| // Copyright 2015 The Vanadium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style |
| // license that can be found in the LICENSE file. |
| |
| package access_test |
| |
| import ( |
| "crypto/ecdsa" |
| "crypto/elliptic" |
| "crypto/rand" |
| "fmt" |
| "io/ioutil" |
| "os" |
| "reflect" |
| "sort" |
| "testing" |
| "time" |
| |
| "v.io/v23/context" |
| "v.io/v23/security" |
| "v.io/v23/security/access" |
| "v.io/v23/security/access/internal" |
| "v.io/v23/vdl" |
| "v.io/v23/verror" |
| ) |
| |
| func authorize(authorizer security.Authorizer, params *security.CallParams) error { |
| ctx, cancel := context.RootContext() |
| defer cancel() |
| return authorizer.Authorize(ctx, security.NewCall(params)) |
| } |
| |
| func enforceable(al access.AccessList, p security.Principal) error { |
| ctx, cancel := context.RootContext() |
| defer cancel() |
| return al.Enforceable(ctx, p) |
| } |
| |
| func TestAccessListAuthorizer(t *testing.T) { |
| var ( |
| pali = newPrincipal(t) |
| pbob = newPrincipal(t) |
| pche = newPrincipal(t) |
| |
| expired, _ = security.NewExpiryCaveat(time.Now().Add(-1 * time.Minute)) |
| |
| ali, _ = pbob.BlessSelf("ali") |
| bob, _ = pbob.BlessSelf("bob") |
| bobSelf, _ = pbob.BlessSelf("bob:self") |
| bobDelegate, _ = pbob.Bless(pche.PublicKey(), bob, "delegate:che", security.UnconstrainedUse()) |
| bobDelegateBad, _ = pbob.Bless(pche.PublicKey(), bob, "delegate:badman", security.UnconstrainedUse()) |
| bobDelegateExpired, _ = pbob.Bless(pche.PublicKey(), bob, "delegate:che", expired) |
| |
| bobUnion, _ = security.UnionOfBlessings(bobDelegate, bobDelegateExpired) |
| bobBadUnion, _ = security.UnionOfBlessings(bobDelegateBad, bobDelegateExpired) |
| |
| acl = access.AccessList{ |
| In: []security.BlessingPattern{"bob:delegate", "bob:self"}, |
| NotIn: []string{"bob:delegate:badman"}, |
| } |
| |
| tests = []struct { |
| B security.Blessings |
| Authorize bool |
| }{ |
| {bob, false}, |
| {bobSelf, true}, |
| {bobDelegate, true}, |
| {bobDelegateBad, false}, |
| {bobDelegateExpired, false}, |
| {bobUnion, true}, |
| {bobBadUnion, false}, |
| } |
| ) |
| for _, test := range tests { |
| err := authorize(acl, &security.CallParams{ |
| LocalPrincipal: pali, |
| LocalBlessings: ali, |
| RemoteBlessings: test.B, |
| }) |
| if test.Authorize && err != nil { |
| t.Errorf("%v: Got error %v", test.B, err) |
| } else if errid := verror.ErrorID(err); !test.Authorize && errid != access.ErrAccessListMatch.ID { |
| t.Errorf("%v: Got error %v (errorid=%v) want errorid %v", test.B, err, errid, access.ErrAccessListMatch.ID) |
| } |
| } |
| } |
| |
| func TestAccessListEnforceable(t *testing.T) { |
| p := newPrincipal(t) |
| if key, err := p.PublicKey().MarshalBinary(); err != nil { |
| t.Fatal(err) |
| } else { |
| for _, pattern := range []security.BlessingPattern{"ali:spouse:$", "bob:friend"} { |
| if err := p.Roots().Add(key, pattern); err != nil { |
| t.Fatal(err) |
| } |
| } |
| } |
| |
| type ( |
| bp []security.BlessingPattern // shorthand |
| s []string // shorthand |
| ) |
| |
| tests := []struct { |
| al access.AccessList |
| errID verror.ID |
| rejected []security.BlessingPattern |
| }{ |
| { |
| al: access.AccessList{ |
| In: bp{"$", "ali:spouse:$", "bob:friend:$", "bob:friend:colleague"}, |
| NotIn: s{"ali:spouse:friend", "bob"}, // NotIn patterns don't matter. |
| }, |
| }, |
| { |
| al: access.AccessList{ |
| In: bp{"bob:friend:$", "ali:$:spouse", "bob::friend", "bob:..."}, // invalid patterns are rejected |
| NotIn: s{"ali:spouse:friend", "bob"}, |
| }, |
| errID: access.ErrUnenforceablePatterns.ID, |
| rejected: bp{"ali:$:spouse", "bob::friend", "bob:..."}, |
| }, |
| { |
| al: access.AccessList{ |
