From cd97b1a1ba70065d959a543b33c9d0932b295b35 Mon Sep 17 00:00:00 2001 From: Airat Arifullin Date: Mon, 18 Nov 2024 18:57:13 +0300 Subject: [PATCH] [#1503] container: Fix APE-request target * Request target shouldn't contain container target as container operations can't be checked with container-targeted rules. Signed-off-by: Airat Arifullin --- pkg/services/container/ape.go | 12 +++++++++--- pkg/services/container/ape_test.go | 20 ++++++++++---------- 2 files changed, 19 insertions(+), 13 deletions(-) diff --git a/pkg/services/container/ape.go b/pkg/services/container/ape.go index 2cdb30b45..09b4058dd 100644 --- a/pkg/services/container/ape.go +++ b/pkg/services/container/ape.go @@ -327,9 +327,15 @@ func (ac *apeChecker) validateContainerBoundedOperation(ctx context.Context, con reqProps, ) - s, found, err := ac.router.IsAllowed(apechain.Ingress, - policyengine.NewRequestTargetExtended(namespace, id.EncodeToString(), fmt.Sprintf("%s:%s", namespace, pk.Address()), groups), - request) + rt := policyengine.NewRequestTargetWithNamespace(namespace) + userTarget := policyengine.UserTarget(fmt.Sprintf("%s:%s", namespace, pk.Address())) + rt.User = &userTarget + rt.Groups = make([]policyengine.Target, len(groups)) + for i := range groups { + rt.Groups[i] = policyengine.GroupTarget(groups[i]) + } + + s, found, err := ac.router.IsAllowed(apechain.Ingress, rt, request) if err != nil { return err } diff --git a/pkg/services/container/ape_test.go b/pkg/services/container/ape_test.go index b6b42a559..4ae43a763 100644 --- a/pkg/services/container/ape_test.go +++ b/pkg/services/container/ape_test.go @@ -117,7 +117,7 @@ func testAllowThenDenyGetContainerRuleDefined(t *testing.T) { _, err = apeSrv.Get(context.Background(), req) require.NoError(t, err) - _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -324,7 +324,7 @@ func testDenyGetContainerForOthers(t *testing.T) { nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap - _, _, err := router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -424,7 +424,7 @@ func testDenyGetContainerByUserClaimTag(t *testing.T) { nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap - _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -522,7 +522,7 @@ func testDenyGetContainerByIP(t *testing.T) { nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap - _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -621,7 +621,7 @@ func testDenyGetContainerByGroupID(t *testing.T) { nm.netmaps[nm.currentEpoch] = &testNetmap nm.netmaps[nm.currentEpoch-1] = &testNetmap - _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err = router.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -1213,7 +1213,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) { components.containerReader.c[contID] = &containercore.Container{Value: testContainer} initTestNetmap(components.netmap) - _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -1255,7 +1255,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) { components.containerReader.c[contID] = &containercore.Container{Value: testContainer} initTestNetmap(components.netmap) - _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -1341,7 +1341,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) { components.containerReader.c[contID] = &containercore.Container{Value: testContainer} initTestNetmap(components.netmap) - _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -1384,7 +1384,7 @@ func TestValidateContainerBoundedOperation(t *testing.T) { components.containerReader.c[contID] = &containercore.Container{Value: testContainer} initTestNetmap(components.netmap) - _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := components.engine.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.AccessDenied, @@ -1566,7 +1566,7 @@ func initListRequest(t *testing.T, actorPK *keys.PrivateKey, ownerPK *keys.Priva } func addDefaultAllowGetPolicy(t *testing.T, e engine.Engine, contID cid.ID) { - _, _, err := e.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.ContainerTarget(contID.EncodeToString()), &chain.Chain{ + _, _, err := e.MorphRuleChainStorage().AddMorphRuleChain(chain.Ingress, engine.NamespaceTarget(""), &chain.Chain{ Rules: []chain.Rule{ { Status: chain.Allow,