diff options
| -rw-r--r-- | moonv4/moon_authz/moon_authz/api/authorization.py | 437 | ||||
| -rw-r--r-- | moonv4/moon_authz/moon_authz/messenger.py | 37 | ||||
| -rw-r--r-- | moonv4/moon_db/moon_db/api/policy.py | 9 | ||||
| -rw-r--r-- | moonv4/moon_interface/moon_interface/tools.py | 1 | ||||
| -rw-r--r-- | moonv4/moon_interface/tests/apitests/scenario/mls.py | 1 | ||||
| -rw-r--r-- | moonv4/moon_interface/tests/apitests/scenario/rbac.py | 7 | ||||
| -rw-r--r-- | moonv4/moon_interface/tests/apitests/set_authz.py | 9 | ||||
| -rw-r--r-- | moonv4/moon_orchestrator/conf/plugins/authz.py | 17 | ||||
| -rw-r--r-- | moonv4/moon_secrouter/moon_secrouter/api/route.py | 192 | ||||
| -rw-r--r-- | moonv4/moon_utilities/moon_utilities/security_functions.py | 120 |
10 files changed, 328 insertions, 502 deletions
diff --git a/moonv4/moon_authz/moon_authz/api/authorization.py b/moonv4/moon_authz/moon_authz/api/authorization.py index 248a9565..5968178e 100644 --- a/moonv4/moon_authz/moon_authz/api/authorization.py +++ b/moonv4/moon_authz/moon_authz/api/authorization.py @@ -3,11 +3,12 @@ # license which can be found in the file 'LICENSE' in this package distribution # or at 'http://www.apache.org/licenses/LICENSE-2.0'. -import copy +import hashlib import itertools from oslo_log import log as logging from oslo_config import cfg -from moon_utilities.security_functions import call, Context +import oslo_messaging +from moon_utilities.security_functions import call, Context, notify from moon_utilities.misc import get_uuid_from_name from moon_utilities import exceptions from moon_db.core import PDPManager @@ -40,11 +41,15 @@ class Authorization(object): meta_rule_id = None keystone_project_id = None - def __init__(self, component_id): - self.component_id = component_id - LOG.info("ext={}".format(component_id)) - for _id_value in component_id.split("_"): - LOG.info("_id_value={}".format(_id_value.split(":"))) + def __init__(self, component_desc): + self.component_id = component_desc + LOG.info("ext={}".format(component_desc)) + self.filter_rule = oslo_messaging.NotificationFilter( + event_type='^authz$', + context={'container_id': "authz_"+hashlib.sha224(component_desc.encode("utf-8")).hexdigest()} + ) + + for _id_value in component_desc.split("_"): _type, _id = _id_value.split(":") if _type == "pdp": self.pdp_id = _id @@ -52,388 +57,80 @@ class Authorization(object): self.meta_rule_id = _id elif _type == "project": self.keystone_project_id = _id - # self.manager = IntraExtensionAdminManager - # self.context = {"id": self.component_id, "user_id": "admin"} - # self.aggregation_algorithm_dict = ConfigurationManager.driver.get_aggregation_algorithms_dict() - # self.__subjects = None - # self.__objects = None - # self.__actions = None - # self.__subject_scopes = None - # self.__object_scopes = None - # self.__action_scopes = None - # self.__subject_categories = None - # self.__object_categories = None - # self.__action_categories = None - # self.__subject_assignments = None - # self.__object_assignments = None - # self.__action_assignments = None - # self.__sub_meta_rules = None - # self.__rules = None - # self.aggregation_algorithm_id = None - - # @property - # def subjects(self): - # if not self.__subjects: - # self.__subjects = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_subjects", args={}) - # if "subjects" in self.__subjects: - # return self.__subjects - # else: - # LOG.error("An error occurred {}".format(self.__subjects)) - # return self.__subjects - # - # @property - # def objects(self): - # if not self.__objects: - # self.__objects = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_objects", args={}) - # if "objects" in self.__objects: - # return self.__objects - # else: - # LOG.error("An error occurred {}".format(self.__objects)) - # return self.__objects - # - # @property - # def actions(self): - # if not self.__actions: - # self.__actions = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_actions", args={}) - # if "actions" in self.__actions: - # return self.__actions - # else: - # LOG.error("An error occurred {}".format(self.__actions)) - # return self.__actions - # - # @property - # def subject_scopes(self): - # if not self.__subject_scopes: - # self.__subject_scopes = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_subject_scopes", args={}) - # if "subject_scopes" in self.__subject_scopes: - # return self.__subject_scopes - # else: - # LOG.error("An error occurred {}".format(self.__subject_scopes)) - # return self.__subject_scopes - # - # @property - # def object_scopes(self): - # if not self.__object_scopes: - # self.__object_scopes = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_object_scopes", args={}) - # if "object_scopes" in self.__object_scopes: - # return self.__object_scopes - # else: - # LOG.error("An error occurred {}".format(self.__object_scopes)) - # return self.__object_scopes - # - # @property - # def action_scopes(self): - # if not self.__action_scopes: - # self.__action_scopes = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_action_scopes", args={}) - # if "action_scopes" in self.__action_scopes: - # return self.__action_scopes - # else: - # LOG.error("An error occurred {}".format(self.__action_scopes)) - # return self.