| In: bp{"ali:spouse:$", "bob:friend:$", "ali", "ali:$", "ali:spouse", "ali:spouse:friend", "bob", "bob:$", "bob:spouse"}, // unrecognized patterns are rejected |
| NotIn: s{"ali:spouse:friend", "bob"}, |
| }, |
| errID: access.ErrUnenforceablePatterns.ID, |
| rejected: bp{"ali", "ali:$", "ali:spouse", "ali:spouse:friend", "bob", "bob:$", "bob:spouse"}, |
| }, |
| { |
| al: access.AccessList{ |
| In: bp{"..."}, |
| NotIn: s{"bob:friend"}, |
| }, |
| errID: access.ErrInvalidOpenAccessList.ID, |
| }, |
| { |
| al: access.AccessList{ |
| In: bp{"...", "bob:friend"}, |
| }, |
| errID: access.ErrInvalidOpenAccessList.ID, |
| }, |
| } |
| for _, test := range tests { |
| gotErr := enforceable(test.al, p) |
| if (test.errID == "" && gotErr != nil) || (verror.ErrorID(gotErr) != test.errID) { |
| t.Errorf("%v.Enforceable(...): got error %v, want error with ID %v", test.al, gotErr, test.errID) |
| } |
| if test.errID != access.ErrUnenforceablePatterns.ID { |
| continue |
| } |
| |
| gotRejected := access.IsUnenforceablePatterns(gotErr) |
| sort.Sort(byPattern(gotRejected)) |
| sort.Sort(byPattern(test.rejected)) |
| if !reflect.DeepEqual(gotRejected, test.rejected) { |
| t.Errorf("IsUnenforceablePatterns(%v): got rejected pattern %v, want %v", gotErr, gotRejected, test.rejected) |
| } |
| } |
| } |
| |
| type byPattern []security.BlessingPattern |
| |
| func (a byPattern) Len() int { return len(a) } |
| func (a byPattern) Swap(i, j int) { a[i], a[j] = a[j], a[i] } |
| func (a byPattern) Less(i, j int) bool { return a[i] < a[j] } |
| |
| // TestPermissionsAuthorizer is both a test and a demonstration of the use of |
| // the access.PermissionsAuthorizer and interaction with interface specification |
| // in VDL. |
| func TestPermissionsAuthorizer(t *testing.T) { |
| type P []security.BlessingPattern |
| type S []string |
| // access.Permissions to test against. |
| perms := access.Permissions{ |
| "R": { |
| In: P{security.AllPrincipals}, |
| }, |
| "W": { |
| In: P{"ali:family", "bob", "che:$"}, |
| NotIn: S{"bob:acquaintances"}, |
| }, |
| "X": { |
| In: P{"ali:family:boss:$", "superman:$"}, |
| }, |
| } |
| type testcase struct { |
| Method string |
| Client security.Blessings |
| } |
| |
| authorizer, err := access.PermissionsAuthorizer(perms, vdl.TypeOf(internal.Read)) |
| if err != nil { |
| t.Fatalf("Could not create authorizer: %v", err) |
| } |
| |
| var ( |
| // Two principals: The "server" and the "client" |
| pserver = newPrincipal(t) |
| pclient = newPrincipal(t) |
| server, _ = pserver.BlessSelf("server") |
| |
| // B generates the provided blessings for the client and ensures |
| // that the server will recognize them. |
| B = func(names ...string) security.Blessings { |
| var ret security.Blessings |
| for _, name := range names { |
| b, err := pclient.BlessSelf(name) |
| if err != nil { |
| t.Fatalf("%q: %v", name, err) |
| } |
| // Since this test uses trustAllRoots, no need |
| // to call AddToRoots(pserver, b) to get the server |
| // to recognize the client. |
| if ret, err = security.UnionOfBlessings(ret, b); err != nil { |
| t.Fatal(err) |
| } |
| } |
| return ret |
| } |
| |
| run = func(test testcase) error { |
| return authorize(authorizer, &security.CallParams{ |
| LocalPrincipal: pserver, |
| LocalBlessings: server, |
| RemoteBlessings: test.Client, |
| Method: test.Method, |
| MethodTags: methodTags(test.Method), |
| }) |
| } |
| ) |
| |
| // Test cases where access should be granted to methods with tags on |
| // them. |
| for _, test := range []testcase{ |
| {"Get", security.Blessings{}}, |
| {"Get", B("ali")}, |
| {"Get", B("bob:friend", "che:enemy")}, |
| |
| {"Put", B("ali:family:mom")}, |
| {"Put", B("bob:friends")}, |
| {"Put", B("bob:acquantainces:carol", "che")}, // Access granted because of "che" |
