forked from TrueCloudLab/frostfs-node
Move to frostfs-node
Signed-off-by: Pavel Karpy <p.karpy@yadro.com>
This commit is contained in:
Pavel Karpy
parent
42554a9298
commit
923f84722a
934 changed files with 3470 additions and 3451 deletions
28
cmd/frostfs-cli/modules/acl/basic/print.go
Normal file
28
cmd/frostfs-cli/modules/acl/basic/print.go
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
package basic
|
||||
|
||||
import (
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/common"
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
|
||||
"github.com/TrueCloudLab/frostfs-sdk-go/container/acl"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var printACLCmd = &cobra.Command{
|
||||
Use: "print",
|
||||
Short: "Pretty print basic ACL from the HEX representation",
|
||||
Example: `frostfs-cli acl basic print 0x1C8C8CCC`,
|
||||
Long: `Pretty print basic ACL from the HEX representation.
|
||||
Few roles have exclusive default access to set of operation, even if particular bit deny it.
|
||||
Container have access to the operations of the data replication mechanism:
|
||||
Get, Head, Put, Search, Hash.
|
||||
InnerRing members are allowed to data audit ops only:
|
||||
Get, Head, Hash, Search.`,
|
||||
Run: printACL,
|
||||
Args: cobra.ExactArgs(1),
|
||||
}
|
||||
|
||||
func printACL(cmd *cobra.Command, args []string) {
|
||||
var bacl acl.Basic
|
||||
common.ExitOnErr(cmd, "unable to parse basic acl: %w", bacl.DecodeString(args[0]))
|
||||
util.PrettyPrintTableBACL(cmd, &bacl)
|
||||
}
|
||||
14
cmd/frostfs-cli/modules/acl/basic/root.go
Normal file
14
cmd/frostfs-cli/modules/acl/basic/root.go
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
package basic
|
||||
|
||||
import (
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var Cmd = &cobra.Command{
|
||||
Use: "basic",
|
||||
Short: "Operations with Basic Access Control Lists",
|
||||
}
|
||||
|
||||
func init() {
|
||||
Cmd.AddCommand(printACLCmd)
|
||||
}
|
||||
127
cmd/frostfs-cli/modules/acl/extended/create.go
Normal file
127
cmd/frostfs-cli/modules/acl/extended/create.go
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
package extended
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/common"
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
|
||||
cid "github.com/TrueCloudLab/frostfs-sdk-go/container/id"
|
||||
"github.com/TrueCloudLab/frostfs-sdk-go/eacl"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var createCmd = &cobra.Command{
|
||||
Use: "create",
|
||||
Short: "Create extended ACL from the text representation",
|
||||
Long: `Create extended ACL from the text representation.
|
||||
|
||||
Rule consist of these blocks: <action> <operation> [<filter1> ...] [<target1> ...]
|
||||
|
||||
Action is 'allow' or 'deny'.
|
||||
|
||||
Operation is an object service verb: 'get', 'head', 'put', 'search', 'delete', 'getrange', or 'getrangehash'.
|
||||
|
||||
Filter consists of <typ>:<key><match><value>
|
||||
Typ is 'obj' for object applied filter or 'req' for request applied filter.
|
||||
Key is a valid unicode string corresponding to object or request header key.
|
||||
Well-known system object headers start with '$Object:' prefix.
|
||||
User defined headers start without prefix.
|
||||
Read more about filter keys at github.com/TrueCloudLab/frostfs-api/blob/master/proto-docs/acl.md#message-eaclrecordfilter
|
||||
Match is '=' for matching and '!=' for non-matching filter.
|
||||
Value is a valid unicode string corresponding to object or request header value.
|
||||
|
||||
Target is
|
||||
'user' for container owner,
|
||||
'system' for Storage nodes in container and Inner Ring nodes,
|
||||
'others' for all other request senders,
|
||||
'pubkey:<key1>,<key2>,...' for exact request sender, where <key> is a hex-encoded 33-byte public key.
|
||||
|
||||
When both '--rule' and '--file' arguments are used, '--rule' records will be placed higher in resulting extended ACL table.