__action_scopes - # - # @property - # def subject_categories(self): - # if not self.__subject_categories: - # self.__subject_categories = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_subject_categories", args={}) - # if "subject_categories" in self.__subject_categories: - # return self.__subject_categories - # else: - # LOG.error("An error occurred {}".format(self.__subject_categories)) - # return self.__subject_categories - # - # @property - # def object_categories(self): - # if not self.__object_categories: - # self.__object_categories = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_object_categories", args={}) - # if "object_categories" in self.__object_categories: - # return self.__object_categories - # else: - # LOG.error("An error occurred {}".format(self.__object_categories)) - # return self.__object_categories - # - # @property - # def action_categories(self): - # if not self.__action_categories: - # self.__action_categories = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_action_categories", args={}) - # if "action_categories" in self.__action_categories: - # return self.__action_categories - # else: - # LOG.error("An error occurred {}".format(self.__action_categories)) - # return self.__action_categories - # - # @property - # def subject_assignments(self): - # if not self.__subject_assignments: - # context = copy.deepcopy(self.context) - # context['sid'] = None - # context['scid'] = None - # args = {'ssid': None} - # self.__subject_assignments = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=context, - # method="get_subject_assignments", args=args) - # if "subject_assignments" in self.__subject_assignments: - # return self.__subject_assignments - # else: - # LOG.error("An error occurred {}".format(self.__subject_assignments)) - # return self.__subject_assignments - # - # @property - # def object_assignments(self): - # if not self.__object_assignments: - # context = copy.deepcopy(self.context) - # context['sid'] = None - # context['scid'] = None - # args = {'ssid': None} - # self.__object_assignments = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=context, - # method="get_object_assignments", args=args) - # if "object_assignments" in self.__object_assignments: - # return self.__object_assignments - # else: - # LOG.error("An error occurred {}".format(self.__object_assignments)) - # return self.__object_assignments - # - # @property - # def action_assignments(self): - # if not self.__action_assignments: - # context = copy.deepcopy(self.context) - # context['sid'] = None - # context['scid'] = None - # args = {'ssid': None} - # self.__action_assignments = call("moon_secpolicy_{}".format(self.intra_extension_id), ctx=context, - # method="get_action_assignments", args=args) - # if "action_assignments" in self.__action_assignments: - # return self.__action_assignments - # else: - # LOG.error("An error occurred {}".format(self.__action_assignments)) - # return self.__action_assignments - # - # @property - # def sub_meta_rules(self): - # if not self.__sub_meta_rules: - # self.__sub_meta_rules = call("moon_secfunction_{}".format(self.intra_extension_id), ctx=self.context, - # method="get_sub_meta_rules", args={}) - # if "sub_meta_rules" in self.__sub_meta_rules: - # return self.__sub_meta_rules - # else: - # LOG.error("An error occurred {}".format(self.__sub_meta_rules)) - # return self.__sub_meta_rules - # - # @property - # def rules(self): - # if not self.__rules: - # self.__rules = dict() - # for _id, _value in self.sub_meta_rules["sub_meta_rules"].items(): - # context = copy.deepcopy(self.context) - # context["sub_meta_rule_id"] = _id - # __elements = call("moon_secfunction_{}".format(self.intra_extension_id), ctx=context, - # method="get_rules", args={}) - # if "rules" in __elements: - # self.__rules[_id] = __elements - # else: - # LOG.error("An error occurred {}".format(__elements)) - # return self.__rules - - # def __get_authz_buffer(self, subject_id, object_id, action_id): - # """ - # :param intra_extension_id: - # :param subject_id: - # :param object_id: - # :param action_id: - # :return: authz_buffer = { - # 'subject_id': xxx, - # 'object_id': yyy, - # 'action_id': zzz, - # 'subject_assignments': { - # 'subject_category1': [], - # 'subject_category2': [], - # ... - # }, - # 'object_assignments': {}, - # 'action_assignments': {}, - # } - # """ - # authz_buffer = dict() - # # Sometimes it is not the subject ID but the User Keystone ID, so, we have to check - # subjects_dict = copy.deepcopy(self.subjects) - # if subject_id not in subjects_dict["subjects"].keys(): - # for _subject_id in subjects_dict["subjects"]: - # if subjects_dict["subjects"][_subject_id]['keystone_id']: - # subject_id = _subject_id - # break - # authz_buffer['subject_id'] = subject_id - # authz_buffer['object_id'] = object_id - # authz_buffer['action_id'] = action_id - # meta_data_dict = dict() - # meta_data_dict["subject_categories"] = copy.deepcopy(self.subject_categories["subject_categories"]) - # meta_data_dict["object_categories"] = copy.deepcopy(self.object_categories["object_categories"]) - # meta_data_dict["action_categories"] = copy.deepcopy(self.action_categories["action_categories"]) - # subject_assignment_dict = copy.deepcopy(self.subject_assignments['subject_assignments'][subject_id]) - # LOG.info("__get_authz_buffer self.object_assignments['object_assignments']={}".format(self.object_assignments['object_assignments'])) - # LOG.info("__get_authz_buffer object_id={}".format(object_id)) - # object_assignment_dict = copy.deepcopy(self.object_assignments['object_assignments'][object_id]) - # action_assignment_dict = copy.deepcopy(self.action_assignments['action_assignments'][action_id]) - # - # authz_buffer['subject_assignments'] = dict() - # authz_buffer['object_assignments'] = dict() - # authz_buffer['action_assignments'] = dict() - # - # for _subject_category in meta_data_dict['subject_categories']: - # authz_buffer['subject_assignments'][_subject_category] = list(subject_assignment_dict[_subject_category]) - # for _object_category in meta_data_dict['object_categories']: - # authz_buffer['object_assignments'][_object_category] = list(object_assignment_dict[_object_category]) - # for _action_category in meta_data_dict['action_categories']: - # authz_buffer['action_assignments'][_action_category] = list(action_assignment_dict[_action_category]) - # return authz_buffer - # - # def __get_decision_dict(self, subject_id, object_id, action_id): - # """Check authorization for a particular action. - # - # :param intra_extension_id: UUID of an IntraExtension - # :param subject_id: subject UUID of the request - # :param object_id: object UUID of the request - # :param action_id: action UUID of the request - # :return: True or False or raise an exception - # :raises: - # """ - # authz_buffer = self.__get_authz_buffer(subject_id, object_id, action_id) - # decision_buffer = dict() - # - # meta_rule_dict = copy.deepcopy(self.sub_meta_rules['sub_meta_rules']) - # rules_dict = copy.deepcopy(self.rules) - # for sub_meta_rule_id in meta_rule_dict: - # if meta_rule_dict[sub_meta_rule_id]['algorithm'] == 'inclusion': - # decision_buffer[sub_meta_rule_id] = algorithms.inclusion( - # authz_buffer, - # meta_rule_dict[sub_meta_rule_id], - # rules_dict[sub_meta_rule_id]['rules'].values()) - # elif meta_rule_dict[sub_meta_rule_id]['algorithm'] == 'comparison': - # decision_buffer[sub_meta_rule_id] = algorithms.comparison( - # authz_buffer, - # meta_rule_dict[sub_meta_rule_id], - # rules_dict[sub_meta_rule_id]['rules'].values()) - # - # return decision_buffer - # - # def __authz(self, subject_id, object_id, action_id): - # decision = False - # decision_dict = dict() - # try: - # decision_dict = self.__get_decision_dict(subject_id, object_id, action_id) - # except (exceptions.SubjectUnknown, exceptions.ObjectUnknown, exceptions.ActionUnknown) as e: - # # maybe we need to synchronize with the master - # pass - # # if CONF.slave.slave_name and CONF.slave.master_url: - # # self.get_data_from_master() - # # decision_dict = self.__get_decision_dict(subject_id, object_id, action_id) - # - # try: - # # aggregation_algorithm_id = IntraExtensionAdminManager.get_aggregation_algorithm_id( - # # "admin", - # # self.intra_extension_id)['aggregation_algorithm'] - # if not self.aggregation_algorithm_id: - # self.aggregation_algorithm_id = self.intra_extension['aggregation_algorithm'] - # except Exception as e: - # LOG.error(e, exc_info=True) - # LOG.error(self.intra_extension) - # return { - # 'authz': False, - # 'comment': "Aggregation algorithm not set" - # } - # if self.aggregation_algorithm_dict[self.aggregation_algorithm_id]['name'] == 'all_true': - # decision = algorithms.all_true(decision_dict) - # elif self.aggregation_algorithm_dict[self.aggregation_algorithm_id]['name'] == 'one_true': - # decision = algorithms.one_true(decision_dict) - # if not decision_dict or not decision: - # raise exceptions.AuthzException("{} {}-{}-{}".format(self.intra_extension['id'], subject_id, action_id, object_id)) - # return { - # 'authz': decision, - # 'comment': "{} {}-{}-{}".format(self.intra_extension['id'], subject_id, action_id, object_id) - # } - # - # def authz_bak(self, ctx, args): - # """Return the authorization for a specific request - # - # :param ctx: { - # "subject_name" : "string name", - # "action_name" : "string name", - # "object_name" : "string name" - # } - # :param args: {} - # :return: { - # "authz": "True or False", - # "message": "optional message" - # } - # """ - # intra_extension_id = ctx["id"] - # try: - # subject_id = get_uuid_from_name(ctx["subject_name"], self.subjects['subjects']) - # object_id = get_uuid_from_name(ctx["object_name"], self.objects['objects']) - # action_id = get_uuid_from_name(ctx["action_name"], self.actions['actions']) - # authz_result = self.