acl

Documentation

Index

• Variables
• type ACL
  • func New(logger *logrus.Logger, loader Loader, disabledActions []string) (*ACL, error)
  • func (acl *ACL) Add(svc string, r Rule) error
  • func (acl *ACL) Decide(service, host string) (Decision, error)
  • func (acl *ACL) DisablePolicies(actions []string) error
  • func (acl *ACL) PolicyDisabled(svc string, p EnforcementPolicy) error
  • func (acl *ACL) Project(service string) (string, error)
  • func (acl *ACL) Rule(service string) *Rule
  • func (acl *ACL) Validate() error
  • func (acl *ACL) ValidateDomainGlobs(svc string, globs []string) error
• type Decider
• type Decision
• type DecisionResult
  • func (d DecisionResult) String() string
• type EnforcementPolicy
  • func PolicyFromAction(action string) (EnforcementPolicy, error)
  • func (p EnforcementPolicy) String() string
• type Loader
• type Rule
• type YAMLConfig
  • func (cfg *YAMLConfig) Load() (*ACL, error)
  • func (yc *YAMLConfig) ValidateConfig() error
• type YAMLLoader
  • func NewYAMLLoader(path string) *YAMLLoader
  • func (yl *YAMLLoader) Load() (*ACL, error)
• type YAMLRule

Variables

var EnforcementPolicies = map[string]EnforcementPolicy{
	"open":    Open,
	"report":  Report,
	"enforce": Enforce,
}

Types

type ACL

type ACL struct {
	Rules            map[string]Rule
	DefaultRule      *Rule
	GlobalDenyList   []string
	GlobalAllowList  []string
	DisabledPolicies []EnforcementPolicy
	*logrus.Logger
}

func New

func New(logger *logrus.Logger, loader Loader, disabledActions []string) (*ACL, error)

func (*ACL) Add

func (acl *ACL) Add(svc string, r Rule) error

Add associates a rule with the specified service after verifying the rule's policy and domains are valid. Add returns an error if the service rule already exists.

func (*ACL) Decide

func (acl *ACL) Decide(service, host string) (Decision, error)

Decide takes uses the rule configured for the given service to determine if

1. The host is in the rule's allowed domain
2. The host has been globally denied
3. The host has been globally allowed
4. There is a default rule for the ACL

func (*ACL) DisablePolicies

func (acl *ACL) DisablePolicies(actions []string) error

DisablePolicies takes a slice of actions (open, report, enforce), maps them to their corresponding EnforcementPolicy, and adds them to the global disabledPolicy slice.

func (*ACL) PolicyDisabled

func (acl *ACL) PolicyDisabled(svc string, p EnforcementPolicy) error

PolicyDisabled checks if an EnforcementPolicy is disabled at the ACL level

func (*ACL) Project

func (acl *ACL) Project(service string) (string, error)

Project returns the configured project for a service

func (*ACL) Rule

func (acl *ACL) Rule(service string) *Rule

Rule returns the configured rule for a service, or the default rule if none is configured.

func (*ACL) Validate

func (acl *ACL) Validate() error

Validate checks that the ACL that every rule has a conformant domain glob and is not utilizing a disabled enforcement policy.

func (*ACL) ValidateDomainGlobs

func (acl *ACL) ValidateDomainGlobs(svc string, globs []string) error

ValidateDomainGlobs takes a slice of domain globs and verifies they conform to smokescreen's domain glob policy.

Wildcards are valid only at the beginning of a domain glob, and only a single wildcard per glob pattern is allowed. Globs must include text after a wildcard.

Domains must use their normalized form (e.g., Punycode)

type Decider

type Decider interface {
	Decide(service, host string) (Decision, error)
}

type Decision

type Decision struct {
	Reason  string
	Default bool
	Result  DecisionResult
	Project string
}

type DecisionResult

type DecisionResult int

DecisionResult represents the result of checking the ACL

const (
	Allow DecisionResult = iota
	AllowAndReport
	Deny
)

func (DecisionResult) String

func (d DecisionResult) String() string

type EnforcementPolicy

type EnforcementPolicy int

EnforcementPolicy represents what the policy is for a service

const (
	Unknown EnforcementPolicy = iota
	Open
	Report
	Enforce
)

func PolicyFromAction

func PolicyFromAction(action string) (EnforcementPolicy, error)

func (EnforcementPolicy) String

func (p EnforcementPolicy) String() string

type Loader

type Loader interface {
	Load() (*ACL, error)
}

Loader is an interface used to return a parsed ACL from an abstract source

type Rule

type Rule struct {
	Project     string
	Policy      EnforcementPolicy
	DomainGlobs []string
}

type YAMLConfig

type YAMLConfig struct {
	Services        []YAMLRule `yaml:"services"`
	Default         *YAMLRule  `yaml:"default"`
	Version         string     `yaml:"version"`
	GlobalDenyList  []string   `yaml:"global_deny_list"`  // domains which will be blocked even in report mode
	GlobalAllowList []string   `yaml:"global_allow_list"` // domains which will be allowed for every host type
}

func (*YAMLConfig) Load

func (cfg *YAMLConfig) Load() (*ACL, error)

func (*YAMLConfig) ValidateConfig

func (yc *YAMLConfig) ValidateConfig() error

type YAMLLoader

type YAMLLoader struct {
	// contains filtered or unexported fields
}

func NewYAMLLoader

func NewYAMLLoader(path string) *YAMLLoader

func (*YAMLLoader) Load

func (yl *YAMLLoader) Load() (*ACL, error)

type YAMLRule

type YAMLRule struct {
	Name         string   `yaml:"name"`
	Project      string   `yaml:"project"` // owner
	Action       string   `yaml:"action"`
	AllowedHosts []string `yaml:"allowed_domains"`
}