|
||||
`,
|
||||
Example: `frostfs-cli acl extended create --cid EutHBsdT1YCzHxjCfQHnLPL1vFrkSyLSio4vkphfnEk -f rules.txt --out table.json
|
||||
frostfs-cli acl extended create --cid EutHBsdT1YCzHxjCfQHnLPL1vFrkSyLSio4vkphfnEk -r 'allow get obj:Key=Value others' -r 'deny put others'`,
|
||||
Run: createEACL,
|
||||
}
|
||||
|
||||
func init() {
|
||||
createCmd.Flags().StringArrayP("rule", "r", nil, "Extended ACL table record to apply")
|
||||
createCmd.Flags().StringP("file", "f", "", "Read list of extended ACL table records from text file")
|
||||
createCmd.Flags().StringP("out", "o", "", "Save JSON formatted extended ACL table in file")
|
||||
createCmd.Flags().StringP(commonflags.CIDFlag, "", "", commonflags.CIDFlagUsage)
|
||||
|
||||
_ = cobra.MarkFlagFilename(createCmd.Flags(), "file")
|
||||
_ = cobra.MarkFlagFilename(createCmd.Flags(), "out")
|
||||
}
|
||||
|
||||
func createEACL(cmd *cobra.Command, _ []string) {
|
||||
rules, _ := cmd.Flags().GetStringArray("rule")
|
||||
fileArg, _ := cmd.Flags().GetString("file")
|
||||
outArg, _ := cmd.Flags().GetString("out")
|
||||
cidArg, _ := cmd.Flags().GetString(commonflags.CIDFlag)
|
||||
|
||||
var containerID cid.ID
|
||||
if cidArg != "" {
|
||||
if err := containerID.DecodeString(cidArg); err != nil {
|
||||
cmd.PrintErrf("invalid container ID: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
rulesFile, err := getRulesFromFile(fileArg)
|
||||
if err != nil {
|
||||
cmd.PrintErrf("can't read rules from file: %v\n", err)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
rules = append(rules, rulesFile...)
|
||||
if len(rules) == 0 {
|
||||
cmd.PrintErrln("no extended ACL rules has been provided")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
tb := eacl.NewTable()
|
||||
common.ExitOnErr(cmd, "unable to parse provided rules: %w", util.ParseEACLRules(tb, rules))
|
||||
|
||||
tb.SetCID(containerID)
|
||||
|
||||
data, err := tb.MarshalJSON()
|
||||
if err != nil {
|
||||
cmd.PrintErrln(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
buf := new(bytes.Buffer)
|
||||
err = json.Indent(buf, data, "", " ")
|
||||
if err != nil {
|
||||
cmd.PrintErrln(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
if len(outArg) == 0 {
|
||||
cmd.Println(buf)
|
||||
return
|
||||
}
|
||||
|
||||
err = os.WriteFile(outArg, buf.Bytes(), 0644)
|
||||
if err != nil {
|
||||
cmd.PrintErrln(err)
|
||||
os.Exit(1)
|
||||
}
|
||||
}
|
||||
|
||||
func getRulesFromFile(filename string) ([]string, error) {
|
||||
if len(filename) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
data, err := os.ReadFile(filename)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return strings.Split(strings.TrimSpace(string(data)), "\n"), nil
|
||||
}
|
||||
90
cmd/frostfs-cli/modules/acl/extended/create_test.go
Normal file
90
cmd/frostfs-cli/modules/acl/extended/create_test.go
Normal file
|
|
@ -0,0 +1,90 @@
|
|||
package extended
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
|
||||
"github.com/TrueCloudLab/frostfs-sdk-go/eacl"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestParseTable(t *testing.T) {
|
||||
tests := [...]struct {
|
||||
name string // test name
|
||||
rule string // input extended ACL rule
|
||||
jsonRecord string // produced record after successfull parsing
|
||||
}{
|
||||
{
|
||||
name: "valid rule with multiple filters",
|
||||
rule: "deny get obj:a=b req:c=d others",
|
||||
jsonRecord: `{"operation":"GET","action":"DENY","filters":[{"headerType":"OBJECT","matchType":"STRING_EQUAL","key":"a","value":"b"},{"headerType":"REQUEST","matchType":"STRING_EQUAL","key":"c","value":"d"}],"targets":[{"role":"OTHERS","keys":[]}]}`,
|
||||
},
|
||||
{
|
||||
name: "valid rule without filters",
|
||||
rule: "allow put user",
|
||||
jsonRecord: `{"operation":"PUT","action":"ALLOW","filters":[],"targets":[{"role":"USER","keys":[]}]}`,
|
||||
},
|
||||
{
|
||||
name: "valid rule with public key",
|
||||
rule: "deny getrange pubkey:036410abb260bbbda89f61c0cad65a4fa15ac5cb83b3c3abf8aee403856fcf65ed",
|
||||
jsonRecord: `{"operation":"GETRANGE","action":"DENY","filters":[],"targets":[{"role":"ROLE_UNSPECIFIED","keys":["A2QQq7Jgu72on2HAytZaT6FaxcuDs8Or+K7kA4Vvz2Xt"]}]}`,
