Examples with RangerResourceTrie org.apache.ranger.plugin.util.RangerResourceTrie used on opensource projects

Example 1 with RangerResourceTrie

use of org.apache.ranger.plugin.util.RangerResourceTrie in project ranger by apache.

the class RangerTagEnricher method setServiceTags.

public void setServiceTags(final ServiceTags serviceTags) {
    if (serviceTags == null || CollectionUtils.isEmpty(serviceTags.getServiceResources())) {
        LOG.info("ServiceTags is null or there are no tagged resources for service " + serviceName);
        enrichedServiceTags = null;
    } else {
        List<RangerServiceResourceMatcher> resourceMatchers = new ArrayList<>();
        RangerServiceDefHelper serviceDefHelper = new RangerServiceDefHelper(serviceDef, false);
        List<RangerServiceResource> serviceResources = serviceTags.getServiceResources();
        ResourceHierarchies hierarchies = new ResourceHierarchies();
        for (RangerServiceResource serviceResource : serviceResources) {
            final Collection<String> resourceKeys = serviceResource.getResourceElements().keySet();
            for (int policyType : RangerPolicy.POLICY_TYPES) {
                Boolean isValidHierarchy = hierarchies.isValidHierarchy(policyType, resourceKeys);
                if (isValidHierarchy == null) {
                    // hierarchy not yet validated
                    isValidHierarchy = Boolean.FALSE;
                    for (List<RangerServiceDef.RangerResourceDef> hierarchy : serviceDefHelper.getResourceHierarchies(policyType)) {
                        if (serviceDefHelper.hierarchyHasAllResources(hierarchy, resourceKeys)) {
                            isValidHierarchy = Boolean.TRUE;
                            break;
                        }
                    }
                    hierarchies.addHierarchy(policyType, resourceKeys, isValidHierarchy);
                }
                if (isValidHierarchy) {
                    RangerDefaultPolicyResourceMatcher matcher = new RangerDefaultPolicyResourceMatcher();
                    matcher.setServiceDef(this.serviceDef);
                    matcher.setPolicyResources(serviceResource.getResourceElements(), policyType);
                    if (LOG.isDebugEnabled()) {
                        LOG.debug("RangerTagEnricher.setServiceTags() - Initializing matcher with (resource=" + serviceResource + ", serviceDef=" + this.serviceDef.getName() + ")");
                    }
                    matcher.setServiceDefHelper(serviceDefHelper);
                    matcher.init();
                    RangerServiceResourceMatcher serviceResourceMatcher = new RangerServiceResourceMatcher(serviceResource, matcher);
                    resourceMatchers.add(serviceResourceMatcher);
                }
            }
        }
        Map<String, RangerResourceTrie<RangerServiceResourceMatcher>> serviceResourceTrie = null;
        if (!disableTrieLookupPrefilter) {
            serviceResourceTrie = new HashMap<>();
            for (RangerServiceDef.RangerResourceDef resourceDef : serviceDef.getResources()) {
                serviceResourceTrie.put(resourceDef.getName(), new RangerResourceTrie<RangerServiceResourceMatcher>(resourceDef, resourceMatchers));
            }
        }
        Set<RangerTagForEval> tagsForEmptyResourceAndAnyAccess = new HashSet<>();
        for (Map.Entry<Long, RangerTag> entry : serviceTags.getTags().entrySet()) {
            tagsForEmptyResourceAndAnyAccess.add(new RangerTagForEval(entry.getValue(), RangerPolicyResourceMatcher.MatchType.DESCENDANT));
        }
        enrichedServiceTags = new EnrichedServiceTags(serviceTags, resourceMatchers, serviceResourceTrie, tagsForEmptyResourceAndAnyAccess);
    }
}

Example 2 with RangerResourceTrie

use of org.apache.ranger.plugin.util.RangerResourceTrie in project ranger by apache.

the class RangerPolicyRepository method getLikelyMatchPolicyEvaluators.

private List<RangerPolicyEvaluator> getLikelyMatchPolicyEvaluators(Map<String, RangerResourceTrie> resourceTrie, RangerAccessResource resource) {
    List<RangerPolicyEvaluator> ret = null;
    Set<String> resourceKeys = resource == null ? null : resource.getKeys();
    if (CollectionUtils.isNotEmpty(resourceKeys)) {
        List<List<RangerPolicyEvaluator>> resourceEvaluatorsList = null;
        List<RangerPolicyEvaluator> smallestList = null;
        for (String resourceName : resourceKeys) {
            RangerResourceTrie trie = resourceTrie.get(resourceName);
            if (trie == null) {
                // if no trie exists for this resource level, ignore and continue to next level
                continue;
            }
            List<RangerPolicyEvaluator> resourceEvaluators = trie.getEvaluatorsForResource(resource.getValue(resourceName));
            if (CollectionUtils.isEmpty(resourceEvaluators)) {
                // no policies for this resource, bail out
                resourceEvaluatorsList = null;
                smallestList = null;
                break;
            }
            if (smallestList == null) {
                smallestList = resourceEvaluators;
            } else {
                if (resourceEvaluatorsList == null) {
                    resourceEvaluatorsList = new ArrayList<>();
                    resourceEvaluatorsList.add(smallestList);
                }
                resourceEvaluatorsList.add(resourceEvaluators);
                if (smallestList.size() > resourceEvaluators.size()) {
                    smallestList = resourceEvaluators;
                }
            }
        }
        if (resourceEvaluatorsList != null) {
            ret = new ArrayList<>(smallestList);
            for (List<RangerPolicyEvaluator> resourceEvaluators : resourceEvaluatorsList) {
                if (resourceEvaluators != smallestList) {
                    // remove policies from ret that are not in resourceEvaluators
                    ret.retainAll(resourceEvaluators);
                    if (CollectionUtils.isEmpty(ret)) {
                        // if no policy exists, bail out and return empty list
                        ret = null;
                        break;
                    }
                }
            }
        } else {
            ret = smallestList;
        }
    }
    if (ret == null) {
        ret = Collections.emptyList();
    }
    if (LOG.isDebugEnabled()) {
        LOG.debug("<== RangerPolicyRepository.getLikelyMatchPolicyEvaluators(" + resource.getAsString() + "): evaluatorCount=" + ret.size());
    }
    return ret;
}