__authz(subject_id, object_id, action_id) - # return authz_result - # except Exception as e: - # LOG.error(e, exc_info=True) - # return {"authz": False, - # "error": str(e), - # "intra_extension_id": intra_extension_id, - # "ctx": ctx, "args": args} - # - # return {"authz": False} def __check_rules(self, context): scopes_list = list() - current_header_id = context.headers[context.index]['id'] - current_pdp = context.pdp_set[current_header_id] + current_header_id = context['headers'][context['index']] + current_pdp = context['pdp_set'][current_header_id] category_list = list() category_list.extend(current_pdp["meta_rules"]["subject_categories"]) - category_list.extend(current_pdp["meta_rules"]["action_categories"]) category_list.extend(current_pdp["meta_rules"]["object_categories"]) + category_list.extend(current_pdp["meta_rules"]["action_categories"]) for category in category_list: - if not current_pdp['target'][category]: - LOG.warning("Empty assignment detected: {} target={}".format(category, current_pdp['target'])) - return False, "Empty assignment detected..." + # if not current_pdp['target'][category]: + # LOG.warning("Empty assignment detected: {} target={}".format(category, current_pdp['target'])) scopes_list.append(current_pdp['target'][category]) - scopes_list.append([True, ]) - rules = PolicyManager.get_rules_dict(user_id="admin", - policy_id=self.policy_id, - meta_rule_id=current_header_id).values() + policy_id = PolicyManager.get_policy_from_meta_rules("admin", current_header_id) + rules = PolicyManager.get_rules(user_id="admin", + policy_id=policy_id, + meta_rule_id=current_header_id) + rules = list(map(lambda x: x['rule'], rules['rules'])) for item in itertools.product(*scopes_list): - if list(item) in rules: + req = list(item) + if req in rules: return True, "" LOG.warning("No rule match the request...") return False, "No rule match the request..." - def authz(self, ctx, args): - LOG.info("authz {}".format(ctx)) - keystone_project_id = ctx["id"] + def critical(self, ctxt, publisher_id, event_type, payload, metadata): + """This is the authz endpoint + but due to the oslo_messaging notification architecture, we must call it "critical" + + :param ctxt: context of the request + :param publisher_id: ID of the publisher + :param event_type: type of event ("authz" here) + :param payload: content of the authz request + :param metadata: metadata of the notification + :return: result of the authorization for the current component + """ + LOG.info("authz {} {}".format(ctxt, payload)) + keystone_project_id = payload["id"] try: - if "authz_context" not in ctx: - ctx["authz_context"] = Context(keystone_project_id, - ctx["subject_name"], - ctx["object_name"], - ctx["action_name"], - ctx["request_id"]).to_dict() - LOG.info("Context={}".format(ctx["authz_context"])) + if "authz_context" not in payload: + payload["authz_context"] = Context(keystone_project_id, + payload["subject_name"], + payload["object_name"], + payload["action_name"], + payload["request_id"]).to_dict() + else: + payload["authz_context"]["index"] += 1 + result, message = self.__check_rules(payload["authz_context"]) + current_header_id = payload["authz_context"]['headers'][payload["authz_context"]['index']] + # current_pdp = payload["authz_context"]['pdp_set'][current_header_id] + if result: + payload["authz_context"]['pdp_set'][current_header_id]["effect"] = "grant" + if payload["authz_context"]["index"]+1 < len(payload["authz_context"]["headers"]): + next_index = payload["authz_context"]["index"]+1 + notify( + request_id=payload["authz_context"]["request_id"], + container_id=payload["container_chaining"][next_index], + payload=payload) else: - ctx["authz_context"].index += 1 - result, message = self.__check_rules(ctx["authz_context"]) - # if ctx["authz_context"].index < len(ctx["authz_context"].headers): - del ctx["authz_context"] + ret = call(endpoint="security_router", + ctx={"id": self.component_id, + "call_master": False, + "method": "return_authz", + "request_id": payload["authz_context"]["request_id"]}, + method="route", + args=payload["authz_context"]) + del payload["authz_context"] return {"authz": result, "error": message, "pdp_id": self.pdp_id, - "ctx": ctx, "args": args} + "ctx": ctxt, "args": payload} except Exception as e: try: - LOG.error(ctx["authz_context"]) + LOG.error(payload["authz_context"]) # del ctx["authz_context"] except KeyError: LOG.error("Cannot find \"authz_context\" in context") @@ -441,5 +138,5 @@ class Authorization(object): return {"authz": False, "error": str(e), "pdp_id": self.pdp_id, - "ctx": ctx, "args": args} + "ctx": ctxt, "args": payload} diff --git a/moonv4/moon_authz/moon_authz/messenger.py b/moonv4/moon_authz/moon_authz/messenger.py index 8ebd1633..6fa34770 100644 --- a/moonv4/moon_authz/moon_authz/messenger.py +++ b/moonv4/moon_authz/moon_authz/messenger.py @@ -5,12 +5,10 @@ from oslo_config import cfg import oslo_messaging -import hashlib import time from oslo_log import log as logging from moon_authz.api.generic import Status, Logs from moon_authz.api.authorization import Authorization -from moon_utilities.security_functions import call from moon_utilities.api import APIList LOG = logging.getLogger(__name__) @@ -20,44 +18,33 @@ CONF = cfg.CONF class Server: def __init__(self, component_id, keystone_project_id): - self.TOPIC = "authz_"+hashlib.sha224(component_id.encode("utf-8")).hexdigest() - self.transport = oslo_messaging.get_transport(cfg.CONF) - self.target = oslo_messaging.Target(topic=self.TOPIC, server='moon_authz_server1') - # ctx = {'user_id': 'admin', 'id': component_id, 'method': 'get_intra_extensions'} - # if CONF.slave.slave_name: - # ctx['call_master'] = True - # intra_extension = call( - # endpoint="security_router", - # ctx=ctx, - # method='route', - # args={} - # ) - # if "intra_extensions" not in intra_extension: - # LOG.error("Error reading intra_extension from router") - # LOG.error("intra_extension: {}".format(intra_extension)) - # raise