Search in sources :

Example 6 with AuthHeaderMatcher

use of io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher in project grpc-java by grpc.

the class GrpcAuthorizationEngineTest method matchersEqualHashcode.

@Test
public void matchersEqualHashcode() throws Exception {
    PathMatcher pathMatcher = PathMatcher.create(STRING_MATCHER);
    AuthHeaderMatcher headerMatcher = AuthHeaderMatcher.create(Matchers.HeaderMatcher.forExactValue("foo", "bar", true));
    DestinationIpMatcher destinationIpMatcher = DestinationIpMatcher.create(CidrMatcher.create(InetAddress.getByName(IP_ADDR1), 24));
    DestinationPortMatcher destinationPortMatcher = DestinationPortMatcher.create(PORT);
    GrpcAuthorizationEngine.DestinationPortRangeMatcher portRangeMatcher = GrpcAuthorizationEngine.DestinationPortRangeMatcher.create(PORT, PORT + 1);
    InvertMatcher invertMatcher = InvertMatcher.create(portRangeMatcher);
    GrpcAuthorizationEngine.RequestedServerNameMatcher requestedServerNameMatcher = GrpcAuthorizationEngine.RequestedServerNameMatcher.create(STRING_MATCHER);
    OrMatcher permission = OrMatcher.create(pathMatcher, headerMatcher, destinationIpMatcher, destinationPortMatcher, invertMatcher, requestedServerNameMatcher);
    AuthenticatedMatcher authenticatedMatcher = AuthenticatedMatcher.create(STRING_MATCHER);
    SourceIpMatcher sourceIpMatcher1 = SourceIpMatcher.create(CidrMatcher.create(InetAddress.getByName(IP_ADDR1), 24));
    OrMatcher principal = OrMatcher.create(authenticatedMatcher, AndMatcher.create(sourceIpMatcher1, AlwaysTrueMatcher.INSTANCE));
    PolicyMatcher policyMatcher1 = PolicyMatcher.create("match", permission, principal);
    AuthConfig config1 = AuthConfig.create(Collections.singletonList(policyMatcher1), Action.ALLOW);
    PathMatcher pathMatcher2 = PathMatcher.create(STRING_MATCHER);
    AuthHeaderMatcher headerMatcher2 = AuthHeaderMatcher.create(Matchers.HeaderMatcher.forExactValue("foo", "bar", true));
    DestinationIpMatcher destinationIpMatcher2 = DestinationIpMatcher.create(CidrMatcher.create(InetAddress.getByName(IP_ADDR1), 24));
    DestinationPortMatcher destinationPortMatcher2 = DestinationPortMatcher.create(PORT);
    GrpcAuthorizationEngine.DestinationPortRangeMatcher portRangeMatcher2 = GrpcAuthorizationEngine.DestinationPortRangeMatcher.create(PORT, PORT + 1);
    InvertMatcher invertMatcher2 = InvertMatcher.create(portRangeMatcher2);
    GrpcAuthorizationEngine.RequestedServerNameMatcher requestedServerNameMatcher2 = GrpcAuthorizationEngine.RequestedServerNameMatcher.create(STRING_MATCHER);
    OrMatcher permission2 = OrMatcher.create(pathMatcher2, headerMatcher2, destinationIpMatcher2, destinationPortMatcher2, invertMatcher2, requestedServerNameMatcher2);
    AuthenticatedMatcher authenticatedMatcher2 = AuthenticatedMatcher.create(STRING_MATCHER);
    SourceIpMatcher sourceIpMatcher2 = SourceIpMatcher.create(CidrMatcher.create(InetAddress.getByName(IP_ADDR1), 24));
    OrMatcher principal2 = OrMatcher.create(authenticatedMatcher2, AndMatcher.create(sourceIpMatcher2, AlwaysTrueMatcher.INSTANCE));
    PolicyMatcher policyMatcher2 = PolicyMatcher.create("match", permission2, principal2);
    AuthConfig config2 = AuthConfig.create(Collections.singletonList(policyMatcher2), Action.ALLOW);
    assertThat(config1).isEqualTo(config2);
    assertThat(config1.hashCode()).isEqualTo(config2.hashCode());
}
Also used : SourceIpMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.SourceIpMatcher) AuthHeaderMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher) AuthConfig(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthConfig) DestinationPortMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.DestinationPortMatcher) PolicyMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PolicyMatcher) AuthenticatedMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthenticatedMatcher) PathMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PathMatcher) InvertMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.InvertMatcher) DestinationIpMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.DestinationIpMatcher) OrMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.OrMatcher) Test(org.junit.Test)

Example 7 with AuthHeaderMatcher

use of io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher in project grpc-java by grpc.

the class GrpcAuthorizationEngineTest method headerMatcher_aliasAuthorityAndHost.

@Test
public void headerMatcher_aliasAuthorityAndHost() {
    AuthHeaderMatcher headerMatcher = AuthHeaderMatcher.create(Matchers.HeaderMatcher.forExactValue("Host", "google.com", false));
    OrMatcher principal = OrMatcher.create(headerMatcher);
    OrMatcher permission = OrMatcher.create(InvertMatcher.create(DestinationPortMatcher.create(PORT + 1)));
    PolicyMatcher policyMatcher = PolicyMatcher.create(POLICY_NAME, permission, principal);
    GrpcAuthorizationEngine engine = new GrpcAuthorizationEngine(AuthConfig.create(Collections.singletonList(policyMatcher), Action.ALLOW));
    when(serverCall.getAuthority()).thenReturn("google.com");
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    assertThat(decision.decision()).isEqualTo(Action.ALLOW);
    assertThat(decision.matchingPolicyName()).isEqualTo(POLICY_NAME);
}
Also used : AuthDecision(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision) OrMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.OrMatcher) Metadata(io.grpc.Metadata) AuthHeaderMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher) PolicyMatcher(io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PolicyMatcher) Test(org.junit.Test)

Aggregations

AuthHeaderMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthHeaderMatcher)7 OrMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.OrMatcher)7 PolicyMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PolicyMatcher)7 Test (org.junit.Test)7 AuthDecision (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision)6 Metadata (io.grpc.Metadata)3 AuthenticatedMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthenticatedMatcher)2 DestinationIpMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.DestinationIpMatcher)2 PathMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.PathMatcher)2 CidrMatcher (io.grpc.xds.internal.Matchers.CidrMatcher)1 AuthConfig (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthConfig)1 DestinationPortMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.DestinationPortMatcher)1 InvertMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.InvertMatcher)1 SourceIpMatcher (io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.SourceIpMatcher)1