func MergeRuleResultsWithOr(results ...RuleResult) RuleResult

MergeRuleResultsWithOr merges all the results using `or`.

func NewRuleResult

func NewRuleResult(value bool, reasons ...criteria.Reason) RuleResult

NewRuleResult creates a new RuleResult.

type SANMatchers

type SANMatchers = map[config.SANType]*regexp.Regexp

SANMatchers is a map of SAN type to regex match expression.