IntraExtensionUnknown - # component_id = list(intra_extension["intra_extensions"].keys())[0] - LOG.info("Starting MQ server with topic: {}".format(self.TOPIC)) + self.TOPIC = "authz-workers" + transport = oslo_messaging.get_notification_transport(cfg.CONF) + targets = [ + oslo_messaging.Target(topic=self.TOPIC), + ] self.endpoints = [ APIList((Status, Logs)), Status(), Logs(), Authorization(component_id) ] - self.server = oslo_messaging.get_rpc_server(self.transport, self.target, self.endpoints, - executor='threading', - access_policy=oslo_messaging.DefaultRPCAccessPolicy) + pool = "authz-workers" + self.server = oslo_messaging.get_notification_listener(transport, targets, + self.endpoints, executor='threading', + pool=pool) + LOG.info("Starting MQ notification server with topic: {}".format(self.TOPIC)) def run(self): try: self.server.start() while True: - time.sleep(1) + time.sleep(0.1) except KeyboardInterrupt: print("Stopping server by crtl+c") except SystemExit: print("Stopping server") self.server.stop() - self.server.wait() + diff --git a/moonv4/moon_db/moon_db/api/policy.py b/moonv4/moon_db/moon_db/api/policy.py index 73889b85..0beaf78f 100644 --- a/moonv4/moon_db/moon_db/api/policy.py +++ b/moonv4/moon_db/moon_db/api/policy.py @@ -28,6 +28,15 @@ class PolicyManager(Managers): self.driver = connector.driver Managers.PolicyManager = self + def get_policy_from_meta_rules(self, user_id, meta_rule_id): + policies = self.PolicyManager.get_policies("admin") + models = self.ModelManager.get_models("admin") + for pdp_key, pdp_value in self.PDPManager.get_pdp(user_id).items(): + for policy_id in pdp_value["security_pipeline"]: + model_id = policies[policy_id]["model_id"] + if meta_rule_id in models[model_id]["meta_rules"]: + return policy_id + @enforce(("read", "write"), "policies") def update_policy(self, user_id, policy_id, value): return self.driver.update_policy(policy_id=policy_id, value=value) diff --git a/moonv4/moon_interface/moon_interface/tools.py b/moonv4/moon_interface/moon_interface/tools.py index 3c0fffa5..443519ac 100644 --- a/moonv4/moon_interface/moon_interface/tools.py +++ b/moonv4/moon_interface/moon_interface/tools.py @@ -29,7 +29,6 @@ def timeit(function): return wrapper -@timeit def call(topic="security_router", ctx=None, method="route", **kwargs): if not ctx: ctx = dict() diff --git a/moonv4/moon_interface/tests/apitests/scenario/mls.py b/moonv4/moon_interface/tests/apitests/scenario/mls.py index fab1d528..e36a86bc 100644 --- a/moonv4/moon_interface/tests/apitests/scenario/mls.py +++ b/moonv4/moon_interface/tests/apitests/scenario/mls.py @@ -39,6 +39,7 @@ meta_rule = { rules = { "mls": ( ("high", "medium", "vm-action"), + ("high", "low", "vm-action"), ("medium", "low", "vm-action"), ) } diff --git a/moonv4/moon_interface/tests/apitests/scenario/rbac.py b/moonv4/moon_interface/tests/apitests/scenario/rbac.py index 073f1d65..cd08308e 100644 --- a/moonv4/moon_interface/tests/apitests/scenario/rbac.py +++ b/moonv4/moon_interface/tests/apitests/scenario/rbac.py @@ -4,7 +4,7 @@ policy_name = "RBAC policy example" model_name = "RBAC" subjects = {"user0": "", "user1": "", } -objects = {"vm0": "", } +objects = {"vm0": "", "vm1": "", } actions = {"start": "", "stop": ""} subject_categories = {"role": "", } @@ -12,11 +12,11 @@ object_categories = {"id": "", } action_categories = {"action-type": "", } subject_data = {"role": {"admin": "", "employee": ""}} -object_data = {"id": {"vm1": "", "vm2": ""}} +object_data = {"id": {"vm0": "", "vm1": ""}} action_data = {"action-type": {"vm-action": "", }} subject_assignments = {"user0": {"role": "admin"}, "user1": {"role": "employee"}, } -object_assignments = {"vm0": {"id": "vm1"}} +object_assignments = {"vm0": {"id": "vm0"}, "vm1": {"id": "vm1"}} action_assignments = {"start": {"action-type": "vm-action"}, "stop": {"action-type": "vm-action"}} meta_rule = { @@ -25,6 +25,7 @@ meta_rule = { rules = { "rbac": ( + ("admin", "vm0", "vm-action"), ("admin", "vm1", "vm-action"), ) } diff --git a/moonv4/moon_interface/tests/apitests/set_authz.py b/moonv4/moon_interface/tests/apitests/set_authz.py index 7d0d5069..38b63509 100644 --- a/moonv4/moon_interface/tests/apitests/set_authz.py +++ b/moonv4/moon_interface/tests/apitests/set_authz.py @@ -40,4 +40,11 @@ if not keystone_project_id: for rule in rules: url = "http://172.18.0.11:38001/authz/{}/{}".format(keystone_project_id, "/".join(rule)) req = requests.get(url) - print(url, req.status_code) + print("\033[1m{}\033[m {}".format(url, req.status_code)) + j = req.json() + # print(j) + if j.get("authz"): + print("\t\033[32m{}\033[m {}".format(j.get("authz"), j.get("error", ""))) + else: + print("\t\033[31m{}\033[m {}".format(j.get("authz"), j.get("error", ""))) + diff --git a/moonv4/moon_orchestrator/conf/plugins/authz.py b/moonv4/moon_orchestrator/conf/plugins/authz.py index c472b36a..4a1441c9 100644 --- a/moonv4/moon_orchestrator/conf/plugins/authz.py +++ b/moonv4/moon_orchestrator/conf/plugins/authz.py @@ -47,16 +47,17 @@ RUN pip3 install . ) # note(asteroide): time to let the new docker boot time.sleep(3) - self.get_status() + # self.get_status() def get_status(self): - transport = oslo_messaging.get_transport(CONF) - target = oslo_messaging.Target(topic=self.id, version='1.0') - client = oslo_messaging.RPCClient(transport, target) - LOG.info("Calling Status on {}".format(self.id)) - ret = client.call({"component_id": self.id}, 'get_status', args=None) - LOG.info(ret) - return ret + return True + # transport = oslo_messaging.get_transport(CONF) + # target = oslo_messaging.Target(topic=self.id, version='1.0') + # client = oslo_messaging.RPCClient(transport, target) + # LOG.info("Calling Status on {}".format(self.id)) + # ret = client.call({"component_id": self.id}, 'get_status', args=None) + # LOG.info(ret) + # return ret def run(uuid, conf_file="", docker=None, network_config=None): diff --git a/moonv4/moon_secrouter/moon_secrouter/api/route.py b/moonv4/moon_secrouter/moon_secrouter/api/route.py index ec79d96b..ccdff08b 100644 --- a/moonv4/moon_secrouter/moon_secrouter/api/route.py +++ b/moonv4/moon_secrouter/moon_secrouter/api/route.py @@ -5,8 +5,10 @@ import copy import time +import itertools +from uuid import uuid4 from oslo_log import log as logging -from moon_utilities.security_functions import call +from moon_utilities.security_functions import call, notify from oslo_config import cfg from moon_secrouter.api.generic import Status, Logs @@ -90,6 +92,7 @@ API = { ), "function": ( "authz", + "return_authz", ), } @@ -97,18 +100,109 @@ API = { class Cache(object): # TODO (asteroide): set cache integer in CONF file - __UPDATE_INTERVAL = 300 + __UPDATE_INTERVAL = 10 + __CONTAINERS = {} - __LAST_UPDATE = 0 + __CONTAINERS_UPDATE = 0 + + __CONTAINER_CHAINING_UPDATE = 0 + __CONTAINER_CHAINING = {} + + __PDP = {} + __PDP_UPDATE = 0 + + __POLICIES = {} + __POLICIES_UPDATE = 0 + + __MODELS = {} + __MODELS_UPDATE = 0 + + __AUTHZ_REQUESTS = {} + + def update(self, component=None): + self.__update_container() + self.__update_pdp() + self.__update_policies() + self.__update_models() + for key, value in self.__PDP.items(): + self.__update_container_chaining(value["keystone_project_id"]) + + @property + def authz_requests(self): + return self.__AUTHZ_REQUESTS + + def __update_pdp(self): + pdp = call("moon_manager", method="get_pdp", ctx={"user_id": "admin"}, args={}) + for _pdp in pdp["pdps"].values(): + if _pdp['keystone_project_id'] not in self.__CONTAINER_CHAINING: + self.__CONTAINER_CHAINING[_pdp['keystone_project_id']] = {} + # Note (asteroide): force update of chaining + self.__update_container_chaining(_pdp['keystone_project_id']) + for key, value in pdp["pdps"].items(): + self.__PDP[key] = value + + @property + def pdp(self): + current_time = time.time() + if self.__PDP_UPDATE + self.__UPDATE_INTERVAL < current_time: + self.__update_pdp() + self.__PDP_UPDATE = current_time + return self.__PDP + + def __update_policies(self): + policies = call("moon_manager", method="get_policies", ctx={"user_id": "admin"}, args={}) + for key, value in policies["policies"].items(): + self.__POLICIES[key] = value + + @property + def policies(self): + current_time = time.time() + if self.__POLICIES_UPDATE + self.__UPDATE_INTERVAL < current_time: + self.__update_policies() + self.__POLICIES_UPDATE = current_time + return self.__POLICIES + + def __update_models(self): + models = call("moon_manager", method="get_models", ctx={"user_id": "admin"}, args={}) + for key, value in models["models"].items(): + self.__MODELS[key] = value + + @property + def models(self): + current_time = time.time() + if self.__MODELS_UPDATE + self.__UPDATE_INTERVAL < current_time: + self.__update_models() + self.__MODELS_UPDATE = current_time + return self.__MODELS def __update_container(self): containers = call("orchestrator", method="get_container", ctx={}, args={}) - LOG.info("container={}".format(containers)) for key, value in containers["containers"].items(): self.__CONTAINERS[key] = value - def update(self, component=None): - self.__update_container() + @property + def container_chaining(self): + current_time = time.time() + if self.__CONTAINER_CHAINING_UPDATE + self.__UPDATE_INTERVAL < current_time: + for key, value in self.pdp.items(): + self.__update_container_chaining(value["keystone_project_id"]) + self.__CONTAINER_CHAINING_UPDATE = current_time + return self.__CONTAINER_CHAINING + + def __update_container_chaining(self, keystone_project_id): + container_ids = [] + for pdp_id, pdp_value, in CACHE.pdp.items(): + if pdp_value: + if pdp_value["keystone_project_id"] == keystone_project_id: + for policy_id in pdp_value["security_pipeline"]: + model_id = CACHE.policies[policy_id]['model_id'] + for meta_rule_id in CACHE.models[model_id]["meta_rules"]: + for container_id, container_values, in CACHE.containers.items(): + for container_value in container_values: + if container_value["meta_rule_id"] == meta_rule_id: + container_ids.append(container_value["container_id"]) + break + self.__CONTAINER_CHAINING[keystone_project_id] = container_ids @property def containers(self): @@ -121,21 +215,65 @@ class Cache(object): :return: """ current_time = time.time() - if self.__LAST_UPDATE + self.__UPDATE_INTERVAL < current_time: + if self.__CONTAINERS_UPDATE + self.__UPDATE_INTERVAL < current_time: self.__update_container() - self.__LAST_UPDATE = current_time + self.__CONTAINERS_UPDATE = current_time return self.__CONTAINERS CACHE = Cache() +class AuthzRequest: + + result = None + req_max_delay = 5 + + def __init__(self, ctx, args): + self.ctx = ctx + self.args = args + self.request_id = ctx["request_id"] + self.container_chaining = CACHE.container_chaining[self.ctx['id']] + ctx["container_chaining"] = copy.deepcopy(self.container_chaining) + self.pdp_container = str(self.container_chaining[0]) + self.run() + + def run(self): + notify(request_id=self.request_id, container_id=self.pdp_container, payload=self.ctx) + cpt = 0 + while cpt < self.req_max_delay*10: + time.sleep(0.1) + cpt += 1 + if CACHE.authz_requests[self.request_id]: + self.result = CACHE.authz_requests[self.request_id] + return + LOG.warning("Request {} has timed out".format(self.request_id)) + + def is_authz(self): + if not self.result: + return False + authz_results = [] + for key in self.result["pdp_set"]: + if "effect" in self.result["pdp_set"][key]: + if self.result["pdp_set"][key]["effect"] == "grant": + authz_results.append(True) + else: + authz_results.append(False) + if list(itertools.accumulate(authz_results, lambda x, y: x & y))[-1]: + self.result["pdp_set"]["effect"] = "grant" + if self.result: + if "pdp_set" in self.result and self.result["pdp_set"]["effect"] == "grant": + return True + return False + + class Router(object): """ Route requests to all components. """ __version__ = "0.1.0" + cache_requests = {} def __init__(self, add_master_cnx): if CONF.slave.slave_name and add_master_cnx: @@ -179,13 +317,6 @@ class Router(object): LOG.info(result) @staticmethod - def __get_first_container(keystone_project_id): - for container_id, container_value, in CACHE.containers.items(): - if container_value: - if container_value[0]["keystone_project_id"] == keystone_project_id: - return container_value[0]["container_id"] - - @staticmethod def check_pdp(ctx): _ctx = copy.deepcopy(ctx) if CONF.slave.slave_name: @@ -228,21 +359,32 @@ class Router(object): if component == "orchestrator": return call(component, method=ctx["method"], ctx=ctx, args=args) if component == "manager": - LOG.info("Call Manager {}".format(ctx)) result = call("moon_manager", method=ctx["method"], ctx=ctx, args=args) self.send_update(api=ctx["method"], ctx=ctx, args=args) return result if component == "function": - if self.check_pdp(ctx): - LOG.info("Tenant ID={}".format(ctx['id'])) - pdp_container = self.__get_first_container(ctx['id']) - LOG.info("pdp_container={}".format(pdp_container)) - # TODO (asteroide): call the first security function through a notification - # and not an RPC call (need to play with ID in context) - result = call(pdp_container, method=ctx["method"], ctx=ctx, args=args) - return result + if ctx["method"] == "return_authz": + request_id = ctx["request_id"] + CACHE.authz_requests[request_id] = args + return args + elif self.check_pdp(ctx): + req_id = uuid4().hex + CACHE.authz_requests[req_id] = {} + ctx["request_id"] = req_id + req = AuthzRequest(ctx, args) + # result = copy.deepcopy(req.result) + if req.is_authz(): + return {"authz": True, + "pdp_id": ctx["id"], + "ctx": ctx, "args": args} + return {"authz": False, + "error": {'code': 403, 'title': 'Authz Error', + 'description': "The authz request is refused."}, + "pdp_id": ctx["id"], + "ctx": ctx, "args": args} return {"result": False, - "error": {'code': 500, 'title': 'Moon Error', 'description': "Function component not found."}, + "error": {'code': 500, 'title': 'Moon Error', + 'description': "Function component not found."}, "pdp_id": ctx["id"], "ctx": ctx, "args": args} diff --git a/moonv4/moon_utilities/moon_utilities/security_functions.py b/moonv4/moon_utilities/moon_utilities/security_functions.py index 2ad52a4c..f7cbdf2c 100644 --- a/moonv4/moon_utilities/moon_utilities/security_functions.py +++ b/moonv4/moon_utilities/moon_utilities/security_functions.py @@ -8,13 +8,10 @@ import copy import re import types import requests -from uuid import uuid4 from oslo_log import log as logging from oslo_config import cfg import oslo_messaging from moon_utilities import exceptions -from oslo_config.cfg import ConfigOpts -# from moon_db.core import PDPManager, ModelManager, PolicyManager LOG = logging.getLogger(__name__) CONF = cfg.CONF @@ -158,6 +155,22 @@ def logout(headers, url=None): __transport_master = oslo_messaging.get_transport(cfg.CONF, CONF.slave.master_url) __transport = oslo_messaging.get_transport(CONF) +__n_transport = oslo_messaging.get_notification_transport(CONF) +__n_notifier = oslo_messaging.Notifier(__n_transport, + 'router.host', + driver='messagingv2', + topics=['authz-workers']) +__n_notifier = __n_notifier.prepare(publisher_id='router') + + +def notify(request_id, container_id, payload, event_type="authz"): + ctxt = { + 'request_id': request_id, + 'container_id': container_id + } + result = __n_notifier.critical(ctxt, event_type, payload=payload) + return result + def call(endpoint, ctx=None, method="get_status", **kwargs): if not ctx: @@ -183,13 +196,11 @@ class Context: self.__keystone_project_id = _keystone_project_id self.__pdp_id = None self.__pdp_value = None - LOG.info("Context pdp={}".format(PDPManager.get_pdp("admin"))) for _pdp_key, _pdp_value in PDPManager.get_pdp("admin").items(): if _pdp_value["keystone_project_id"] == _keystone_project_id: self.__pdp_id = _pdp_key self.__pdp_value = copy.deepcopy(_pdp_value) break - LOG.info("Context pdp_value={}".format(self.