Search in sources :

Example 16 with AuthDecision

use of io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision in project grpc-java by grpc.

the class RbacFilterTest method ipPortParser.

@Test
@SuppressWarnings({ "unchecked", "deprecation" })
public void ipPortParser() {
    CidrRange cidrRange = CidrRange.newBuilder().setAddressPrefix("10.10.10.0").setPrefixLen(UInt32Value.of(24)).build();
    List<Permission> permissionList = Arrays.asList(Permission.newBuilder().setAndRules(Permission.Set.newBuilder().addRules(Permission.newBuilder().setDestinationIp(cidrRange).build()).addRules(Permission.newBuilder().setDestinationPort(9090).build()).build()).build());
    List<Principal> principalList = Arrays.asList(Principal.newBuilder().setAndIds(Principal.Set.newBuilder().addIds(Principal.newBuilder().setDirectRemoteIp(cidrRange).build()).addIds(Principal.newBuilder().setRemoteIp(cidrRange).build()).addIds(Principal.newBuilder().setSourceIp(cidrRange).build()).build()).build());
    ConfigOrError<?> result = parseRaw(permissionList, principalList);
    assertThat(result.errorDetail).isNull();
    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    Attributes attributes = Attributes.newBuilder().set(Grpc.TRANSPORT_ATTR_REMOTE_ADDR, new InetSocketAddress("10.10.10.0", 1)).set(Grpc.TRANSPORT_ATTR_LOCAL_ADDR, new InetSocketAddress("10.10.10.0", 9090)).build();
    when(serverCall.getAttributes()).thenReturn(attributes);
    when(serverCall.getMethodDescriptor()).thenReturn(method().build());
    GrpcAuthorizationEngine engine = new GrpcAuthorizationEngine(((RbacConfig) result.config).authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.DENY);
}
Also used : AuthDecision(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision) CidrRange(io.envoyproxy.envoy.config.core.v3.CidrRange) InetSocketAddress(java.net.InetSocketAddress) Attributes(io.grpc.Attributes) Metadata(io.grpc.Metadata) GrpcAuthorizationEngine(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine) Permission(io.envoyproxy.envoy.config.rbac.v3.Permission) Principal(io.envoyproxy.envoy.config.rbac.v3.Principal) Test(org.junit.Test)

Aggregations

AuthDecision (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision)16 Test (org.junit.Test)15 Metadata (io.grpc.Metadata)9 OrMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.OrMatcher)9 PolicyMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PolicyMatcher)9 GrpcAuthorizationEngine (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine)7 Permission (io.envoyproxy.envoy.config.rbac.v3.Permission)6 Principal (io.envoyproxy.envoy.config.rbac.v3.Principal)6 AuthHeaderMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher)6 Attributes (io.grpc.Attributes)5 InetSocketAddress (java.net.InetSocketAddress)4 PathMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PathMatcher)3 CidrMatcher (io.grpc.xds.internal.Matchers.CidrMatcher)2 AuthenticatedMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthenticatedMatcher)2 DestinationIpMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.DestinationIpMatcher)2 X509Certificate (java.security.cert.X509Certificate)2 CidrRange (io.envoyproxy.envoy.config.core.v3.CidrRange)1 HeaderMatcher (io.envoyproxy.envoy.config.route.v3.HeaderMatcher)1 MetadataMatcher (io.envoyproxy.envoy.type.matcher.v3.MetadataMatcher)1 PathMatcher (io.envoyproxy.envoy.type.matcher.v3.PathMatcher)1