| |
| {"Resolve", B("superman")}, |
| {"Resolve", B("ali:family:boss")}, |
| } { |
| if err := run(test); err != nil { |
| t.Errorf("Access denied to method %q to %v: %v", test.Method, test.Client, err) |
| } |
| } |
| // Test cases where access should be denied. |
| for _, test := range []testcase{ |
| // Nobody is denied access to "Get" |
| {"Put", B("ali", "bob:acquaintances", "bob:acquaintances:dave", "che:friend", "dave")}, |
| {"Resolve", B("ali", "ali:friend", "ali:family", "ali:family:friend", "alice:family:boss:friend", "superman:friend")}, |
| // Since there are no tags on the NoTags method, it has an |
| // empty AccessList. No client will have access. |
| {"NoTags", B("ali", "ali:family:boss", "bob", "che", "superman")}, |
| } { |
| if err := run(test); err == nil { |
| t.Errorf("Access to %q granted to %v", test.Method, test.Client) |
| } |
| } |
| } |
| |
| func TestPermissionsAuthorizerSelfRPCs(t *testing.T) { |
| var ( |
| // Client and server are the same principal, though have |
| // different blessings. |
| p = newPrincipal(t) |
| client, _ = p.BlessSelf("client") |
| server, _ = p.BlessSelf("server") |
| // Authorizer with access.Permissions that grant access to noone. |
| authorizer, _ = access.PermissionsAuthorizer(access.Permissions{"R": {In: []security.BlessingPattern{"nobody:$"}}}, vdl.TypeOf(internal.Read)) |
| ) |
| for _, test := range []string{"Put", "Get", "Resolve", "NoTags"} { |
| params := &security.CallParams{ |
| LocalPrincipal: p, |
| LocalBlessings: server, |
| RemoteBlessings: client, |
| Method: test, |
| MethodTags: methodTags(test), |
| } |
| // Self-RPCs should not be treated differently. |
| if err := authorize(authorizer, params); err == nil { |
| t.Errorf("Access to %q granted to %v", test, client) |
| } |
| } |
| } |
| |
| func TestPermissionsAuthorizerWithNilAccessList(t *testing.T) { |
| var ( |
| authorizer, _ = access.PermissionsAuthorizer(nil, vdl.TypeOf(internal.Read)) |
| pserver = newPrincipal(t) |
| pclient = newPrincipal(t) |
| server, _ = pserver.BlessSelf("server") |
| client, _ = pclient.BlessSelf("client") |
| ) |
| for _, test := range []string{"Put", "Get", "Resolve", "NoTags"} { |
| params := &security.CallParams{ |
| LocalPrincipal: pserver, |
| LocalBlessings: server, |
| RemoteBlessings: client, |
| Method: test, |
| MethodTags: methodTags(test), |
| } |
| if err := authorize(authorizer, params); err == nil { |
| t.Errorf("nil access.Permissions authorized method %q, %v", test, err) |
| } |
| } |
| } |
| |
| func TestPermissionsAuthorizerFromFile(t *testing.T) { |
| file, err := ioutil.TempFile("", "TestPermissionsAuthorizerFromFile") |
| if err != nil { |
| t.Fatal(err) |
| } |
| filename := file.Name() |
| file.Close() |
| defer os.Remove(filename) |
| |
| var ( |
| authorizer, _ = access.PermissionsAuthorizerFromFile(filename, vdl.TypeOf(internal.Read)) |
| pserver = newPrincipal(t) |
| pclient = newPrincipal(t) |
| server, _ = pserver.BlessSelf("alice") |
| alicefriend, _ = pserver.Bless(pclient.PublicKey(), server, "friend:bob", security.UnconstrainedUse()) |
| params = &security.CallParams{ |
| LocalPrincipal: pserver, |
| LocalBlessings: server, |
| RemoteBlessings: alicefriend, |
| Method: "Get", |
| MethodTags: methodTags("Get"), |
| } |
| ) |
| // Since this test is using trustAllRoots{}, do not need |
| // AddToRoots(pserver, server) to make pserver recognize itself as an |
| // authority on blessings matching "alice". |
| |
| // "alice:friend:bob" should not have access to internal.Read methods like Get. |
| if err := authorize(authorizer, params); err == nil { |
| t.Fatalf("Expected authorization error as %v is not on the AccessList for Read operations", alicefriend) |
| } |