__pdp_value)) self.__subject = _subject self.__object = _object self.__action = _action @@ -200,29 +211,11 @@ class Context: self.__headers = [] policies = PolicyManager.get_policies("admin") models = ModelManager.get_models("admin") - LOG.info("Context policies={}".format(policies)) - LOG.info("Context models={}".format(models)) for policy_id in self.__pdp_value["security_pipeline"]: model_id = policies[policy_id]["model_id"] for meta_rule in models[model_id]["meta_rules"]: self.__headers.append(meta_rule) self.__meta_rules = ModelManager.get_meta_rules("admin") - LOG.info("Context meta_rules={}".format(self.__meta_rules)) - LOG.info("Context headers={}".format(self.__headers)) - # call("moon_manager", - # method="get_meta_rules", - # ctx={"id": self.__intra_extension_id, - # "user_id": "admin", - # "method": "get_sub_meta_rules"}, - # args={})["sub_meta_rules"] - # for key in self.__intra_extension["pdp_pipeline"]: - # LOG.info("__meta_rules={}".format(self.__meta_rules)) - # for meta_rule_key in self.__meta_rules: - # if self.__meta_rules[meta_rule_key]['name'] == key.split(":", maxsplit=1)[-1]: - # self.__headers.append({"name": self.__meta_rules[meta_rule_key]['name'], "id": meta_rule_key}) - # break - # else: - # LOG.warning("Cannot find meta_rule_key {}".format(key)) self.__pdp_set = {} self.__init_pdp_set() @@ -254,59 +247,36 @@ class Context: for header in self.__headers: self.__pdp_set[header] = dict() self.__pdp_set[header]["meta_rules"] = self.__meta_rules[header] - self.__pdp_set[header]["target"] = self.__add_target() + self.__pdp_set[header]["target"] = self.__add_target(header) # TODO (asteroide): the following information must be retrieve somewhere self.__pdp_set[header]["instruction"] = list() - self.__pdp_set[header]["effect"] = "grant" - self.__pdp_set["effect"] = "grant" + self.__pdp_set[header]["effect"] = "deny" + self.__pdp_set["effect"] = "deny" - def __add_target(self): + def __add_target(self, meta_rule_id): result = dict() _subject = self.__current_request["subject"] _object = self.__current_request["object"] _action = self.__current_request["action"] - categories = self.ModelManager.get_subject_categories("admin") - # TODO (asteroide): end the dev of that part - # for category in categories: - # result[category] = list() - # assignments = call("moon_secpolicy_{}".format(self.__intra_extension_id), - # method="get_subject_assignments", - # ctx={"id": self.__intra_extension_id, - # "sid": _subject, - # "scid": category, - # "user_id": "admin"}, - # args={})["subject_assignments"] - # result[category].extend(assignments[_subject][category]) - # categories = call("moon_secpolicy_{}".format(self.__intra_extension_id), - # method="get_object_categories", - # ctx={"id": self.__intra_extension_id, - # "user_id": "admin"}, - # args={})["object_categories"] - # for category in categories: - # result[category] = list() - # assignments = call("moon_secpolicy_{}".format(self.__intra_extension_id), - # method="get_object_assignments", - # ctx={"id": self.__intra_extension_id, - # "sid": _object, - # "scid": category, - # "user_id": "admin"}, - # args={})["object_assignments"] - # result[category].extend(assignments[_object][category]) - # categories = call("moon_secpolicy_{}".format(self.__intra_extension_id), - # method="get_action_categories", - # ctx={"id": self.__intra_extension_id, - # "user_id": "admin"}, - # args={})["action_categories"] - # for category in categories: - # result[category] = list() - # assignments = call("moon_secpolicy_{}".format(self.__intra_extension_id), - # method="get_action_assignments", - # ctx={"id": self.__intra_extension_id, - # "sid": _action, - # "scid": category, - # "user_id": "admin"}, - # args={})["action_assignments"] - # result[category].extend(assignments[_action][category]) + meta_rules = self.ModelManager.get_meta_rules("admin") + for header in self.__headers: + policy_id = self.PolicyManager.get_policy_from_meta_rules("admin", header) + for meta_rule_id in meta_rules: + for sub_cat in meta_rules[meta_rule_id]['subject_categories']: + if sub_cat not in result: + result[sub_cat] = [] + for assign in self.PolicyManager.get_subject_assignments("admin", policy_id, _subject, sub_cat).values(): + result[sub_cat].extend(assign["assignments"]) + for obj_cat in meta_rules[meta_rule_id]['object_categories']: + if obj_cat not in result: + result[obj_cat] = [] + for assign in self.PolicyManager.get_object_assignments("admin", policy_id, _object, obj_cat).values(): + result[obj_cat].extend(assign["assignments"]) + for act_cat in meta_rules[meta_rule_id]['action_categories']: + if act_cat not in result: + result[act_cat] = [] + for assign in self.PolicyManager.get_action_assignments("admin", policy_id, _action, act_cat).values(): + result[act_cat].extend(assign["assignments"]) return result def __repr__(self): @@ -336,6 +306,18 @@ pdp_set: {pdp_set} } @property + def request_id(self): + return self.__request_id + + @request_id.setter + def request_id(self, value): + raise Exception("You cannot update the request_id") + + @request_id.deleter + def request_id(self): + raise Exception("You cannot update the request_id") + + @property def initial_request(self): return { "subject": self.__subject, |