mirror of
https://github.com/hanzozt/zt.git
synced 2026-10-30 15:04:55 +00:00
Andrew MartinezandGitHub
bb5cc51a97
* adds posture cache, instance, instance data, and event hooks - reworks router security - abstracts api session and service sessions - use connection tracker instead of various maps - doc - adds service sessions as always JWTs - addes token logging fields - removes multiple connection tracking fields - adds support for router specific posture data/respones - adds support for router posture check evaluation - defer dial/bind posture checking for legacy to controller - fix double session event emitting - fix session event missing id
68 lines
1.9 KiB
Go
68 lines
1.9 KiB
Go
package posture
|
|
|
|
import (
|
|
"fmt"
|
|
"github.com/michaelquigley/pfxlog"
|
|
"github.com/openziti/ziti/common"
|
|
"github.com/openziti/ziti/common/eid"
|
|
"github.com/openziti/ziti/common/pb/edge_ctrl_pb"
|
|
)
|
|
|
|
func HasAccess(rdm *common.RouterDataModel, identityId string, serviceId string, data *InstanceData, policyType edge_ctrl_pb.PolicyType) (*common.ServicePolicy, error) {
|
|
log := pfxlog.Logger().WithField("instance", eid.New()).WithField("identityId", identityId).WithField("serviceId", serviceId)
|
|
|
|
accessPolicies, err := rdm.GetServiceAccessPolicies(identityId, serviceId, policyType)
|
|
|
|
if err != nil {
|
|
log.WithError(err).Debug("could not find access path for authorization checks")
|
|
return nil, err
|
|
}
|
|
|
|
if accessPolicies == nil || len(accessPolicies.Policies) == 0 {
|
|
return nil, &NoPoliciesError{}
|
|
}
|
|
|
|
grantingPolicy, errs := IsPassing(accessPolicies, data)
|
|
|
|
if errs != nil && len(*errs) > 0 {
|
|
log.Debug("policies provided access but posture checks failed")
|
|
return nil, errs
|
|
}
|
|
|
|
log.Debugf("access provided via policy %s [%s]", grantingPolicy.Name, grantingPolicy.Id)
|
|
return grantingPolicy, nil
|
|
}
|
|
|
|
func IsPassing(accessPolicies *common.AccessPolicies, data *InstanceData) (*common.ServicePolicy, *PolicyAccessErrors) {
|
|
errs := &PolicyAccessErrors{}
|
|
|
|
for _, policy := range accessPolicies.Policies {
|
|
policyErr := &PolicyAccessError{
|
|
Id: policy.Id,
|
|
Name: policy.Name,
|
|
Errors: []error{},
|
|
}
|
|
|
|
policy.PostureChecks.IterCb(func(postureCheckId string, _ struct{}) {
|
|
postureCheck, ok := accessPolicies.PostureChecks[postureCheckId]
|
|
|
|
if !ok || postureCheck == nil {
|
|
policyErr.Errors = append(policyErr.Errors, fmt.Errorf("posture check id %s not found model", postureCheckId))
|
|
return
|
|
}
|
|
|
|
if err := EvaluatePostureCheck(postureCheck, data); err != nil {
|
|
policyErr.Errors = append(policyErr.Errors, err)
|
|
}
|
|
})
|
|
|
|
if len(policyErr.Errors) == 0 {
|
|
return policy, nil
|
|
} else {
|
|
*errs = append(*errs, policyErr)
|
|
}
|
|
}
|
|
|
|
return nil, errs
|
|
}
|