| // Rewrite the file giving access |
| if err := ioutil.WriteFile(filename, []byte(`{"R": { "In":["alice:friend"] }}`), 0600); err != nil { |
| t.Fatal(err) |
| } |
| // Now should have access |
| if err := authorize(authorizer, params); err != nil { |
| t.Fatal(err) |
| } |
| } |
| |
| func TestTagTypeMustBeString(t *testing.T) { |
| type I int |
| if auth, err := access.PermissionsAuthorizer(access.Permissions{}, vdl.TypeOf(I(0))); err == nil || auth != nil { |
| t.Errorf("Got (%v, %v), wanted error since tag type is not a string", auth, err) |
| } |
| if auth, err := access.PermissionsAuthorizerFromFile("does_not_matter", vdl.TypeOf(I(0))); err == nil || auth != nil { |
| t.Errorf("Got (%v, %v), wanted error since tag type is not a string", auth, err) |
| } |
| } |
| |
| // TestMultipleTags will fail if PermissionsAuthorizer authorizes a request to |
| // a method with multiple tags. Alternatives considered were "must be present |
| // in access list for *all* tags", "must be present in access list for *any* |
| // tag" and "must be present in access list for *first* tag". Cases can be made |
| // for any of them and until there is more mileage on the use of multiple tags, |
| // take the conservative approach of considering multiple tags an error. |
| func TestMultipleTags(t *testing.T) { |
| var ( |
| allowAll = access.AccessList{In: []security.BlessingPattern{security.AllPrincipals}} |
| perms = access.Permissions{ |
| "R": allowAll, |
| "W": allowAll, |
| } |
| authorizer, _ = access.PermissionsAuthorizer(perms, vdl.TypeOf(internal.Read)) |
| pserver = newPrincipal(t) |
| pclient = newPrincipal(t) |
| server, _ = pserver.BlessSelf("server") |
| client, _ = pclient.BlessSelf("client") |
| call = &security.CallParams{ |
| LocalPrincipal: pserver, |
| LocalBlessings: server, |
| RemoteBlessings: client, |
| Method: "Get", |
| } |
| tags = []*vdl.Value{vdl.ValueOf(internal.Read), vdl.ValueOf(internal.Write)} |
| ) |
| // Access should be granted if any of the two tags are present. |
| for _, tag := range tags { |
| call.MethodTags = []*vdl.Value{tag} |
| if err := authorize(authorizer, call); err != nil { |
| t.Errorf("%v: %v", tag, err) |
| } |
| } |
| // But not if both the tags are present. |
| call.MethodTags = tags |
| if err := authorize(authorizer, call); err == nil { |
| t.Errorf("Expected error since there are multiple tags on the method") |
| } |
| } |
| |
| func methodTags(name string) []*vdl.Value { |
| server := internal.MyObjectServer(nil) |
| for _, iface := range server.Describe__() { |
| for _, method := range iface.Methods { |
| if method.Name == name { |
| return method.Tags |
| } |
| } |
| } |
| return nil |
| } |
| |
| func newPrincipal(t *testing.T) security.Principal { |
| key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) |
| if err != nil { |
| t.Fatal(err) |
| } |
| p, err := security.CreatePrincipal( |
| security.NewInMemoryECDSASigner(key), |
| nil, |
| &trustAllRoots{dump: make(map[security.BlessingPattern][]security.PublicKey)}, |
| ) |
| if err != nil { |
| t.Fatal(err) |
| } |
| return p |
| } |
| |
| type trustAllRoots struct { |
| dump map[security.BlessingPattern][]security.PublicKey |
| } |
| |
| func (r *trustAllRoots) Add(root []byte, pattern security.BlessingPattern) error { |
| key, err := security.UnmarshalPublicKey(root) |
| if err != nil { |
| return err |
| } |
| r.dump[pattern] = append(r.dump[pattern], key) |
| return nil |
| } |
| func (r *trustAllRoots) Recognized(root []byte, blessing string) error { |
| return nil |
| } |
| func (r *trustAllRoots) Dump() map[security.BlessingPattern][]security.PublicKey { |
| return r.dump |
| } |
| func (r *trustAllRoots) DebugString() string { |
| return fmt.Sprintf("%v", r) |
| } |