|
||||
},
|
||||
{
|
||||
name: "missing action",
|
||||
rule: "get obj:a=b others",
|
||||
},
|
||||
{
|
||||
name: "invalid action",
|
||||
rule: "permit get obj:a=b others",
|
||||
},
|
||||
{
|
||||
name: "missing op",
|
||||
rule: "deny obj:a=b others",
|
||||
},
|
||||
{
|
||||
name: "invalid op action",
|
||||
rule: "deny look obj:a=b others",
|
||||
},
|
||||
{
|
||||
name: "invalid filter type",
|
||||
rule: "deny get invalid:a=b others",
|
||||
},
|
||||
{
|
||||
name: "invalid target group",
|
||||
rule: "deny get obj:a=b helpers",
|
||||
},
|
||||
{
|
||||
name: "invalid public key",
|
||||
rule: "deny get obj:a=b pubkey:0123",
|
||||
},
|
||||
}
|
||||
|
||||
eaclTable := eacl.NewTable()
|
||||
|
||||
for _, test := range tests {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
err := util.ParseEACLRule(eaclTable, test.rule)
|
||||
ok := len(test.jsonRecord) > 0
|
||||
require.Equal(t, ok, err == nil, err)
|
||||
if ok {
|
||||
expectedRecord := eacl.NewRecord()
|
||||
err = expectedRecord.UnmarshalJSON([]byte(test.jsonRecord))
|
||||
require.NoError(t, err)
|
||||
|
||||
actualRecord := eaclTable.Records()[len(eaclTable.Records())-1]
|
||||
|
||||
equalRecords(t, expectedRecord, &actualRecord)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func equalRecords(t *testing.T, r1, r2 *eacl.Record) {
|
||||
d1, err := r1.Marshal()
|
||||
require.NoError(t, err)
|
||||
|
||||
d2, err := r2.Marshal()
|
||||
require.NoError(t, err)
|
||||
|
||||
require.Equal(t, d1, d2)
|
||||
}
|
||||
38
cmd/frostfs-cli/modules/acl/extended/print.go
Normal file
38
cmd/frostfs-cli/modules/acl/extended/print.go
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
package extended
|
||||
|
||||
import (
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/common"
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/util"
|
||||
"github.com/TrueCloudLab/frostfs-sdk-go/eacl"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var printEACLCmd = &cobra.Command{
|
||||
Use: "print",
|
||||
Short: "Pretty print extended ACL from the file(in text or json format) or for given container.",
|
||||
Run: printEACL,
|
||||
}
|
||||
|
||||
func init() {
|
||||
flags := printEACLCmd.Flags()
|
||||
flags.StringP("file", "f", "",
|
||||
"Read list of extended ACL table records from text or json file")
|
||||
_ = printEACLCmd.MarkFlagRequired("file")
|
||||
}
|
||||
|
||||
func printEACL(cmd *cobra.Command, _ []string) {
|
||||
file, _ := cmd.Flags().GetString("file")
|
||||
eaclTable := new(eacl.Table)
|
||||
data, err := os.ReadFile(file)
|
||||
common.ExitOnErr(cmd, "can't read file with EACL: %w", err)
|
||||
if strings.HasSuffix(file, ".json") {
|
||||
common.ExitOnErr(cmd, "unable to parse json: %w", eaclTable.UnmarshalJSON(data))
|
||||
} else {
|
||||
rules := strings.Split(strings.TrimSpace(string(data)), "\n")
|
||||
common.ExitOnErr(cmd, "can't parse file with EACL: %w", util.ParseEACLRules(eaclTable, rules))
|
||||
}
|
||||
util.PrettyPrintTableEACL(cmd, eaclTable)
|
||||
}
|
||||
15
cmd/frostfs-cli/modules/acl/extended/root.go
Normal file
15
cmd/frostfs-cli/modules/acl/extended/root.go
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
package extended
|
||||
|
||||
import (
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var Cmd = &cobra.Command{
|
||||
Use: "extended",
|
||||
Short: "Operations with Extended Access Control Lists",
|
||||
}
|
||||
|
||||
func init() {
|
||||
Cmd.AddCommand(createCmd)
|
||||
Cmd.AddCommand(printEACLCmd)
|
||||
}
|
||||
17
cmd/frostfs-cli/modules/acl/root.go
Normal file
17
cmd/frostfs-cli/modules/acl/root.go
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
package acl
|
||||
|
||||
import (
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/acl/basic"
|
||||
"github.com/TrueCloudLab/frostfs-node/cmd/frostfs-cli/modules/acl/extended"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var Cmd = &cobra.Command{
|
||||
Use: "acl",
|
||||
Short: "Operations with Access Control Lists",
|
||||
}
|
||||
|
||||
func init() {
|
||||
Cmd.AddCommand(extended.Cmd)
|
||||
Cmd.AddCommand(basic.Cmd)
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue